Kosovo Has A Legal ‘Right To Be Forgotten, ‘But Few Know About It – Analysis

The law in Kosovo recognises the ‘right to be forgotten’, but most people in the country don’t know they can seek the removal of their personal data from the internet.

By Florentina Hoti

In 2010, Helsinki-based medical student Juliana Nura returned to her native Kosovo and took part in a beauty pageant. A few months later, an anonymous message arrived: someone had got hold of a video of her having phone sex on WhatsApp with her then-boyfriend, a Kosovo singer, and was demanding money not to publish it.

With the help of friends, Nura raised the money, but the video leaked anyway. The backlash was brutal, pushing her to consider suicide. She was 20 years old.

“No one knows the truth,” Nura said in a 2022 television interview. “They only look at a girl performing in front of the camera. I thought about what I would do, how I would start my life all over again from scratch.”

Nura left Kosovo again, this time for London, and built a career on social media as a lifestyle and fitness influencer. But when she returned as a participant on Kosovo’s edition of Big Brother VIP in 2022-2023, the video – which had never disappeared – began to circulate again online and Nura became the target of ‘slut-shaming’.

Since 2019, however, Kosovo citizens have the ‘right to be forgotten’, after the concept entered the country’s legal framework under privacy and personal data protection laws harmonised with those of the European Union, which Kosovo one day wants to join.

In theory, the right allows individuals, under certain conditions, to request the deletion of their personal data.

In the five years since it was enshrined in law, however, Kosovo’s Agency for Information and Privacy, AIP, has acted to enforce the right in just one case.

In reality, few people in Kosovo know they even have the right to have their data deleted from the internet. Nura has not said whether she has tried to exercise the right in her case.

However, this doesn’t mean that people aren’t concerned about the misuse of their personal data. According to the AIP’s annual report for 2022, the agency received 145 complaints related to personal data breaches, primarily concerning unauthorised data processing, misuse of personal data, and incorrect data processing, according to Levizija FOL, a Kosovo NGO that promotes good governance.

“Exposure of data identifying the data’s subjects has expanded due to technological advances and increased use in society,” the AIP was quoted as saying in a report by Levizija FOL.

The complaints received by the AIP were primarily directed at national and local institutions, banks and microfinance institutions, insurance companies, the healthcare sector and retail companies. The agency issued fines totalling 169,000 euros for these breaches, Levizija FOL’s report said.

Vast majority of people unaware

The ‘right to be forgotten’ is a relatively new concept that has divided opinion between those who support it fully and those who say it must be used cautiously to avoid limiting freedom of expression and media.

But as is often the case in the digital world, the right has its limitations.

The AIP, for example, can order that material be removed from the internet and media outlets in majority-Albanian Kosovo, but not, for example, in neighbouring Albania, where media often cover stories from Kosovo.

Individuals can also contact social media platforms and search engines like Google directly and request that they remove their personal data, but the effectiveness of such requests can vary depending on the platform’s policies and the specific laws in an individual’s country of residence.

The first – and so far only – case in Kosovo was registered in May 2022, when a person identified as A.A. filed a complaint with the AIP over a 2018 decision by the Judicial Council of Kosovo to publish the names of candidates – successful and unsuccessful – for a vacant position in the public prosecution.

The AIP ordered the Judicial Council to remove the names based on the grounds that the purpose of processing such data had expired. The AIP ruling cited the ‘right to be forgotten’.

The AIP did not respond to a request for comment for this story.

That the AIP has handled only one such case so far is hardly surprising given the results of a study by two professors from the University of Pristina.

They found that 78.9 per cent of respondents in Kosovo were unfamiliar with the right to be forgotten. Roughly a third said that their personal data had been published, of which 74 per cent said it was published without their consent.

Abuse of images and private data online

The abuse of images is rife on the Internet, challenging privacy norms.

In Kosovo, for example, the website Sinjali.com publishes photographs of crime or accident victims as well as those accused, but not yet convicted, of crimes. It has 280,000 followers on Facebook alone.

On Telegram, the messaging app, more than 100,000 members of a group called Albkings have been sharing the personal data, photos and ‘deepfake’ images and videos of women and girls. As of February 9 this year, almost 21,000 photos and 20,000 videos had been shared within the group, which went private soon after.

Police moved against Albkings in May, arresting seven people.

The impact on victims can be devastating, particularly in conservative societies like Kosovo’s.

Faton Ismajli, one of the authors of the Pristina University study, criticised the lack of public awareness about the right to be forgotten.

“In Kosovo, there is a lack of societal debate and discussion on such a topic,” he told BIRN. “Even the media have not given much importance to such a legal right as the right to be forgotten.”

In such circumstances, he said, the onus is on the state to spread the word.

“If there was more discussion, debate and reports about the existence of the ‘right to be forgotten’ in Kosovo laws, there would likely be more requests directed to the Agency for Information and Privacy, as well as directly to the media, to delete information that is no longer relevant to the public and is requested for removal by citizens,” he said. 

“Besides the media, the Agency for Information and Privacy and other higher institutions such as the parliament and government should do more to inform citizens about the right.”

Media quandary

The media, however, tread a fine line when it comes to the right to privacy.

Experts have raised concern about the potential for individuals involved in criminal wrongdoing to cleanse the internet of reports about their misdeeds.

One Kosovo journalist, who declined to be named, said it was also hardly in the media’s interest to publicise such a right given the widespread tendency to publish personal data in contravention of journalistic ethics.

“It would cause us a lot of trouble because people would be informed and could ask us to delete certain publications,” said the journalist at Klan Kosova TV.

Asked how it would respond to a request to remove a text based on the ‘right to be forgotten’, a Klan Kosova spokesperson told BIRN: “We would carefully review all of the arguments to see if they are really right. Certainly, in collaboration with the Agency for Information and Privacy we would strive to do our best about it.”

So far, however, the right has barely been used. 

The good governance NGO Levizija FO has been involved in some of the very few attempts to raise public awareness about it. In November last year, Levizija FOL published a practical video guide on Facebook explaining how to lodge a complaint with the AIP. 

“Protect your personal data!” it urged. 

The video has been viewed more than 34,000 times.

Xhorxhina Bami contributed to this story.