Digital transformation, driving efficiency and productivity through the adoption of digital technologies and data utilisation, holds promise for fostering economic activity and competitiveness. This chapter, across four sub-dimensions, assesses the scope and quality of the policy framework and strategies and the implementation and adoption by Kosovo. The first sub-dimension, access, explores government policies and initiatives to enable network infrastructure investment and broadband services take-up and increase data accessibility. The second, use, delves into the government’s plan to implement programmes to develop a user-centric digital government and help businesses achieve a digital transformation. The third, society, assesses whether governments have planned and implemented programmes to reduce the digital divide and create an inclusive society through green digital technologies. The fourth, trust, examines the economies’ frameworks and how they are being implemented to protect data and privacy, build trust in e-commerce and ensure cybersecurity through effective digital risk management systems.
Western Balkans Competitiveness Outlook 2024: Kosovo
Abstract
Kosovo has enhanced its performance in the digital society policy dimension since the last assessment (Table 11.1).1 Kosovo has made advancements in government and business digitalisation, digital inclusion, privacy and personal data protection, consumer protection in e-commerce and cybersecurity. However, it slowed down in data accessibility. Kosovo’s overall performance remains in line with the average Western Balkan regional performance for digital society policy.
The key findings are:
In March 2023, Kosovo achieved a milestone by connecting all rural settlements to a broadband Internet infrastructure. Despite this progress, challenges persist in meeting the revised gigabit connectivity targets. Notably, at 22%, Kosovo’s fixed Internet access penetration per 100 inhabitants remains among the lowest in the Western Balkan region.
While Kosovo is in the process of updating its electronic communications framework to align with the European Electronic Communications Code, the alignment process is projected to continue until 2025. The existing framework lacks sufficient incentives for competition and private sector investments in high-capacity fibre infrastructure and mobile network quality enhancements.
Kosovo’s data accessibility lacks efficient regulation for data sharing and re-use, hindering data‑driven innovation. Public institutions’ obligations regarding data transparency, openness and proactive disclosure are poorly understood and enforced. Moreover, there is a lack of capacity building for public sector officials and private sector data practitioners to develop trustworthy data partnerships aimed at creating new services.
Kosovo adopted a strategy for digital government development in 2023, prioritising e-services development, alongside public administration digitalisation and reducing administrative burdens through process simplification. However, the government’s interoperability platform remains underutilised and inadequate capacities among public sector officials reduce the speed and quality of e-government initiatives. Currently, only 10% of public services are available on the national e-government portal.
Although cross-sectoral policies aimed at addressing different aspects of digital inclusion have been adopted, their implementation lacks adequate horizontal co-ordination. The establishment of the Digital Transformation Commission under the Prime Minister’s office aims to enhance inter-ministerial co-operation and systematic policy monitoring.
Kosovo adopted both a strategy and a new law on cybersecurity in 2023, committing to comprehensive reforms aimed at strengthening the economy’s cybersecurity capacity. While the new law enhances alignment with the EU acquis, its implementation is still in the early stages, necessitating a significant increase in human and financial resources.
1. Decreased scores in the Use and Society sub-dimensions in the current assessment (CO 2024), compared with scores in the CO 2021 assessment, are mainly attributed to the incorporation of two new, forward-looking qualitative indicators in the current digital society assessment framework. Scores for these new indicators, namely emerging digital technologies and green digital technologies, are relatively low since they are still in the early stages of development in the Western Balkan region. Furthermore, the scores from the CO 2018 assessment are not directly comparable with current scores due to a significant restructuring of the digital society assessment framework.
The Information and Communications Technology (ICT) sector stands out as one of the few industries in Kosovo with a positive trade balance. In the process of developing Kosovo’s Smart Specialisation Strategy, ICT has been identified as one of the five priority sectors with significant potential in fostering growth and innovation within the economy. ICT companies in Kosovo mainly specialise in software development and IT services, particularly focusing on web and mobile applications. These companies have a strong global outlook, with 38% of them solely targeting international markets (STIKK, 2023[1]). The salaries offered by ICT companies in Kosovo consistently surpass average monthly salaries in the economy, reflecting the sector's growth.
The government of Kosovo has shown strong commitment to using digital technologies to enhance transparency and accountability in governance, improve services for citizens and businesses, and increase the productivity and competitiveness of the economy. However, despite the growing trend towards digitalisation, the availability of electronic services remains limited with the number of e-services not exceeding 130, constituting a relatively small fraction of all public services. Both the private and public sectors struggle with a shortage of qualified ICT professionals, who represent a mere 0.5% of the total workforce in 2023 (MIA, 2023[2]). While Internet access has reached an impressive 98.6% of households in 2023 (KAS, 2023[3]), only 28% (2022) of individuals aged 16 to 74 use the Internet to interact with public administration services, indicating further room for improvement in digital engagement and literacy among the population (KAS, 2022[4]).
