AlbaniaLaw No. 124/2024, special categories of personal data, criminal records and children's data
Law No. 124/2024, Arts. 8(6), 9, 10 (special categories, criminal records and children's data)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 31 January 2025.
A sensitive categories rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Do not process sensitive data, meaning racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, genetic data, biometric data, health records, or sexual orientation, unless a listed exception applies, such as the data subject's explicit consent to a specified purpose.
- Treat a facial image or other biometric identifier as sensitive data requiring one of Article 9's listed exceptions before you may process it; the definition names a facial image as an example, so a derived faceprint is covered and the definition is not confined to a raw recording.
- Do not process sensitive data about race or ethnic origin unless the processing ensures justice and equality on that ground and carries appropriate safeguards, and put appropriate technical and security safeguards in place before relying on any Article 9 exception.
- Process the personal data of a minor for the online delivery of goods or services only where the minor is at least 16, and where the minor is younger, obtain consent given or authorized by a parent or legal custodian.
- Process criminal records only under the control of the competent authority or where a law specifically authorizes it, with adequate protection for the rights and freedoms of the data subject.
What it reaches
Excludes recording-derived identifiersNo
Obligation class
Prohibition, Consent, Biometric, Age verification
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 5(28) defines sensitive data as a special category revealing racial or ethnic origin, political opinions, religious belief or philosophical views, trade union membership, genetic data, biometric data, health records, or a person's sexual orientation.
Article 5(24) defines biometric data as personal data from specific technical processing of a person's physical, physiological, or behavioral characteristics that allows or confirms unique identification, naming a facial image as an example, so a derived faceprint counts and the definition is not confined to a raw recording.
Article 9(1) prohibits the processing of sensitive data outright, and Article 9(2) permits it only in the listed cases, beginning with the data subject's explicit consent to a specified purpose. Article 9(3) bars processing sensitive data about race or ethnic origin unless it ensures justice and equality on that ground and carries appropriate safeguards, and Article 9(4) permits every listed exception only where appropriate technical and security safeguards are in place.
Article 10 confines the processing of criminal records to the control of the competent authority or a specific legal authorization, with adequate protection for the data subject's rights and freedoms. Article 8(6) makes consent based processing of a minor's personal data for the online delivery of goods or services legitimate only where the minor is at least 16, and where the minor is younger, requires consent given or authorized by a parent or legal custodian.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometricsprocesses_voiceserves_minorshandles_health_records
Read the law
Official statute PDF hosted by the Commissioner for the Right to Information and Personal Data Protection (idp.al)
read in full (169,825 characters, untruncated)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.