Albania: Law No. 8517 of 1999 on the Right to Information and Protection of Personal Data

In virtue of articles  23, 35, 81 para. 1 of the Constitution, on the proposal of the Council of Ministers, the Assembly of the Republic of Albania,

DECIDED:

CHAPTER I: GENERAL PROVISIONS

Article 1: Scope of the law

The present law guarantees the enjoyment of the right to information on data of public interest, as well as protection of personal data while observing the fundamental rights and freedoms, personal dignity and confidentiality.

Article 2: Definitions

For the purposes of this law:

a)   Personal data - shall mean any data relating directly or indirectly to an identified or identifiable natural/legal person;

b)   Public authority - shall mean any central or local organ of executive branch, central or local elected organ, courts, the office of the attorney general, public agencies as well as persons who exert public or government functions;

c)   Entities which provide public services - shall mean all those units which provide goods and services, such as: education, health care, telecommunication, production and distribution of electrical power, maintenance of public utilities or any other service of a public nature regardless of their funding and ownership;

d)   Public corporations - shall mean all those private law subjects that are directly or indirectly controlled by a public authority;

e)   Data of public interest - shall mean any act or implementative action thereon, rules, proceedings, notes, written opinions, records as well as any other data processed by those subjects envisaged in the paragraphs "b", "c" and "d" of this article, not coming under the definition of personal data;

f)    Data processing - shall mean any act carried out with or without support of electronic equipment with a view to accumulation, registration, organisation, protection, elaboration, modification, selection, extraction, confrontation, usage, suspension, communication, distribution, deletion and destruction of data;

g)   Data subject - shall mean any natural or legal person to whom the personal data relates;

h)   Person in charge of data processing - shall mean subjects envisaged in paragraphs "b", "c", "d" and any other person legally entrusted with the processing of personal data of others;

i)    Data user - shall mean the subjects envisaged in paragraphs "b", "c", "d" as well as any natural or legal person, other than the data subject, authorised for the processing of data by the person in charge of data processing.

j)    Anonymous data - shall mean any data whereby no legal or natural person can be identified directly or indirectly;

k)   Public - shall mean at least one natural or legal person, domestic or foreigner.

Article 3: Exemptions

The provisions of this law shall not apply on the following cases:

a)   Processing of personal data from the data subject;

b)   Processing of anonymous data;

c)   Classified data;

d)   Data obtained in the course of criminal investigations and court proceedings;

e)   Processing of data for the purposes of national security and crime prevention.

The second Chapter of the present law that deals with the right to information on data of public interest does not apply to those data that are qualified as intellectual property and/or trade secrets.

CHAPTER II: Freedom of information

Article 4: Right to information

Everyone is untitled to get information on data of public interest without being obliged to explain the motives of such request.

Subjects envisaged in paragraphs "b", "c", "d" of article 2 shall issue rules of procedure and shall set up structural and practical facilities in order to provide the public with exact, speedy and adequate information.

Any person requesting a data of public interest shall describe properly such data and also express his/her preference as to the format in which the data is supplied.

The data shall be supplied orally only if the interested person expresses his/her consent for such manner of supply in a written form.

Article 5: Restrictions

If the requested data is found to be personal data, subjects envisaged in paragraphs "b", "c", "d" of article 2 shall act in compliance with the provisions envisaged in the chapter on personal data protection.

If the requested data falls under the categories envisaged in paragraphs "c", "d", "e" and "f" of article 3, the subject envisaged in paragraphs "b", "c", and "d" of article 2 shall refuse the supply of such data and shall provide the interest party with a written declaration expressing the reasons of such refusal.

When the limitations provided for in the first and second paragraphs of this article, interest only a part of the requested data, the remaining part of such data shall be considered of public interest and shall be processed accordingly without infringing the part whose processing is limited or excluded.

Article 6: Personal data with limited protection

Shall not be refused to the public the personal data of:

a.   persons vested with state functions;

b.   employees of civil service;

c.   subjects which offer public services,

Only when these data are related to their legally required qualities for the performing of their duties.

Article 7: Information obligatory available to the public

Subjects envisaged in paragraphs "b", "c", "d" of article 2:

1.   shall make available to the public in sufficient quantity and appropriate formats the following information:

a)            information as where its central and local organs are situated, the employees from whom, and the methods whereby, the public may obtain information, make submittals or requests, or obtain decisions;

b)            statements on methods and procedures by which its functions are channelled and determined;

c)   rules and methods on how different forms can be obtained, and instructions as to the scope and contents of all papers, reports, or examinations;

d)   general legal rules based on which the subject operates as well as the adopted policies and the changes thereon.

