Data protection in Kosovo
January 27, 2011
The age of the anonymous, pre-paid mobile phone is coming to an end in Kosovo.
Per a new directive from the semi-recognized Balkan state's telecom regulator, all existing SIM cards must be registered to an owner by February 28 or face disconnection.
The registrations are designed to help police identify callers who make false reports to emergency services as well as users who illegally reroute international calls to voice-over-IP systems to skirt carriers' tariffs. To comply with the rule, users must submit identification to their mobile phone provider. In the case of most Kosovars, this is a national ID card which is linked to things such as pensions.
Kosovo follows other countries across Europe - including Germany, France, and Bulgaria - that require such registrations. And like those nations, Kosovo has strong legal provisions to protect the data that is collected from mobile phone users and potentially made available to law enforcement. But they mean very little in practice in Kosovo's case.
"There is not any supportive mechanism to implement this very important part of the law," says attorney Ahmet Hasolli, a partner at Kalo and Associates in Pristina, Kosovo's capital. "In addition, my perception is that citizens are not very familiar with the concept of data protection law."
Law but no law enforcement
Kosovo's constitution explicitly protects personal data. A 42-page law adopted in 2010 bolsters this with a stringent set of regulations on how personal information can be collected, maintained and disclosed, laying out penalties for violations. However, the agency established by the new law to actually implement and enforce its provisions isn't operational yet.
The result is that Kosovo has "zero" personal data protection, an official in the European Commission Liaison Office to Kosovo said, speaking on the condition of anonymity because he wasn't authorized to talk to the media.
"We have a new country here," the official said of Kosovo, which declared independence from Serbia in February, 2008. "You start from scratch."
Political opposition to the data protection agency's proposed head scuttled its formation, the European Commission official said, leaving Kosovo without a watchdog devoted to making sure that the information collected in these SIM card registrations is handled in accordance with personal data protection law. And there hasn't been an opportunity to change this since Kosovo's government fell in November.
Doing it by the book
The Kosovo Police Service sees the new registrations as a useful tool for criminal investigations. Lieutenant Brahim Sadriu, the spokesman for the national police force, said police will not have direct access to the mobile user database. Officers will have to make requests under strict legal guidelines.
"As for the investigations, they are monitored by the prosecutor and everything is done with the warrant from the prosecutor," Sadriu said. "We do not have access to those data and will not have access to it since it is illegal unless we have a warrant from the prosecutor for certain cases."
In essence, police are asking people to trust that officers will operate under the color of the law.
The European Commission official sees things differently: Kosovars shouldn't give any government or private entity the benefit of the doubt when it comes to integrity of the personal data until the watchdog is in place. And these SIM card registrations, from the point of data collection, to the processing, the storage and finally the possible release to law enforcement, raise many red flags, the official said.
Need a poweful carrot
Kosovo's personal data protection situation, the official said, isn't going to improve until the government starts to take the issue seriously. This may happen in the next two years as Kosovo tries to make it possible for its citizens to travel to most countries in Europe without a visa.
"If there's not a powerful carrot, they will not do it," the official said of the government.
In the meantime, data protection isn't really on the radar of most Kosovars, who face more basic problems such as poverty, high unemployment, and water and electricity stoppages.
Hasolli, the attorney in Pristina, is of the opinion Kosovars should view data privacy as a necessity, not a luxury.
"They should be concerned because this is a right every citizen in Kosovo is entitled to based on the constitution." Hasolli said. "Unless their data is revealed with their consent, they are not subject to the disclosure of the public."
Author: Nathan Tabak, Pristina
Editor: Stuart Tiffen