Albania’s commercial banks are caught in a legal tug-of-war between competition authorities and data protection regulators—raising big questions about how the country will balance privacy with regulatory enforcement in its drive to align with the EU.

Albania’s commercial banks are facing a complicated legal dilemma as they navigate between conflicting demands from the country’s Competition Authority and the Commissioner for the Right to Information and Protection of Personal Data. According to reports from Reuters, CNA, and the George Washington University Competition Law Center, the issue centers around the Competition Authority’s investigation into possible anti-competitive practices in the life insurance sector—specifically regarding life insurance policies required for loan products.

Competing Demands: Competition Oversight vs. Data Privacy

The Competition Authority, which launched its inquiry in March 2025, has demanded that banks provide comprehensive records of all life insurance contracts tied to credit products since January 2022, including detailed personal information about the clients involved (competition.law.gwu.edu). In response, the Albanian Association of Banks turned to the Data Protection Commissioner, seeking guidance on whether providing such unredacted personal data would violate privacy laws.

The Commissioner’s office, as reported by Oracle Law Global and Albanian Daily News, clarified that under Albania’s recently updated Law No. 124/2024 on Personal Data Protection—which is harmonized with the EU’s General Data Protection Regulation (GDPR)—banks are prohibited from sharing unredacted personal data. The law, which took effect on January 31, 2025, enforces strict penalties for breaches, with fines reaching up to €20 million.

Banks Face Sanctions from Both Sides

Despite the Commissioner’s clear stance, the Competition Authority has doubled down, insisting that the Law on the Protection of Competition requires full disclosure of all information necessary for its investigations—even if it involves personal data. The Authority warned that non-compliance could result in fines equivalent to 1% of a bank’s annual turnover (Albanian Daily News, Autoriteti i Konkurrencës).

The original deadline for data submission, April 24, was recently extended to April 30, with the Authority reiterating its threat of sanctions for banks that fail to comply (CNA, competition.law.gwu.edu).

Legal and Regulatory Implications

Legal analysts cited by Oracle Law Global and Albanian Daily News argue that the standoff highlights the urgent need for greater inter-agency coordination and legal clarity to reconcile data protection requirements with the demands of regulatory investigations. As the extended deadline looms, several banks are reportedly preparing to seek judicial intervention to resolve the conflict (KPMG).

A Precedent-Setting Case for Albania’s EU Alignment

The outcome of this high-stakes dispute could set a critical precedent for Albania, as the country continues to harmonize its legal system with European standards. The resolution will likely influence how regulators approach the intersection of privacy rights and oversight powers going forward (competition.law.gwu.edu, Albanian Daily News, Reuters).