LexLint.ioBeta

Know the law your code answers to.

Law / Kosovo

Law No. 06/L-082 on Protection of Personal Data, transfer of personal data to other states and international organisations

Law No. 06/L-082 on Protection of Personal Data, arts. 44-51 (transfer of personal data to other states and international organisations)

In force since .

A cross border transfer rule binding public and private bodies.

Obligation class
Transfer, Access restriction
Audit expectation
none

What it requires

  • Before transferring personal data to another state or an international organisation, confirm the destination is on the Agency's adequacy list, or ensure the transfer meets one of Article 49's other bases, such as the data subject's informed consent or the controller's own adequate safeguards.NIST Privacy FrameworkCT.PO-P2
  • Where you rely on Article 49, keep a record of the transfer authorisation as part of your Article 29 processing register.NIST Privacy FrameworkID.IM-P4
  • Do not disclose or transfer personal data in response to a foreign court judgment or administrative decision unless an international agreement between that state and Kosovo authorises recognition or enforcement of the request.NIST Privacy FrameworkCT.PO-P2
  • Expect the Agency's adequacy assessment to weigh the destination's rule of law and human rights record, the existence of an effective independent supervisory authority, its international commitments, and whether data subjects there have effective, enforceable rights and redress.
  • Expect the Agency to review its adequacy list at least every four years, and to amend or suspend a listing without retroactive effect if a state or organisation stops ensuring an adequate level of protection.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.IM-P4Data actions of the systems/products/services are inventoried.
  • CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Article 50 requires the authorizations the Agency gives for a transfer of personal data to another state or an international organization to be recorded in the register of processing activities, in line with Article 29(1)(5), which also names the destination and the safeguards documented for certain transfers. The rest of Articles 44 to 49 and 51 set the conditions for a transfer and say nothing of a record. The duty to make the register available to the Agency on request is Article 29(3), which this row does not cite, so the audit and access values are left empty. The cited articles contain no territorial reach clause, so the hook is empty.

Kind
Explicit
As of
Provision
Article 50 (authorizations for transfers abroad are entered in the register of processing activities under Article 29(1)(5))
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 44 permits transferring personal data to another state or an international organisation only in accordance with this law and only where that state or organisation ensures an adequate level of data protection.

Articles 45 and 46 let the Agency formally decide that a state or international organisation, or a specified sector within it, ensures an adequate level of protection, maintain a public list of those states and organisations, and adopt a decision the competent European Union body has already made to the same effect.

Article 47 lists the factors the Agency weighs in an adequacy decision, including the rule of law and human rights record, the existence of an effective independent supervisory authority, the third state's or organisation's international commitments, and the data subject's effective and enforceable rights and administrative and judicial redress. Article 47(3) requires the Agency to review its adequacy list at least every four years.

Article 49 lets the Agency authorise a transfer to a state or organisation that does not ensure an adequate level of protection where one of the listed conditions is met, including another law or binding international treaty, the data subject's informed consent, necessity for performing or entering a contract, an important public interest, protecting the data subject's life or body, legal claims, a public register open to consultation, or the controller's application of adequate safeguards.

Article 50 requires the Agency's transfer authorisations to be recorded under Article 29(1)(5)'s processing-register rule. Article 51 lets a foreign court judgment or administrative authority decision demanding a controller or processor transfer or disclose personal data be recognised or enforced only on the basis of an international agreement between the requesting third state and the Republic of Kosovo.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .