Law 06/L-082 art. 21 — GDPR art. 22 with the words «legal» and «significantly» missing from the trigger, and no fine attached to the right itself
Binds Art. 21 binds data controllers. Art. 2(1) applies the Law to the processing of personal data by public and private bodies alike and excludes processing carried out for purely personal purposes; art. 2(2) extends it to Kosovo's diplomatic and consular offices and other official representations abroad. Art. 2(3) reaches controllers not established in the Republic of Kosovo that use automated or other equipment in Kosovo for processing purposes, unless the equipment is used only for transit through Kosovo territory — an equipment-based extraterritorial test of the Directive 95/46 art. 4(1)(c) kind rather than GDPR art. 3(2)'s targeting-and-monitoring test — and requires such controllers to designate a representative registered in Kosovo. Supervision sits with the Agjencia për Informim dhe Privatësi. Impact tier: all entities.. Art. 21 of Ligji Nr. 06/L-082 për Mbrojtjen e të Dhënave Personale (Gazeta Zyrtare e Republikës së Kosovës, Nr. 6, 25 shkurt 2019) is Kosovo's automated-decision rule, and it has been binding since the Law entered into force on 12 March 2019. Art. 1(2) says the Law is aligned with Regulation (EU) 2016/679, and art. 21 follows GDPR art. 22 closely — with one divergence in the operative sentence that runs the other way from every other Western Balkans transposition. Art. 21(1): «Subjekti i të dhënave ka të drejtën të mos i nënshtrohet një vendimi të bazuar vetëm në një përpunim automatik, duke përfshirë profilizimin që prodhon efekte në lidhje me të ose e ndikon në mënyrë të ngjashme atë» — a decision that produces EFFECTS concerning the data subject or similarly affects them. The two qualifiers the GDPR uses to narrow the trigger are absent: «ligjore» (legal), before effects, and «ndjeshëm» / «në masë të konsiderueshme» (significantly), before affects. On its face the threshold is any effect, not a legal effect or a similarly significant one. That the omission is textual rather than an artefact of drafting shorthand is visible inside the same statute: art. 35(3.1), the impact-assessment trigger, carries the full GDPR phrase — «vendimet që prodhojnë efekte ligjore në lidhje me personat fizikë ose ndikojnë në masë të ngjashme personin fizik» — so the drafter had the complete formula to hand and did not use it in art. 21(1). The repealed 2010 Law had it too. Everything else tracks GDPR art. 22. Art. 21(2) gives the same three exits: necessary for entering into or performing a contract between the data subject and a controller (2.1), authorised by a specific law applying to the controller which itself lays down suitable safeguards (2.2), or based on the data subject's explicit consent (2.3). Art. 21(3) attaches safeguards to the contract and consent exits and names all three GDPR limbs — the right to obtain human intervention on the part of the controller, to express one's point of view and to contest the decision. Art. 21(4) bars such decisions from resting on the special categories in art. 8(1) unless art. 8(2.1) (explicit consent) or art. 8(2.7) (substantial public interest) applies, landing exactly where GDPR art. 22(4) lands via art. 9(2)(a) and (g). «Profilizim» is defined at art. 3(1.5) in GDPR terms. Transparency is proactive and triple-anchored on art. 21(1) and (4): arts. 12(2.6) and 13(2.7) require the existence of automated decision-making, profiling included, to be disclosed at collection, and art. 14(1.8) repeats it in the right of access — each with meaningful information about the logic involved and the significance and envisaged consequences. The enforcement picture is the finding. Art. 92, the general misdemeanour article, lists the finable breaches by article number — arts. 4, 5, 6, 7, 8, 10, 12, 14, 29, 30, 32, 46 and 49 and art. 86(3) — and art. 21 is not among them, so the substantive right carries no article-specific fine. Its transparency limbs do: acting contrary to art. 12 is art. 92(1.4) and (1.7), and acting contrary to art. 14 is art. 92(1.12), both at €20,000–€40,000 for a legal person. The same asymmetry existed under the predecessor Law: art. 8 of Ligji Nr. 03/L-172 was likewise absent from the art. 79 misdemeanour list, so an automated-decision breach has never carried a fine of its own in Kosovo, across both statutes. What can reach art. 21 is art. 105, a severity-based catch-all outside the article-by-article scheme. Kosovo has no Law Enforcement Directive counterpart: 06/L-082 applies to public and private bodies alike under art. 2(1), there is no competent-authority Part, and law-enforcement processing is handled through the art. 22 restrictions clause rather than through a separate regime — the North Macedonia and Montenegro pattern rather than the Serbian, Albanian or Bosnian one. Kosovo has no AI-specific statute and no adopted national AI strategy.
