KOSOVO Law and Practice Contributed by: Ardian Rexha, Nora Grajcevci Mehmeti and Vjollca Hiseni, Rex Law Partners
Foreign controllers are obliged to designate a repre - sentative registered in Kosovo to handle processing issues and ensure compliance with the LPPD. The obligation to designate a local representative does not apply if: • the processing in question is occasional; • the processing does not include large-scale processing of special categories of data (ie, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, identifiable biom - etric data and other categories as expressly listed in Article 8 of the LPPD); • the processing is related to criminal convictions; and • the processing is unlikely to pose a risk to the rights and freedoms of natural persons. Additionally, foreign public bodies or authorities are exempted from the obligation to designate a local representative. 8.3 Role and Authority of the Data Protection Agency The Information and Privacy Agency (the “Agency”), led by the Commissioner, is the independent authority responsible for supervising the implementation of Law on the Protection of Personal Data and other regula - tions concerning personal data protection and access to public documents. The Agency is additionally tasked with providing advice to public and private bodies on data protec - tion-related issues, informing the public on relevant developments, issuing decisions about complaints from data subjects, supporting the fundamental right of personal data protection, carrying out inspections, carrying out periodic reviews of issued certificates to data controllers, and providing opinions for public institutions and advising the Assembly of Kosovo and the government on legislative measures.
The Agency has the authority to carry out inspections and audits ex officio to monitor compliance with data protection rules. If a violation is identified during the inspection, the Agency can order the elimination of processing irregularities or deficiencies, including the erasure, blocking, deletion or anonymisation of relevant data. Other available measures are tempo - rary or definite bans on data processing or transfers, orders directed to controllers to meet data subjects’ requests for the exercise of their rights and fines. In cases of serious and great violations, the Agency may impose fines between EUR20,000 and EUR40,000, or for companies, an amount representing 2% to 4% of their general turnover from the previous fiscal year. The Agency also holds specific authorisation powers; for instance, private sector controllers may only imple - ment biometric measures upon receiving authorisa - tion. Kosovo may see several legislative reforms in the near future, although their timing and adoption remain uncertain given that the country has held three gen - eral elections within 18 months. Based on the gov - ernment’s Draft Laws Programme 2026–28, potential reforms may affect taxation, customs, investment and financial markets, public-private partnerships, state aid, business organisations, trade, consumer protec - tion, employment, occupational safety and competi - tion. 9. Looking Forward 9.1 Upcoming Legal Reforms However, these reforms should be treated as indica - tive rather than confirmed until a fully mandated gov - ernment and assembly advance them through the legislative process.
552 CHAMBERS.COM
Powered by FlippingBook