Data Protection Regulation in the Republic of Kosovo and Compliance by the Companies: a Proposed Model for Kosovo
Total Page:16
File Type:pdf, Size:1020Kb
International In-house Counsel Journal Vol. 2, No. 8, Summer 2009, 1227–1238 Data Protection Regulation in the Republic of Kosovo and Compliance by the Companies: A proposed Model for Kosovo MERITA KOSTANICA Head of Legal and Regulatory Affairs, IPKO Telecommunications, Republic of Kosovo I. Introduction Most companies cannot survive without storing personal information of individuals in different forms. In today‟s information society the flow of this information is becoming of fundamental importance for different purposes of companies. Present trends the way information flows around include widespread outsourcing arrangements, providing services from where companies find best skills and productivity, working far away from the employer, companies‟ split-up functions in many different countries who transfer information between themselves online. Considering these scenarios, it is easy to see how the ability to process and transfer personal information can in effect be a company‟s lifeblood.1 Whilst the use of personal data for such purposes may make commercial and political sense, companies should not overlook the fact that the use of personal data is increasingly regulated.2 Data protection regulations exist to make a balance between the rights of individuals to privacy and ability of the companies to use personal data for the purpose of their business.3 Any company processing and controlling personal data must comply with significant data protection regulations. However, companies often take no notice of the ever-increasing regulation of data protection that might affect their functionality in the market. While in the European Economic Area (EEA) the flow and the protection of personal information is complex and fluid, and its regulation is continually developing, outside EEA data protection is relatively new issue. The Republic of Kosovo, for instance, is the case where data protection is not yet regulated as an issue on its own; consequently, this paper will outline the immediate need for data protection regulation in Kosovo. The paper will begin by underlining the current status of regulation of privacy and data protection in Kosovo and will analyze whether this regulation is adequate. However, at this point, it should be noted that the aim of this paper is to outline the problems arising from the lack of regulation of data protection in Kosovo rather than privacy in general. Attempts of the policy makers to bring a specific law on this issue will be emphasized. 1 C. Kuner, European Data Protection Law, Corporate Compliance and Regulation, (Oxford: University Press, 2nd ed. 2007) p152. 2 Louise Townsend and Victoria Southern, “The cost of non-compliance with data protection law”, Privacy and Data Protection Journal, Volume 6 (07 August 2006) p1. 3 Ibid. International In-house Counsel Journal ISSN 1754-0607 print/ISSN 1754-0607 online 1228 Merita Kostanica The second part of this paper will focus on the problematic revolution as a consequence of an inadequate level of regulation of data protection in Kosovo, its impact on how companies process, control and transfer personal data inside the territory of Kosovo and the impact that the absence of this regulation may have on international business transactions as well as international investment in Kosovo, especially in the light of the restrictions of data from EEA to third countries. Emphasis will be given on legal matters as well as potential economic and reputation consequences that might arise from non regulation of this issue. Further, the third part of this paper will emphasize the comprehensiveness of the EU regime in data protection. At this point it should be noted that it is beyond the scope this paper to analyze the EU regime on data protection as a whole, rather this part of the paper will discuss the effect that the implementation of the EU Data Protection Directive had on the business activities through EU.4 In its fourth part this paper‟s focus will continue with the consideration of the regulatory studies which would lead to the adoption of an adequate data protection law in Kosovo and an adequate authority to ensure the law is complied with. The paper will conclude with the call on imperative need of adequate data protection regulation in Kosovo. However, it should be emphasized that this paper does not aim to solve the problems that arise from inadequate regulation of data protection rather to underline them and also to provide awareness among competent authorities and business organizations of the importance of adequate legislation on this issue. II. General Rules That Currently Govern Data Protection in Kosovo There is no specific legislation on data protection, consequently, no independent data protection authority has been set up. However, it seems like policy makers attempted to make a difference of the two concepts, „privacy‟ and „data protection‟. Firstly, Article 36 of the Constitution of the Republic of Kosovo considers privacy as a fundamental human right and also attempts to regulate data protection by stating as follows: “Every person enjoys the right of protection of personal data. Collection, preservation, access, correction and use of personal data are regulated by law”. 