Analysis of Applicability of the Albanian Law on Protection of Personal Data (LPDP)

Material Applicability Factors

The material applicability of the LPDP is determined by the following factors:

• Automated Means Criterion
• Filing System Criterion
• Prospective Filing System Inclusion
• Personal and Domestic Use Exemption
• Exemption for Official Information of Public Servants

Automated Means Criterion

Relevant Provisions

LPDP Art.4(1):

"1. This law shall apply to the processing of personal data, wholly or partly by automatic means and to the processing by other means of a personal data stored in a filing system, or are intended to form part of a filing system."

Analysis

The LPDP applies to any processing of personal data conducted "wholly or partly by automatic means." This criterion includes all data processing activities that utilize automated systems such as computers, software applications, or any electronic devices. The use of the phrase "wholly or partly" indicates that even if only a portion of the processing is automated, the entire activity falls within the scope of the law.

Filing System Criterion

Relevant Provisions

LPDP Art.4(1):

"1. This law shall apply to the processing of personal data, wholly or partly by automatic means and to the processing by other means of a personal data stored in a filing system, or are intended to form part of a filing system."

LPDP Art.3(8):

"8. “Filing system” shall mean any structured set of personal data, which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis."

Analysis

The LPDP extends its applicability to the processing of personal data by non-automated means if the data are stored in a "filing system." A filing system is defined as any structured set of personal data accessible according to specific criteria, regardless of its physical or organizational form. This ensures that manual records, such as paper files organized systematically, are also subject to the LPDP.

Prospective Filing System Inclusion

Relevant Provisions

LPDP Art.4(1):

"1. This law shall apply to the processing of personal data, wholly or partly by automatic means and to the processing by other means of a personal data stored in a filing system, or are intended to form part of a filing system."

Analysis

The LPDP covers the processing of personal data intended to be included in a filing system, even if they are not yet part of one. This provision captures data at the initial stages of collection when the intention is to organize them systematically. It prevents any gaps in legal protection during the transitional phase before data are formally entered into a filing system.

Personal and Domestic Use Exemption

Relevant Provisions

LPDP Art.4(4)(a):

*"4. This law is not applicable to processing of data:

a) by a natural persons for purely personal or family purposes;"*

Analysis

The LPDP explicitly exempts processing carried out by natural persons for "purely personal or family purposes." This means that individuals handling personal data within the context of their private lives are not subject to the obligations imposed by the LPDP. The exemption recognizes the need to respect personal privacy and the impracticality of regulating data processing in intimate or domestic settings.

Exemption for Official Information of Public Servants

Relevant Provisions

LPDP Art.4(4)(b):

*"4. This law is not applicable to processing of data:

b) only in case the information is provided about public officials or public (state) administration servants, reflecting their public, administrative activities or issues related to their duties"*

Analysis

The LPDP does not apply to processing information about public officials or state administration servants when the data reflect their public or administrative activities or relate to their official duties. This exemption facilitates transparency and accountability in public administration by allowing the dissemination and processing of information pertinent to the functions and responsibilities of public servants without being constrained by data protection regulations.

Territorial Applicability Factors

The territorial applicability of the LPDP is determined by the following factors:

• Processing by Local Establishment
• Use of Equipment Within Jurisdiction
• Processing in Jurisdiction

Processing by Local Establishment

Relevant Provisions

LPDP Art.4(2)(a):

*"2. This law shall apply to the processing of personal data by:

a) Controllers established in the Republic of Albania;"*

LPDP Art.3(5):

"5. “Controller” shall mean the natural or legal person, public authority, agency or any other body, which alone or jointly with others determines the purposes and means of processing of personal data, in compliance with the laws and secondary legal acts applicable..."

Analysis

The LPDP applies to controllers established in Albania, meaning any entity with a stable and effective presence in the country. This includes businesses, organizations, and public authorities that determine the purposes and means of processing personal data. The law governs their data processing activities regardless of where the actual processing occurs, ensuring that entities operating within Albanian jurisdiction comply with national data protection standards.

Use of Equipment Within Jurisdiction

Relevant Provisions

LPDP Art.4(2)(c):

*"2. This law shall apply to the processing of personal data by:

c) Controllers who are not established in the Republic of Albania, making use of any equipment situated in the Republic of Albania;"*

LPDP Art.4(3):

"3. In circumstances stipulated in point 2 (c) of this article, the controller designates a representative established in the territory of Albania. Stipulations of this law applying to controllers are also applicable to their representatives."

Analysis

The LPDP extends its reach to controllers not established in Albania but who use equipment located within the country for processing personal data. "Equipment" may include servers, computers, or any technological infrastructure situated in Albania. Controllers in this category must designate a representative in Albania, who assumes responsibility for compliance with the LPDP. This provision ensures that foreign entities utilizing Albanian-based resources are subject to local data protection laws.

Processing in Jurisdiction

Relevant Provisions

LPDP Art.4(2)(b):

*"2. This law shall apply to the processing of personal data by:

b) Diplomatic missions or consular offices of the Albanian state;"*

Analysis

The LPDP applies to data processing activities conducted by Albanian diplomatic missions and consular offices. Although these entities operate outside the geographical boundaries of Albania, they are integral parts of the Albanian state. This provision ensures that the data protection standards set by the LPDP are upheld in all official activities abroad, maintaining consistency in the protection of personal data handled by state representatives.

Conclusion

The Albanian Law on Protection of Personal Data (LPDP) establishes a comprehensive framework for data protection based on specific material and territorial applicability factors. Materially, it governs automated processing and processing involving filing systems, while exempting purely personal or domestic activities and certain official information about public servants. Territorially, the law applies to controllers established in Albania, those using equipment within the country, and Albanian diplomatic missions abroad.