Places automated calls, in Albania

Law No. 124/2024 (Ligj Nr. 124/2024) On the Protection of Personal Data, Arts. 1-8, 11, 22-38, 43-46 (general provisions, lawful basis, consent, controller and processor obligations, and specific-purpose exceptions), in force 31 January 2025 · Read the law's page

• Establish one of the lawful bases Article 7 lists, such as the data subject's consent, contractual necessity, a legal obligation, vital interests, a public task, or a legitimate interest that does not override the data subject's rights, before processing personal data of a person in Albania.
• Demonstrate that consent was given, present a request for consent separately from other matters in clear and plain language, and let the data subject withdraw consent at any time as easily as it was given.
• Implement data protection by design and by default in every processing tool and process, and appoint a data protection officer where processing is carried out by a public authority, requires regular and systematic large scale monitoring of data subjects, or involves large scale processing of sensitive data or criminal records.
• Appoint a representative located in Albania and notify the Commissioner in writing of that representative's identity when you target people in Albania from outside the country, unless the processing is occasional, small scale, and unlikely to risk fundamental rights, or you are a public authority.
• Maintain written and electronic records of processing activities naming the controller, the purposes, the categories of data and recipients, any transfer outside Albania, and the envisaged erasure periods, and make the records available to the Commissioner on request.
• Implement technical and organizational security measures appropriate to the risk, including pseudonymization and encryption, the ability to restore access after an incident, and a process for regularly testing their effectiveness.
• Keep personal data confidential wherever an employee or processor has access to it for professional reasons, bind that confidentiality into every processor contract and employment contract, and continue it after the contract or employment ends.
• From two years after the law's publication in the Official Gazette, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of a person in Albania, and seek the Commissioner's opinion in advance where the risk cannot be mitigated; until then, Articles 31 and 32 do not themselves bind.
• Where personal data are prepared for journalistic, academic, literary or artistic publication, use them for no other purpose and do not identify a minor or a crime victim in the published material without the guardian's consent or a court's permission.

Law No. 124/2024, Arts. 12-19, 21 (rights of the data subject) · Read the law's page

• Tell a data subject, in concise and plain language and with particular care where the information is addressed to a minor, your identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available to them.
• Answer a data subject's request under Articles 13 to 20 as soon as possible and no later than 30 days after receiving it, extendable to 60 days for complex or numerous requests, and free of charge unless the request is manifestly unfounded or excessive.
• Give a data subject access to their personal data, its purpose, retention period, source, and recipients within 30 days of the request, and correct or erase inaccurate, unlawfully processed, or no longer necessary personal data within 30 days, telling every recipient the data were disclosed to of the change.
• Provide a data subject their personal data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where technically feasible.
• Stop processing a data subject's personal data for direct marketing, including related profiling, as soon as they object, without requiring a reason, and tell them of this right explicitly and separately at the first communication.