Shqip
Srpski
Prishtina, March 2022
Information and Privacy Agency on 27.01.2022 has received information that the Agency for Agricultural Development (AAD) in its official website has published lists with personal data of the data subjects (farmers), without obtaining their consent, including name, surname, personal number, dwelling-place, etc.
Upon the completion of verification/inspection procedures, the Agency has ascertained that AAD with the publication of these data has processed personal data in violation of Articles 4 and 5 of the LPPD, and thus has committed violation of Article 92, paragraph 1 of the Law No. 06/L-082 on Protection of Personal Data.
Agency for Agricultural Development through the publication of the lists of beneficiary farmers in its official website, these lists that contain personal data, where in addition to the name and surname, dwelling-place, etc. has also published the personal number. The Agency, with this action has violated privacy of the data subject, because it has exposed/disclosed a unique data of a natural person in the network (internet), in which has access to an unlimited number of visitors.
Law no. 06/L-082 on Protection of Personal Data has provided that each controller, processor of personal data, to process lawfully the data, in contrary the Information and Privacy Agency, based on the legal competencies is obliged to undertake appropriate actions and measures until the imposition of a fine for non-compliance with provisions provided by the law.
Therefore, the Information and Privacy Agency, with decision No. 15/22, dated 28.02.2022 has imposed a minor offence fine to the Agency for Agricultural Development because of unlawful processing of personal data.
In order to clarify an opinion, in any case when IPA finds that a data controller or processor has published the data of the entities without obtaining the consent of the Party, imposes a fine, even if that data have been removed or deleted after finding the violation.