2.   In compliance with the existing legislation, regulations and other publicly known rules they make available to the public, upon request, for review and duplication the following data:

a)   final decisions on a given case, including concurring and dissenting opinions as well as implementative orders;

b)            administrative staff manuals and instructions to staff that affect a member of the public;

Copies of data that have been given priory to at least one member of the public, regardless of their format.

Article 8: Time limits

Subjects envisaged in paragraphs "b", "c", "d" of article 2, shall respond to the request for information on data of public interest within the shortest possible time.

The request shall be upheld or rejected within a maximum of 10 days from the day it was lodged.

The information shall be provided within a maximum of 30 days from the day of its acceptance.

Article 9: Reinstatement of time limits

When the processing of the requested data, for objective and unforeseen obstacles, exceeds the time limit envisaged in article 8, the requested shall immediately notify the interested person in a written form for such obstacle and offers him a second, reasonable time limit. The new time limit begins at the termination of the former.

The new time limit shall not be longer than 30 days and shall not be more than one reinstatement of time limits.

The interested party shall express in written his/her consent on the reinstatement of the time limit.

Article 10: Fees for the supply of information

The supply for information on data of public interest may be subjected to fees if such supply causes expenses to be born by the subjects envisaged in paragraphs "b", "c", and "d" of article 2. The fees are established in advance.

Fees for ordinary and standardised services are made available to the public. Fees for other services are decided on a case by case basis and are communicated to the interested parties at the moment of the acceptance of the request.

The fees shall not exceed the direct costs incurred for the supply of the data. The direct costs include both manpower and other direct material costs necessary for the processing of the requested data.

data envisaged in article 7, para. 1 are free of charge. The fees for the data envisaged in article 7, para. 2 shall include only the direct costs for their duplication.

Procedures and decisions for the levying of the fees are themselves considered data of public interest.

CHAPTER III: PERSONAL DATA PROCESSING

Article 11: General Rule

Personal data shall not open to processing by the public and/or subjects envisaged in paragraphs "b", "c", "d" of article 2, with the exception of the cases foreseen in article 3, paragraphs  "a", "c" and "e", article 6 and in other cases as foreseen by law.

 SECTION I: Condition for the processing of personal data

Article 12: Modalities of personal data processing

Personal data processing shall be conducted:

a)   qas envisaged by law;

b)   following a definite, clear and legitimate purpose;

c)   in an accurate way and making use of updated data;

d)   within the scope of the original purpose and the envisaged time limits;

e)   in a safe and harmless way;

f)    making use of only such data that are relevant and necessary for the accomplishment of the original purpose;

g)   in a way which permits identification of the data subject for no longer than is required for the purpose for which those data are stored.

Article 13: Notification of data subject

Prior to personal data processing, the person in charge of the data processing shall notify the data subject at least as to:

a)   the name and address of the person in charge of data processing as well as all other persons who will process the data;

b)   the purpose or purposes of the processing;

c)   a description of the category or categories of personal data to be processed;

d)   the recipients or categories of recipient to whom the data might be disclosed;

e)   possibility of transfer of data to third countries;

f)    a general description on the security of processing.

Article 14: The Person in Charge of Data Processing

In order to effectively guarantee the fair processing of personal data, the person in charge of data processing and any other person involved with the processing shall meet certain requirements relating to experience, reliability and technical capacity.

Other subjects who deal with data processing shall observe the rules determined by the person in charge of data processing.

Any person who processes personal data shall be authorised in a written from by the person in charge of data processing, safe for the cases when the processing is required by law.

The authorised data user may not forward the data to any third party.

Article 15: Security of processing

The person in charge of data processing must implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves information technology and the transmission of data over a network, and against all other unlawful forms of processing.

Such measures shall ensure a level of security proportional to the risk posed by the processing and the nature of the data to be protected.

SECTION II: Rights of the data subject

Article 16: Preliminary consent clause

Personal data processing by other subjects shall only be permitted if the data subject has unambiguously given his/her consent.

The preliminary consent may relate to the entire processing procedure or to one or more parts of the said procedure.

The preliminary consent shall be deemed valid only if it was given freely, in a written form and upon the condition that the data subject is notified in accordance with the requirements of article 13 of the present law.

Article 17: Waiving of the preliminary consent

The preliminary consent of the data subject is not necessary in the following cases:

a)   when the processing of data is necessary for the fulfilment of a contractual relationship in which the data subject is a party or intends to become a party;

b)   the processing of data is necessary for the fulfilment of a legal obligation pending on the data subject;

c)   the processing of data is necessary for the fulfilment of a duty of public or state interest by the data user;

d)   when the processed data are extracted by public registries, lists, acts or other publicly known documents;

e)   when the processing of data is necessary for safeguarding life and physical integrity of the data subject or of a third person, provided that the data subject is unable to provide his/her consent due to physical or legal impediment;

f)    when processing of data is needed in the course of criminal investigations and court proceedings.