5Secondly, according to Article 22 of the Constitution, the provisions of the European Convention for the Protection of Human Rights and Fundamental Freedoms consequently, provisions on privacy as a fundamental human right are directly applied in Kosovo. Further, Article 168 of the Criminal Code of Kosovo provides a provision on Infringing Privacy in Correspondence and Computer Databases.6 Given the current regulation of privacy and data protection in Kosovo, one might ask a question whether in today‟s information society general privacy rights and obligations enshrined in a Constitution and other instruments are considered adequate regulation of 4 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data [1995] OJ L281/31. 5 Constitution of the Republic of Kosovo, adopted on 15 June 2008, available in English version at: www.kushtetutakosoves.info/repository/docs/Constitution.of.the.Republic.of.Kosovo.pdf (last visited on 01 June 2009). 6 Criminal Code of Kosovo, UNMIK Regulation, 2003/25, 06 July, 2003, available at:www.unmikonline.org/regulations/2003/RE2003_25_criminal_code.pdf (last visited on 02 June, 2009). Data Protection Regulation 1229 data protection or whether policy makers intended to regulate data protection as a subject on its own based on Article 36 (4) of the Constitution stated above. These two concerns will be analyzed subsequently. Firstly, in today‟s society it is generally known that privacy legislation is not considered adequate in regulating data protection. Privacy and data protection concepts are not the same, „On one hand the concept of data protection is narrower than privacy since privacy encompasses more than personal data, on the other hand, it encompasses a wider area, since personal data are protected not only to enhance the privacy of the subject but also to guarantee other fundamental rights, such as the right not to be discriminated against‟.7 Secondly, it looks like the policy makers intended to regulate data protection as a subject on its own based on Article 36 (4) of the Constitution quoted above. From the first part of this provision it is clear that all persons have the right to the protection of their data. Whereas, the second part, on one hand provides that the collection, preservation, access, correction and use of personal data are regulated by law and on the other hand, there is no law protecting these rights. So far, the policy makers have not taken the necessary steps to bring a specific law in order to transpose the data protection directive obligations.8 As per the Criminal Code provisions on „Infringing Privacy in Correspondence and Computer Databases‟ provided above, it is clear that these provisions more or less regulate the secrecy of correspondence and do not even touch the regulation on how one can process and handle others personal data. Given that there are no rules on protection of personal data in Kosovo, and consequently no data protection authority to ensure these rules, if an individual‟s personal data are breached, they may only seek to realize their rights before the applicable courts based on the general provisions outlined and analyzed above. However, Kosovo‟s judicial institutions remain week and unable to deliver a proper service, both in the civil and criminal sectors thus, individuals have additional reasons as to why they do not seek to realize their rights before the courts. Thus, the absence of the appropriate regulation creates a disorder on how organisations process individual‟s data in one hand, and leaves individuals with no means on realising their rights in the other. Attempts to specific regulation on data protection - It is of utmost importance to emphasize that on 22 July 2005 the policy makers adopted the Law on Information Societies Services, section 7 of which attempted regulation of data protection and the creation of data protection authority.9 However, these provisions were never complied with and the provisions were abrogated accordingly. At the present, there are indications that policy makers are working on a draft of data protection law which would transpose obligations that arise from the EU Data Protection Directive, however, there are no indications for any regulatory studies which would bring adequate regulation. 7 See: European Data Protection Supervisor, „Public access to the documents and data protection‟ (July 2005) 15, available at: http://www.edps.europa.eu/EDPSWEB/ (last visited on 06 August 7, 2008). 8 Commission of the European Communities report: Kosovo under (UNSCR 1244), 2007 Progress Report, Brussels, 6 November 2007, SEC (2007) 1433, p 48. 9 Law No.