Data Protection in Albania

Collection and processing in Albania

Data Protection Law states that fair and lawful processing is one of the core principles for the protection of personal data. Personal data shall be collected and/or processed for specific, clearly defined and legitimate purposes. 

Personal data protection is based on data adequacy, data which are relevant to the purpose of their processing and not excessive in relation to such purpose, as well as data accuracy, data which are updated and complete. 

Additionally, the data are to be kept in a form that allows the identification of data subjects for no longer than it is necessary for the purpose for which they were collected or further processed. 

Data Protection Law provides for the legal criteria for personal data processing, sensitive data processing and special processing of data.

Personal data may be processed only: 

  • with the consent of the personal data subject;
  • if necessary, for the performance of a contract to which the data subject is a party or in order to negotiate or amend a draft/contract at the request of the data subject;
  • to protect the vital interests of the data subject;
  • to comply with a legal obligation of the controller;
  • for the performance of a legal task of public interest or in exercise of powers of the controller or of a third party to whom the data are disclosed;
  • if the processing is necessary for the protection of the legitimate rights and interests of the controller, the recipient or any other interested party. However, in any case, the processing of personal data cannot be in clear contradiction with the data subject's right to protection of personal life and privacy. 

The processing of personal data in the field of national security, criminal law and crime prevention, shall be performed by official authorities as stipulated in the law. 

The controller or processor that processes personal data for the purpose of offering business opportunities or services may use personal data obtained from a public data list. The controller or processor cannot process these data further, if the data subject has expressed his disagreement or has objected their further processing. 

It should be noted that additional personal data cannot be added to the data obtained from the public data list without the consent of the data subject. However, the controller is allowed to keep these personal data in its filing system even after the data subject has objected the processing. Such data can be used only if the data subject gives his content. 

Collection of personal data which is related to a data subject solely for reasons of direct marketing is allowed only if the data subject has given his explicit consent. 

Sensitive data may be processed only if: 

  • the data subject has given his consent, which may be revoked at any given moment making any further processing of data illegal;
  • it is in the vital interest of the data subject or another person and the data subject is physically or mentally incapable of giving his consent;
  • it is authorized by the responsible authority for an important public interest, under adequate safeguards;
  • it is related to data which are widely made known by the data subject or it is necessary, for exercising/protecting a legal right;
  • the data are processed for historic, scientific or statistical purposes, under adequate safeguards;
  • the data are required for the purposes of preventive medicine, medical diagnosis, the provision of health care, treatment or management of health care services and the data are used by the medical personnel or other persons with the obligation to preserve confidentiality;
  • the data are processed by non-profit political, philosophical or religious organizations and trade unions for purposes of their legitimate activity, only for members, sponsors, or other persons related to their activity. These data shall not be disclosed to a third party without the consent of the data subject unless otherwise stipulated by law.
  • the data processing is necessary for the purpose of fulfilling the legal obligations and specific rights of the controller in the field of employment in compliance with the Labour Code. 

Special processing of data: 

  • Processing for historical, scientific and statistical purposes: 

Personal data collected for any purpose, may be further processed for historic, scientific or statistical purposes, provided that the data is not processed in order to take measures or decisions related to an individual. 

The transmission of sensitive data for scientific research shall take place only in case of an important public interest. Personal data shall be used exclusively by individuals who are bound by the obligation of confidentiality. When data processing is made in a manner that allows the identification of the data subject, the data should be encrypted immediately in order for the subjects to be no longer identifiable. Encrypted personal data shall be used exclusively by individuals bound by the obligation of confidentiality. 

  • Processing of personal data and freedom of expression: 

The Commissioner has issued an Instruction No. 31, dated 27 December 2012 "On the Determination of the Conditions and Criteria for the Exemption from the relevant Obligations in Personal Data Processing for Journalism, Literature or Artistic Purposes". The exemptions for these purposes shall be allowed up to the extent that they reconcile the right of personal data protection with the rules governing the right to freedom of expression.  

Continue reading

  • no results

Previous topic
Back to top