The Information and Data Protection Commissioner’s Office held the activity on the topic “Protection of Personal Data and Artificial Intelligence in the Financial Sector”, with the participation of representatives of banking, non-banking financial institutions, the insurance sector, data protection officers (DPOs), technology experts and information security professionals. The activity aimed to strengthen institutional capacities and dialogue between the supervisory authority and the financial sector on the use of Artificial Intelligence, in accordance with the requirements of Law No. 124/2024 “On the Protection of Personal Data” and European standards.
In his opening remarks, Commissioner Besnik Dervishi stressed that Artificial Intelligence is transforming the way institutions process information and provide services, creating new opportunities for automating processes and increasing efficiency, but at the same time bringing important challenges related to the protection of personal data, transparency, security and fundamental rights of individuals.
Commissioner Dervishi noted that the financial sector is among the sectors that is actively exploring and implementing solutions based on Artificial Intelligence, which makes it even more important to ensure compliance with the legislation on the protection of personal data. He stressed that the principles of lawfulness, transparency, data minimization, security of processing and accountability remain fully applicable even when processing is carried out through Artificial Intelligence systems.
“Technological development must go hand in hand with respect for fundamental rights. Data protection and innovation are not mutually exclusive concepts, but must be built on the same foundation: the trust of individuals”, said the Commissioner.
During the event, Prof. Alessandro Mantelero, Professor at the University of Turin and international expert in the field of data protection and Artificial Intelligence, addressed the use of Artificial Intelligence in the financial sector, the benefits and risks associated with the processing of personal data, as well as the obligations stemming from legislation to minimize these risks.
In his speech, Prof. Mantelero praised the progress achieved by Albania in recent years in the field of technological systems development and data protection, emphasizing that the country has made significant progress in aligning with European standards. He also emphasized that the use of Artificial Intelligence systems requires a comprehensive risk assessment, based on criteria such as the degree of impact, its scope, the probability of occurrence and the possibility of restoring the situation to its previous state. According to him, organizations should go beyond the personal data protection impact assessment (DPIA), by also considering the impact assessment on the fundamental rights and freedoms of individuals (FRIA), as an essential element for ensuring the responsible and trustworthy use of Artificial Intelligence.
Next, Prof. Endrit Xhina presented concrete cases of the use of Artificial Intelligence solutions and their impact in relation to the protection of personal data, focusing on the use of chatbots and service automation, large language models (LLMs), privacy issues in cloud and on-premises environments, as well as automated decision-making, profiling and transparency requirements according to GDPR standards.
“We are advancing every day more and more in terms of personal data protection, just as the Commissioner’s Office is doing a very good job in this regard, in full compliance with the GDPR”, said Xhina.
The second part of the activity was dedicated to an interactive session and practical discussion on the implementation of Law No. 124/2024 in Artificial Intelligence environments, moderated by Pjerina Mema, General Director for Personal Data Protection. During the discussions, concrete cases from the banking sector were presented, providing practical examples on the use of Artificial Intelligence in financial services. Participants exchanged experiences, good practices and discussed the challenges related to the implementation of personal data protection requirements in this context.
At the conclusion of the activity, Commissioner Dervishi emphasized the importance of cooperation between public authorities, the private sector, the academic community and technology experts to guarantee a responsible use of Artificial Intelligence, in accordance with personal data protection standards and respect for the fundamental rights and freedoms of individuals.