Article 18: Right of access to one's own personal data

Every person has the right of access, at any time, in the processing of his/her personal data. The person in charge with the data processing and other persons involved in the processing of personal data shall provide any requested information to the data subject with 10 days form the day when the request was lodged.

Article 19: The data subject right to object

The data subject has the right to object any processing of his/her personal data, safe in the cases foreseen in articles 3 and 17 of the present law.

Any person is entitled to request the correction or deletion of false or inaccurate data or any other data that are collected in violation of the law.

The person in charge of data processing shall respond to the request of the data subject in a written form and within 15 days from the day when the request was lodged.

Article 20: Forwarding of personal data abroad

Personal data may only be forwarded from the Republic of Albania to a foreign user, when:

a)   the data subject has  unambiguously given his/her consent;

b)   is permitted by law, and;

the conditions of data processing, as defined with by the present law, are satisfied by the foreign jurisdiction where the user operates.

CHAPTER IV: PEOPLE'S ADVOCATE AS THE SUPERVISOR OF THE FREEDOM OF INFORMATION AND PERSONAL DATA PROTECTION

Article 21

The Advocate of the People supervises the implementation of the present law.

The Advocate of the People designates one of the commissioners to deal with the right to information for the data of public interest and the protection of personal data.

Article 22

The powers of the Advocate of the People in the field of the freedom of information for the data of public interest and personal data protection are regulated by the Law "On the Advocate of the People" and the provisions of the present law.

Article 23

In the case of any violation of the provisions of this law, the Advocate of the People shall require the interruption of the actions and/or omissions that have caused the violation and the taking of measures in order to avoid such violation.

The subject to whom the request is addressed shall notify the Advocate of the People, in a written form, about:

1.   the interruption of the processing of data within 3 days from the submission of the request;

2.   the taking of the requested measures within 30 days from the submission of the request.

If the abovementioned subject does not comply with the request of the Advocate of the People, he/she takes all necessary steps as envisaged by the law "On the Advocate of the People" as well as inform the public in relation with the fact of the illegal use of the data, the identity of the violator and the data that are being processed.

Article 24: The Personal Data Protection Registry

A personal data protection registry is created at the Office of the Advocate of the People.

Before the initiation of the data treatment, the person in charge of data processing shall notify the Advocate of the People who enlists such notification in the Personal Data Protection Registry. The notification shall contain the following information:

a)   the purpose of data treatment;

b)   categories of data that are going to be treated and the legal ground for the treatment;

c)   the data subjects that are effected by the data treatment;

d)   categories and subjects to whom the data are conveyed;

e)   the data sources;

f)    time limits for the treatment of data;

g)   technical facilities for the treatment;

h)   name and address of the data user, the address of the place where the data shall be handled as well as a copy of the written authorisation envisaged in article 14 of the present law;

i) any foreign countries to which the data may be transferred.

Article 25: The data registry number

As from the moment of the registration, the person in charge of data protection shall be given e registry number. The registry number shall be communicated to the person in charge of data protection.

Any change with regard to the information specified in article 24, shall be reported to the Advocate of the People within 8 days from their occurrence.

The Advocate of the People shall reflect the changes into the registry.

CHAPTER V: The Appeal

Article 26: General Rule

The violations of the provisions of this law, insofar as they do not qualify as criminal offences, constitute administrative offences and are regulated by the provisions of the law "On Administrative Offences".

Article 27: Administrative Appeal

Everybody who believes that his/her rights, as recognised by this law, are infringed, is entitled to lodge an administrative appeal.

The procedure for the administrative appeal is provided for by law.

Article 28: Judicial Appeal

Everybody who believes that his/her rights, as recognised by this law, are infringed, is entitled to lodge a judicial appeal.

The procedure for the judicial appeal is provided for by the provisions of the Code of Civil Procedure on judicial review of administrative action.

Article 29: The People Advocate's Appeal

Everybody who believes that his/her rights, as recognised by this law, are infringed, is entitled to lodge an application to the Advocate of the People.

The procedure for the People's Advocate appeal is provided for by the provisions of the law "On the Advocate of the People".

Article 30: Causation of the Damage

Everybody is entitled to seek reparation for the infringement of his/her rights, as recognised by this law, if such infringement causes damage.

The procedure for the claiming and the awarding of the reparation is provided for by law.

CHAPTER VI: TRANSITORY AND FINAL PROVISIONS

Article 31

All those subjects whose activity is totally or partially subjected to the provisions of this law, shall take all necessary measures of a technical-administrative nature within one year from the day of the entry into force of this law, in order to adjust their activity to the provisions of the present law.

Article 32: Entry into Force

The present law shall come into effect 15 days after its publication in the Official Gazette.

Skender GJINUSHI

SPEAKER OF THE ASSEMBLY