1. Introduction. – 2. Methodology and Scope of Research. – 3. Limitations of the Study. – 4. Literature Review. – 5. Transfer Of Personal Data and Alignment of Albanian Legislation with EU Standards. – 6. Automated Profiling Under AI Systems: Legal Risks and Individual Protection. – 7. The EU Artificial Intelligence Act and Its Interaction with Data Protection Standards. – 8. Empirical Insights from the Survey. – 9. Conclusions.
Background: In the era of artificial intelligence, data protection and privacy rights have become critical components of the European Union’s legal order. This study examines the interaction between the EU Artificial Intelligence Act of 2024 and the General Data Protection Regulation, focusing on their implications for non-EU countries, particularly Albania. The adoption of the EU Artificial Intelligence Act has reshaped the legal framework governing artificial intelligence and personal data protection in Europe. However, the practical implications of these instruments for non-EU citizens, particularly in Western Balkan countries as EU candidate countries, remain underexplored.
Methods: The study adopts a combined comparative legal and empirical methodology. It integrates a comparative legal analysis to evaluate the extent of alignment between domestic legislation and EU standards, a questionnaire-based survey of 178 respondents to assess public awareness and perceptions of privacy rights, and an analysis of attitudes towards the risks associated with artificial intelligence and personal data processing. It provides quantitative evidence that complements the legal analysis by illustrating how regulatory frameworks are perceived and experienced in practice. Based on the questionnaire data identifying Meta Platforms as the most widely used social media platform in Albania, the study includes a case study designed as an experimental rights-exercise test involving a data-access request submitted to the company, aimed at examining the cross-border enforceability of data-subject rights.
Results and Conclusions: The findings reveal a significant gap between formal legislative harmonisation with EU data-protection and AI standards and their effective implementation in Western Balkan candidate countries. Survey evidence from 178 Albanian respondents indicates limited awareness of personal data rights, low trust in institutional protection, and widespread uncertainty about AI-driven profiling and data use. The case study further demonstrates challenges in enforcing rights against foreign entities. Strengthening supervisory mechanisms and adopting the EU’s risk-based approach to AI regulation are recommended to ensure effective protection of personal data in candidate countries. Effective data protection measures for non-EU citizens require strengthening supervisory cooperation, enhancing enforcement capacity, and adopting the EU AI Act’s risk-based governance model in domestic law.