The Agency for Information and Privacy (AIP), as the supervisory authority for the implementation of Law No. 06/L-082 for the Protection of Personal Data, imposed a fine on the Kosovar Company for Electricity Supply Sh.A. (KESCo) for not taking the necessary security measures in the processing of personal data during the distribution of invoices for the citizens.

"The Information and Privacy Agency has received several complaints from citizens (data subjects) regarding the action that KESCo has distributed monthly invoices for electricity consumption without applying security measures and allowing unauthorized persons access to the data personal data of consumers", the announcement states.

It is further stated that during the review of complaints, AIP has found that KESCo has failed to implement security measures to protect the personal data of citizens, thereby violating its legal obligations.

"The Agency's action to impose a fine on KESCo was undertaken after the awareness campaign that the Agency conducted in February 2024, with all companies that distribute invoices, in which case it requested the implementation of the legal obligations that these companies have to consumers. In order to prepare the conditions, the Agency has asked the Companies to take all measures to ensure the protection of personal data by June 30, 2024", the communiqué states.

The security of personal data is a fundamental right of citizens and the protection of this data should be a priority for any company that processes personal data.

At the end of the announcement, it is stated that the Information and Privacy Agency will continue to supervise the implementation of the law by private companies and public institutions to ensure the protection of citizens' personal data.