The Information and Privacy Agency (hereinafter IPA) has fined the Tax Administration of Kosovo (hereinafter referred to as TAK) €20.000 penalty for unlawful processing of personal data.
This verdict was taken by the IPA after receiving an anonymous report by a citizen, indicating that TAK, on behalf of the reporting of employers who do not declare employees process, is violating the rights of privacy by exposing employees’ personal data, respectively citizen’s personal data. In the application which is being promoted by TAK, the complainant states that it is possible to obtain a list of employee data by submitting their personal number. Furthermore, they state that the application has no security parameters, such as password or username, and that citizens are exposed to be subject to various abuses.
This is the very first fine since 2015 handed by IPA, which derived from the election of the commissioner of Information and Privacy Agency – Krenare Sogojeva Dermaku.
The fines handed by IPA are very low compared to the ones imposed by European data protection authorities. In 2021, according to the GDPR Enforcement Tracker, the highest fine imposed by EU data protection authorities was issued to Amazon for €746 million. However, it is a positive step for IPA to start operating in accordance with the Agency’s duties and responsibilities, considering the fact that the Agency has previously taken two other verdicts without issuing any fines.
Detailed information of this verdict can be found as follow:
Vendim_per_ATK_Nr_04-1