Law No. 124/2024, Commissioner, remedies, liability and penalties

Article 75 establishes the Commissioner for the Right to Information and Personal Data Protection as an independent public legal person responsible for monitoring and supervising this law.

Article 78 has the Assembly appoint the Commissioner for a 7 year renewable term on the Council of Ministers' proposal, and Article 82 gives the Commissioner authority to investigate on its own initiative or on a complaint, issue guidelines, approve codes of conduct and certification schemes, and authorize cross border transfers.

Article 83 gives the Commissioner remedial powers including warnings, notices, orders to comply with a data subject's rights, restrictions or bans on processing, orders to communicate a breach to data subjects, revocation of a certification, and suspension of a transfer, alongside its administrative sanction power.

Article 86 lets a data subject lodge a complaint with the Commissioner free of charge, and Article 87 lets any person appeal a Commissioner act, or a data subject sue, before the competent administrative court.

Article 88 gives a data subject a right to compensation for financial or non-financial damage from an infringement of this law, separate from and without prejudice to the administrative complaint route, with a controller or processor liable unless it proves it was not responsible for the event causing the damage. Article 89 lets a data subject authorize a public interest entity or association to lodge a complaint and exercise these rights on their behalf.

Article 94(2) fixes the highest administrative fine tier at 2,000,000,000 Albanian Lek or 4% of total annual worldwide turnover, whichever is higher, for failing to apply the basic lawfulness and consent principles, violating a data subject's rights, an unlawful cross border transfer, or breaching the specific purposes rules, and the same tier punishes non-compliance with a Commissioner order.

Article 94(1) fixes a lower tier at 1,000,000,000 Lek or 2% of turnover for the minors' online consent rule, the non-identification rule, and most of the controller and processor obligations chapter other than Article 22 itself. Article 95 lets a controller or processor appeal a fine to the competent court, and collected fines go to the state budget.