Makes health care decisions, in Kosovo

Law No. 06/L-082 on Protection of Personal Data, art. 21 (automated individual decisions) · Read the law's page

• Do not subject a data subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless a listed exception applies and you provide the required safeguards, including the right to obtain human intervention.

Law No. 06/L-082 on Protection of Personal Data, arts. 11-20, 22, 74 (rights of the data subject) · Read the law's page

• Answer an access, rectification, erasure, restriction, portability or objection request within one month of receipt, extendable by two further months for complex or numerous requests, and tell the data subject about any extension within the first month.
• Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights, within one month where the data came from elsewhere.
• Give a data subject a copy of their personal data on request, along with the purposes, categories, recipients, storage period and other Article 14 information, free of charge for the first copy.
• Correct inaccurate or incomplete personal data on request without undue delay.
• Erase personal data on request without undue delay where it is no longer necessary, consent is withdrawn with no other lawful basis, the data subject objects with no overriding ground, it was processed unlawfully, a legal obligation requires erasure, or it was collected under the child information-society-service consent rule.
• Restrict processing on request while accuracy is contested, in place of erasure where the data subject prefers restriction, where you no longer need the data but the data subject does for legal claims, or while an objection is being verified, and tell the data subject before lifting the restriction.
• Pass on any rectification, erasure or restriction to every recipient the data were disclosed to, unless that is impossible or disproportionately difficult, and tell the data subject who those recipients are on request.
• Give a data subject their data in a structured, commonly used, machine-readable format and transmit it to another controller on request where processing rests on consent or a contract and is automated.
• Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.
• Where you rely on Article 74's specific direct-marketing procedure, stop the marketing use within eight days of receiving a written objection and confirm that in writing to the data subject within a further five days.