Kosovo has made significant advancements in broadband infrastructure development over the past three years. The overarching Digital Agenda Strategy 2030, adopted in June 2023, outlines gigabit connectivity objectives for key socio-economic drivers, encompassing public buildings, academic institutions and schools across the entire territory by 2026. Additionally, strategic documents, such as the Government Programme 2021-25 and the National Development Strategy of Kosovo 2030, underscore the pivotal role of fixed broadband and 5G mobile infrastructure in fostering the digital economy. Broadband connectivity in rural and underserved areas has increased through the implementation of the Kosovo Digital Economy (KODE) project, financially supported by the World Bank. The KODE project connected over 60 mobile network towers (5G or 5G ready) through fibre by 2021 and all rural settlements to broadband Internet infrastructure by March 2023, helping Kosovo achieve 100% broadband KODE Project (2023[5]). The KODE project connected Kosovo’s Research and Education Network (KREN) with the European academic network (GEANT), and access to Eduroam, a secure worldwide service that enables students, researchers and staff from educational institutions to have Internet connections across their campuses, but also during their visits to other institutions abroad. Moreover, it provides subsidised fixed or mobile high-speed Internet access to schools across Kosovo, with the installation of digital infrastructure in 100 schools completed at the beginning of 2024 and an additional 110 schools already in the pipeline.
Mobile broadband penetration per 100 inhabitants through 3G and 4G technologies has increased significantly, reaching 95.4% in the third quarter of 2023 (ARKEP, 2023[6]). However, despite advancements in mobile broadband, achieving the revised gigabit connectivity targets faces significant challenges. Kosovo’s fixed broadband Internet penetration per 100 inhabitants has remained stagnant, between 21% and 22% over the past three years (ARKEP, 2023[6]) (Figure 11.1); this ranks it among the lowest in the Western Balkan region, trailing the EU (38.70%) and the OECD average (34.9%) in 2022 (OECD, 2022[7]). Hindrances to the development of very-high-speed broadband infrastructure include limited private sector investment capacities, an outdated cable network unsuitable for gigabit speeds1, and delays in 5G development. Kosovo has not yet completed legal and regulatory reforms to align with the EU policy framework for gigabit broadband development, including alignment with the EU Connectivity Toolbox and the 2023 revised EC Guidelines on state aid for developing broadband networks. Addressing these challenges will be vital to realising Kosovo's aspirations for ultra-high-speed connectivity.
The existing communications regulatory framework is outdated and does not effectively encourage competition, investment or consumer choice diversity. The government is in the process of formulating a new Electronic Communications Law, along with complementary secondary legislation to align with the European Electronic Communications Code.2 However, the timeline for this undertaking anticipates the adoption of the new law only by mid-year 2024, with accompanying regulations extending until mid-year 2025. Until then, the financial independence of the Authority of Electronic and Postal Communications (ARKEP) will not be ensured (European Commission, 2023[9]). Meanwhile, broadband Infrastructure mapping is progressing, fostering enhanced transparency and reducing operators’ uncertainty. Existing regulations align with the EU Broadband Cost Reduction Directive,3 leading to cost reductions for the development of high-capacity network infrastructure. However, administrative burdens related to construction works are still present due to incomplete harmonisation of legacy legislation, discouraging private sector investments. Although 5G licences were granted to two telecom operators (IPKO and Telecom Kosovo) in the 800MHz and 3.5 GHz frequency bands in early 2023, regulations for simplifying 5G network installations, such as a permit-exempt deployment regime, are still pending. Furthermore, there are no specifications for the physical and technical characteristics of small-area wireless access points (small antennas) in alignment with the relevant EC regulation.4
Kosovo has yet to advance its data accessibility policy framework to promote the sharing and reuse of data in the digital economy, aligning with the principles of the EU data strategy. The foundation for open data development in Kosovo is the Public Administration Reform Strategy 2022–27. The strategy aims to enhance accountability and transparency by urging the state administration to provide more information on its activities and performance through public institution websites and the Open Data Portal.5 While it incorporates the concepts of sharing and re-use of open datasets from public sector institutions, there is insufficient regulation of published data. The current legal and regulatory framework lacks provisions that clearly delineate the process of data sharing and re-using, data governance and technical specifications for published datasets. As of early 2024, the national open data portal hosted only 205 datasets from 14 institutions, which are not always available in machine-readable formats. Without data certification systems on the open data portal, datasets are not subject to review for compliance with open government data principles, drastically limiting their re-use potential.
