At a time when digital technology has revolutionized the way information flows across national borders, the sharing of personal data has become an inevitable and increasingly important process. As the personal data of Kosovo citizens travels across global platforms, the main challenge is ensuring the security and privacy of this information. But how can we ensure that the personal data of Kosovo citizens remains protected when it crosses international borders?
Law No. 06/L-082 on Personal Data Protection, which is intended to be aligned with Regulation (EU) 2016/679 of the European Parliament and of the Council, commonly known as the General Data Protection Regulation (GDPR), provides a clear legal framework for protecting personal data in the context of international transfers.
The GDPR establishes the legal framework for the protection of personal data and its free movement within the European Union. The alignment of Kosovo’s legislation with this regulation demonstrates the country’s commitment to achieving the highest international standards, with the hope that Kosovo will soon be recognized as a country providing an adequate level of data protection, thereby facilitating the transfer of personal data of EU citizens to Kosovo.
It is a fact that Kosovo faces significant challenges in the field of personal data protection domestically. The implementation of data protection rules and the development of the necessary supervisory capacities remain issues requiring continuous improvement. However, this article focuses on the mechanisms and rules governing international transfers of personal data, a subject of particular importance in today’s interconnected digital world.
1. Transfer of Personal Data to Countries and Organizations Providing an Adequate Level of Protection
Article 45 of the Law on Personal Data Protection provides that the transfer of personal data outside Kosovo is permitted if the receiving country or organization ensures an adequate level of protection for such data.
The Information and Privacy Agency is responsible for assessing and approving the list of countries and international organizations that meet these protection standards. Countries and international organizations included on this list are considered to provide sufficient security and privacy safeguards for the personal data of Kosovo citizens.
Before approving a country or international organization, the Agency verifies several key elements, including:
- Ensuring that personal data will be used exclusively for the purposes for which it was transferred and that the purpose of processing will not be changed without the data subject’s authorization.
- Guaranteeing that appropriate technical and organizational safeguards are in place to protect personal data during its processing and transfer.
- Ensuring that the data will not be transferred onward without obtaining additional authorization and that the data subject retains the right to determine how their personal data is used and transferred.
The list of countries and organizations providing an adequate level of protection is reviewed at least every four years, as prescribed by law, to ensure continued compliance with international personal data protection standards.
In April 2024, the Agency adopted Decision No. 31/2024, updating the list of countries providing an adequate level of personal data protection. This decision replaced the previous decision adopted in 2021 and, for the first time, included the United States of America as a country providing an adequate level of protection. On the other hand, the Republic of Albania remained excluded from this list.
Amendments to and suspensions of this list are carried out in accordance with strict criteria, ensuring that the protection of Kosovo citizens’ personal data remains a priority, regardless of changes in international standards.
Such amendments do not have retroactive effect, meaning that transfers carried out before the changes are not affected by subsequent suspensions.
2. Transfer of Personal Data to Countries That Do Not Provide an Adequate Level of Protection
When a country or international organization is not included on the list of those providing an adequate level of protection, the transfer of personal data is not automatically prohibited.
Pursuant to Article 49 of the Law on Personal Data Protection, such transfers may take place in certain specific circumstances, provided that the data controller obtains special authorization from the Information and Privacy Agency.
These circumstances include:
- Where the data subject has given explicit and informed consent to the transfer.
- Where the transfer is necessary for the performance of a contract between the data subject and the data controller.
- Where the transfer is necessary for legal reasons or to protect the vital interests of the data subject.
To obtain such authorization, the data controller must submit sufficient evidence demonstrating that the personal data will be protected both during and after the transfer.
The Agency examines the technical and organizational safeguards, the categories of personal data involved, and the purpose of the transfer to ensure that the fundamental rights and freedoms of the data subject are protected.
Data Protection in Accordance with International Standards
Kosovo’s Law on Personal Data Protection is based on international standards, particularly the General Data Protection Regulation (GDPR).
Although Kosovo has not yet adopted Standard Contractual Clauses (SCCs) for international data transfers, the existing legal framework seeks to ensure that citizens’ personal data remains protected during international transfers through strong legal mechanisms and procedures supervised by the Information and Privacy Agency.
Conclusion
In today’s digital world, the protection of personal data during international transfers must be a priority for the Republic of Kosovo.
Through the Law on Personal Data Protection and the continuous supervision of the Information and Privacy Agency, Kosovo is establishing a foundation to ensure that its citizens’ personal data remains protected, regardless of where it is processed or transferred.
Nevertheless, Kosovo still has considerable work to do to achieve the required standards in this particularly sensitive area of global importance.