In force since 12 March 2019. The Law was adopted by the Assembly on 30 January 2019, promulgated by Presidential decree Nr. DL-59-2019 of 14 February 2019 and published in the Gazeta Zyrtare, Nr. 6, of 25 February 2019; art. 111 sets entry into force at fifteen days after publication, which is 12 March 2019, and the Official Gazette's act record lists no amendment to it. The date is computed from the statutory text because neither the gazette record nor the Agency states an entry-into-force date, and secondary sources diverge — one commercial survey reports 13 February 2019, which conflates the decree, and another reports 11 March 2019, an off-by-one on the same fifteen-day period. Nothing in this entry turns on the one-day question and the primary computation is used. Art. 110 repealed Ligji Nr. 03/L-172 (published 31 May 2010) on entry into force. Its art. 8 was the predecessor rule and is recorded here for the comparison: a Directive 95/46 art. 15 permission clause addressed to the processing rather than a right held by the data subject — automated decision-making capable of producing legal effects or having a significant impact, based solely on automatic processing intended to evaluate certain personal aspects, was permitted only if taken on conclusion or performance of a contract with safeguards such as arrangements allowing the data subject to contest the decision or express a view, or provided for by a law laying down safeguards including a remedy against such decisions. No profiling concept, no consent exit, and no express right to human intervention — the same generation as Montenegro's art. 15a. The atlas carried no Kosovo row under the old Law, so this is an addition rather than a supersession edit. Art. 21 was verified against two independent primary renderings of the same gazette text — the Official Gazette's own HTML of act 18616 and the PDF the Information and Privacy Agency publishes of Gazeta Zyrtare Nr. 6/2019 — which agree word for word, so the omission of «ligjore» and «ndjeshëm» in art. 21(1) is in the text and not in the extraction. Only the Albanian text was read; the gazette's Serbian and English tabs are ASP.NET postbacks that refused a scripted request, and the Albanian text is authentic in any event. Kosovo has no AI statute, no AI bill before the Assembly and no adopted national AI strategy as of this check.
Stated maximum penalty — €20,000 to €40,000 for a legal person or a person carrying on an independent activity, but not for a breach of art. 21 itself. Art. 92(1) enumerates the general misdemeanours by article number and art. 21 is absent from the list, so the substantive automated-decision right has no article-specific penalty attached to it; the same was true of art. 8 under the repealed 2010 Law, whose art. 79 list also omitted it, so the rule has never been directly finable in Kosovo. The neighbouring duties are finable at that band: failing to inform the data subject under art. 12 — which is where art. 12(2.6) requires disclosure of automated decision-making under art. 21(1) and (4) — is art. 92(1.4) and (1.7), and acting contrary to art. 14, the right of access carrying the same disclosure at art. 14(1.8), is art. 92(1.12). Responsible-person and individual exposure runs alongside at €1,000–€2,000 for the responsible person of a state body and €400–€1,000 for an individual (art. 92(3) and (4)). Reaching art. 21 requires art. 105, which sits outside the article-by-article scheme: where the Agency finds a serious and large-scale breach of personal data it may impose €20,000–€40,000 or, for a company or undertaking, 2% to 4% of total annual turnover of the preceding financial year, the article citing Regulation (EU) 2016/679 for the measure. That band is worth reading closely — the GDPR sets 2% and 4% as ceilings, while art. 105 states 2% as a floor and 4% as the ceiling, so the Kosovo provision has a percentage minimum the GDPR does not have. Art. 91(2) caps the total for multiple related breaches at twice the highest single fine in the Law. Art. 106 preserves civil liability for unlawful processing and criminal liability under the Criminal Code alongside.