The legislation on access to public sector information is not aligned with key EU legislation, such as the Open Data Directive6 and the EU Data Governance Act.7 Thus, Kosovo is not compliant with the common set of rules for establishing government-held data marketplaces, adopted by EU Member States and some of the Western Balkan economies. This limits Kosovo’s opportunities to collaborate with WB economies and EU Member States in new data-driven services. The existing legal framework does not incorporate the concepts of high-value datasets and data-intermediary services provided by trustworthy organisers of data sharing or pooling. Despite policy objectives to foster transparency in governance, public institutions’ obligations to publish data are practically unenforced, and open data indicators are not regularly monitored. In December 2022, no public institutions at the central level had published information catalogues on their official websites. The most significant challenges for data accessibility and openness in Kosovo involve public officials’ lack of skills in data management and distribution, inefficient co-ordination of standards and processes for data re-use, and a lack of opportunities for public awareness regarding data innovation and data partnerships with public institutions.
Kosovo has made some strides in digital government development since 2021, but the pace of digitalisation remains slow. Recognising the pivotal role of digitalisation in transforming Kosovo’s society and economy, key strategic documents like the Government Programme 2021-25 and the National Development Strategy 2030 underscore its importance. Moreover, Kosovo has renewed commitment to digital government by adopting the overarching Digital Agenda Strategy 2030 and the sectoral e‑Government Strategy 2023-27 in 2023. Concurrently, efforts are underway to simplify administrative processes through the Strategy for Public Administration Reform 2022-27 and the Program for the Prevention and Reduction of Administrative Burden 2022-27. These initiatives have streamlined 152 services at central and local levels, with another 64 services eliminated in three municipalities, while over 30 services are in the digitalisation pipeline (PM Office, 2024[10]). However positive, the activities outlined in these documents require careful co-ordination to avoid leading to redundant efforts in digitalisation and simplification processes. Kosovo faces challenges in adopting a coherent approach regarding governance of public administration IT services and co-ordination of parallel activities. Limited progress has been made in re-designing e-government services and implementing the “once only” principle.8 Additionally, a shortage of IT specialists - constituting only 0.5% of total public employment – hampers digital transformation efforts (MIA, 2023[2]). To address these challenges, the government has established the Digital Transformation Commission under the prime minister’s office and the Digital Transformation Unit to oversee strategic digital transformation projects and to co-ordinate the implementation of the e-Government Strategy, respectively. Both structures aim to enhance e-service redesign initiatives and strengthen public sector capacity building in various topics from digital service design to cybersecurity. In 2023, 65 officials received training on preventing and reducing administrative burden and service design, while another 400 will be trained in 2024 (PM Office, 2024[10]).
In the meantime, the utilisation of e-government services in Kosovo remains below expectations. Despite high Internet usage (98.3%) in 2023 (KAS, 2024[11]), surpassing the EU average (92.42%) (Eurostat, 2024[12]), and 100% coverage in basic broadband access, an alarming 72% of individuals had never accessed the Internet for public administration information or services in 2022 (KAS, 2022[4]). While efforts to develop the government interoperability platform have advanced, it remains underutilised. Inefficiencies in the legal framework governing administrative procedures and digital service provision and poor data quality in digitalised public registers result in a mere 10% of public services being available online. Furthermore, while the legal framework aligns with the EU eIDAS9 Regulation, the deployment of the government’s eID system is not expected before 2025, which impedes the development of fully transactional domestic and cross-border e-services.
Kosovo is in the early stages of digital business development, although it has shown some advancement in the past three years. The Digital Agenda 2030 strategy emphasises the importance of business digitalisation. However, the integration of relevant activities into specific budgeted programmes and projects is still pending. Currently, business digitalisation is primarily driven by private sector investments and donor-funded programmes, such as the 4-year “Access” Programme completed in 2022 with financial support from the Austrian Development Agency. Although the Programme supported 62 businesses in their digital transformation, its impact on SME digitalisation on a broader scale remains limited. Despite high rates of computer (99.2%) and Internet (97.1%) usage among enterprises in 2022, only 40% had company websites, significantly trailing the EU average of 78.1% (Eurostat, 2024[13]). Similarly, only 4.8% of enterprises in Kosovo conducted online sales in 2022, compared to the EU average of 22.9% (Eurostat, 2024[13]). On the other hand, 76.1% of companies in Kosovo engaged with social media in 2022 (KAS, 2022[14]), exceeding the EU average of 57.1% in 2023 (Eurostat, 2024[13]).
