KKB cannot publish business data. All cases where transparency conflicts with the law

2024-05-25 13:21:33Biznes SHKRUAR NGA REDAKSIA VOX

A part of the data published by the National Business Center about the subjects contradicts the law. After an investigation undertaken in this institution, the Commissioner for Personal Data Protection has come to the conclusion that the law in force for the National Registration Center for business registration obliges this institution to publish the recorded data.

According to the Commissioner's Office, from on-site verifications, it appears that visitors to the official website qkb.gov.al can search and download documents/information from all three registers through the "search" section. "Specifically, in the "search for subject" column of the official website, extracts are published with data of commercial subjects, such as: "nephew", "shareholder", "subject name", "trade name", "address ” and “identification number”, etc., is highlighted in the recommendation report for KKB.

Referring to this document, "it is established that the publication of certain categories of data, included in contracts with third parties, information related to the physical identification or identity of data subjects, addresses of certain individuals, as well as bank account data of third parties, are carried out in violation of the principles and criteria of Articles 5 and 6 of the Law. Specifically, Article 5 stipulates that the protection of personal data is based "... on the collection for specific, clearly defined, legitimate purposes and on the processing in accordance with these purposes". While according to Article 6 of the Law, personal data are processed only if one of the processing criteria is met: if the subject of the personal data has given consent; to fulfill a legal obligation of the controller.

Pursuant to the obligations stipulated by the Law, the Office of the Commissioner assesses that, KKB, in the capacity of the Controller for the data collected during the processing processes, should take appropriate organizational and technical measures to publish only the data that is necessary for realized the purpose of processing, in accordance with the principles and criteria of the Law, as well as in accordance with the requirements of specific legislation.