Law No. 06/L-082 on Protection of Personal Data, remedies, the Agency, inspections and penalties

Article 52 gives a data subject the right to complain to the Agency for Information and Privacy that processing of their personal data breaches this law, without prejudice to other administrative or judicial remedies.

Articles 53 and 54 give a person a right to an effective judicial remedy against a legally binding Agency decision, against the Agency's failure to handle or report on a complaint within three months, and against a controller or processor whose processing the person believes has violated their rights.

Article 55 lets a data subject authorise a representative body, organisation or non-profit association active in data protection to lodge a complaint, exercise judicial remedies, and claim compensation on their behalf.

Article 56 gives any person who has suffered material or non-material damage from a breach of this law the right to compensation from the controller or processor, holds every controller and processor involved in the same processing jointly liable to guarantee effective compensation, and excuses a controller or processor that proves it bears no responsibility for the damage.

Article 57 establishes the Agency for Information and Privacy as an independent authority responsible for overseeing this law, answerable to the Assembly of Kosovo, acting free from external influence and taking instructions from no one.

Article 58 places the Agency under a Commissioner elected by the Assembly of Kosovo for a five-year term, renewable once, and Article 61 lists the grounds on which the Commissioner's mandate ends, including resignation, a criminal conviction carrying more than six months' imprisonment, or dismissal by the Assembly for breaching this law.

Articles 64 and 65 give the Agency its core duties, including supervising this law's implementation, advising public and private bodies, deciding complaints, conducting inspections, and cooperating with other supervisory authorities in Kosovo and abroad. Articles 68 to 70 let the Agency conduct inspections and controls on its own initiative or on a complaint, and let inspection officers examine and seize documentation, computers and equipment relevant to personal data processing.

Article 71 lets an inspection officer who finds a violation order the correction of irregularities, including destruction, blocking or anonymisation of personal data, temporarily halt unlawful or non-compliant processing, order compliance with a data subject's rights request, impose a fine for violations of this law, or issue a written warning for minor violations.

Article 91 sets the criteria the Agency weighs in fixing an administrative fine, including the nature, gravity and duration of the violation, whether it was intentional or negligent, the categories of personal data affected, the degree of cooperation with the Agency, and any prior relevant violation.

Article 92 fines a legal person or independent-activity person twenty thousand to forty thousand euros for a general violation such as processing without a lawful basis or consent, unlawfully processing special categories or criminal-offence data, or failing to inform a data subject, with lower tiers set for a responsible individual within that legal person, a responsible individual within a state body, and an individual acting alone.

Articles 93 to 104 set separate fine tiers for violations of the contracted-processing, security, direct-marketing, video-surveillance, biometric, building-entry-log, filing-system-interconnection and Data Protection Officer rules, ranging from two hundred to forty thousand euros depending on the provision and the offender's category.

Article 105 lets the Agency fine a serious and large-scale violation of personal data provisions twenty thousand to forty thousand euros, or, for a company or undertaking, two to four percent of its total annual worldwide turnover of the preceding financial year, in accordance with Regulation (EU) 2016/679.

Article 106 states that imposing these penalties does not exclude other liabilities under other legislation, including a controller's or processor's liability for damage from unlawful processing and criminal liability under the Criminal Code of the Republic of Kosovo.