AlbaniaLaw No. 124/2024, rights of the data subject
Law No. 124/2024, Arts. 12-19, 21 (rights of the data subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- Tell a data subject, in concise and plain language and with particular care where the information is addressed to a minor, your identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available to them.NIST Privacy FrameworkCM.AW-P1
- Answer a data subject's request under Articles 13 to 20 as soon as possible and no later than 30 days after receiving it, extendable to 60 days for complex or numerous requests, and free of charge unless the request is manifestly unfounded or excessive.NIST Privacy FrameworkCT.PO-P3
- Give a data subject access to their personal data, its purpose, retention period, source, and recipients within 30 days of the request, and correct or erase inaccurate, unlawfully processed, or no longer necessary personal data within 30 days, telling every recipient the data were disclosed to of the change.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P5
- Provide a data subject their personal data in a structured, commonly used, machine readable format on request, and transmit it directly to another controller where technically feasible.NIST Privacy FrameworkCT.DM-P2
- Stop processing a data subject's personal data for direct marketing, including related profiling, as soon as they object, without requiring a reason, and tell them of this right explicitly and separately at the first communication.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 12 to 19 and 21 set the content of the information a controller gives, the 30 day response period (extendable to 60), the rights of access, rectification, erasure, restriction, portability and objection, and the restrictions on them. None of them requires a log or a record to be kept. Article 12(5) puts the burden of proving that a request is manifestly unfounded or excessive on the controller, which is a rule of proof and names no record. The record duties of the Law are in other sections.
- Kind
- None
- As of
What this law does
Article 13 requires the controller to tell a data subject its identity and contact details, the purposes and legal basis of processing, the recipients, any transfer abroad, the retention period, and the rights available, and Article 12 requires that information to be concise, transparent, and in plain language, with particular care for information addressed to a minor.
Article 12(4) requires the controller to act on a data subject's request as soon as possible and no later than 30 days after receipt, extendable to 60 days for complex or numerous requests, and Article 12(5) makes that response free of charge unless the request is manifestly unfounded or excessive. Article 14 gives a data subject the right to access their personal data, its purpose, retention period, source, and recipients within 30 days of the request.
Article 15 gives a right to rectification of inaccurate data and to erasure on the listed grounds, both within 30 days, and requires the controller to inform every recipient the data were disclosed to of the change. Article 16 gives a right to be forgotten against search engines that continue to surface outdated and reputationally damaging results.
Article 17 gives a right to restrict processing, and Article 18 gives a right to receive personal data in a structured, commonly used, machine readable format and to have it transmitted directly to another controller where technically feasible. Article 19 gives a right to object to processing based on a public task or legitimate interest, and an unqualified right to object to direct marketing and its related profiling at any time without giving a reason.
When LexLint raises it
When your app profile says your app sends automated outreach, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .