On January 8, 2024, the Information and Data Protection Commissioner (IDP) issued its decision No. 49/1 in which it imposed a fine of ALL 460,000 (approx. $4,843) on EuroCom CX for violating the Law on the Protection of Personal Data No. 9887 of 10 March 2008 (as amended) (the Law) following a complaint submitted by an individual.

Background to the decision

The IDP noted that it received a complaint that EuroCom monitored its employees through CCTV surveillance cameras installed inside the company's offices without the employees' knowledge.

Findings of the IDP

Following an investigation, the IDP found that EuroCom violated Articles 18, 21, and 22 of the Law by failing to:

• notify data subjects about the processing of their data through the video surveillance system; and
• inform data subjects of the scope and purpose for which their data is processed.

During its investigation, the IDP also determined that sensitive health data of former employees of EuroCom was stored in the human resources office without appropriate organizational and physical measures to guarantee the security of the data, in violation of Article 27 of the Law.

Outcomes

In light of the above violations, the IDP imposed a fine of ALL 460,000 (approx. $4,843) on EuroCom. In addition to the fine, the IDP ordered EuroCom to:

• stop monitoring employees in the workplace through the CCTV surveillance system, as well as irretrievably destroy the video/audio data collected;
• notify data subjects of the processing of their personal data;
• set retention periods for the data it collects; and
• implement adequate data security measures.

You can read the decision, only available in Albanian, here.