As part of the broader effort to harmonise national legislation with the EU General Data Protection Regulation, the Albanian Data Protection Commissioner issued Instruction No. 2, dated 30 April 2025 (Instruction No. 2), on the protection of personal data in the health sector. This Instruction repeals the previous 2020 framework and establishes a comprehensive set of rules governing the collection, use, and disclosure of health and genetic data.
The scope of Instruction No. 2 extends beyond public and private healthcare providers. It also applies to oversight authorities, insurance companies, employers, researchers, and any third parties involved in processing health-related data. It is particularly relevant in light of the increasing reliance on digital tools, telemedicine, and cross-border data exchange in healthcare delivery.
Health and genetic data are categorised as sensitive personal data and are subject to heightened protection. Instruction no. 2 outlines strict legal grounds under which such data may be processed, including medical necessity, public health purposes, scientific research, the protection of vital interests, and the data subject’s explicit consent. Additional safeguards apply when processing the data of minors or information related to fetal health. Notably, Instruction No. 2 confirms that employers are not permitted to access or process employees’ health data unless explicitly provided by law. Similarly, insurance companies may only access such data with the data subject’s informed consent or when specifically authorised by applicable legislation.
Data controllers and processors are required to implement rigorous technical and organisational measures to ensure the security and confidentiality of health data. These include encryption, access controls, secure communication protocols, and compliance with principles of professional secrecy. Data must be deleted or anonymised when no longer necessary and may only be retained in accordance with applicable data retention laws.
Additionally, it introduces detailed provisions on the use of health data for scientific research. It mandates the use of anonymisation or pseudonymisation where possible and emphasises the protection of data subjects’ rights throughout the research process. Data subjects retain key rights, including the right to be informed, to access their data, and to request its rectification or erasure where appropriate.
By providing detailed guidance and sector-specific safeguards, Instruction No. 2 enhances legal certainty and supports the responsible processing of sensitive health data. It marks a significant step in aligning Albania’s data protection standards with European norms while addressing the operational realities of modern healthcare and biomedical research.
The information in this document does not constitute legal advice on any particular matter and is provided for general informational purposes only.