However, Kosovo has yet to update its IT Strategy, which dates back to 2016, to foster ICT sector growth. The Economic Reform (ER) Programme 2023-25 acknowledges the vital role of the ICT industry in the digital economy and Kosovo's overall economic growth. It outlines plans to review the outdated IT Strategy, though this activity is still pending. Additionally, the ER Programme aims to advance the Digital Excellence Centre and the Prizren Innovation and Training Park (ITP Prizren), currently under development. Furthermore, the inauguration of the Digital Technology Park in Bërnicë, Pristina, in October 2023, managed by the ICT Association of Kosovo (STIKK), marks a significant milestone in supporting start-ups and innovative businesses, including ICT companies.
Despite these advancements, the digital innovation capacity of Kosovo’s ICT industry faces constraints due to the gap between industry demand for highly skilled ICT professionals and available ICT graduate capacities. According to the IT Barometer 2021-22, 44% of IT companies encountered challenges due to an inadequately educated workforce, prompting a substantial increase (43%) in investments for employee training from 2021 to 2022 (STIKK, 2023[1]). To bridge this gap, the government has initiated programmes for workforce digital upskilling and ICT professionals’ training, with international donor and EU financing. The KODE project aims to train a total of 3 000 young people in ICTs by the end of 2024 through the Youth Online and Upward (YOU) programme. Thus far, 1 300 unemployed or underemployed young men and women with university education have already undergone training in technical and soft skills. Additionally, around 1 500 ICT professionals have received training and certification in advanced ICT topics through 67 relevant courses financed by the EU-funded Instrument for Pre-accession Assistance (IPA programmes).
Kosovo has yet to establish a dedicated policy for the development and utilisation of emerging digital technologies such as artificial intelligence (AI), the Internet of Things (IoT) and blockchain. Although the Digital Agenda Strategy 2030 envisions the formulation of an AI strategy, the development of an enabling legal framework for innovation through emerging technologies, and the integration of emerging technologies into tertiary education curricula, this vision requires further elaboration into specific budgeted initiatives with well-defined roles, monitoring and accountability processes. Additionally, the Economic Reform Programme 2023-25 outlines plans to establish a Laboratory for 5G, IoT, Cybersecurity and Smart Village at the Innovation and Training Park in Prizren. The government also plans to use support from the World Bank to establish an innovation cell within the Information Society Agency (ASHI).10 This innovation cell will primarily focus on exploring the practical application of emerging technologies, including AI, cryptography and big data, within the realm of public administration. Notably, the IT industry in Kosovo is already using various emerging technologies. According to the IT Barometer 2021-22, the most widely adopted technologies, among surveyed companies, included web-based development (81%), AI (36%), big data (33%), and data science (29%) (STIKK, 2023[1]). However, other emerging technologies, such as blockchain (17%) and virtual reality/augmented reality (8%) are less commonly used, suggesting potential areas for growth and exploration within the industry (STIKK, 2023[1]).
Kosovo has made notable progress in digital inclusion over the past three years, propelled by the overarching Digital Agenda 2030 strategy, which aims to cultivate a digitally skilled population. This advancement is underpinned by two key factors: Kosovo’s youthful demographic and widespread Internet connectivity spanning the economy’s entire territory (Box 11.1). By the end of 2023, the KODE project delivered at least basic broadband connectivity to households in every rural settlement in Kosovo. According to the 2023 survey on ICT usage in households, 98.6% of households now have Internet access, with a slight majority of users being women (51.7%) compared to men (48.3%). The predominant means of access is through mobile/smartphones (94.8%) (KAS, 2023[3]). However, while Internet usage mainly revolves around basic activities such as browsing, social media and emails, more advanced applications like e-education and e-health remain underutilised, partly due to the limited availability of corresponding e‑services. Additionally, Kosovo lacks policy initiatives or programmes aimed at promoting digital technology usage among marginalised groups to ensure digital inclusion regardless of age, geographic location, education level, ethnicity or ability. Moreover, the legal framework on accessibility of public websites has not been updated since 2021 to align with EU legislation and international standards. Current legislation lacks provisions for ICT products and services’ certification for accessibility and integration of relevant requirements in public procurement processes. While the Office of Good Governance in the prime minister’s office is responsible for human rights, equal opportunities and non-discrimination issues, it does not assess progress or propose policy adjustments to mitigate digital exclusion among marginalised groups, such as the Roma and Egyptian populations. Furthermore, Kosovo has yet to prioritise horizontal co-ordination of cross-sectoral policies addressing different aspects of digital society development, resulting in weak operational-level interministerial co-operation. Consequently, data collection and impact assessment of policy initiatives related to digital inclusion are inadequately monitored.
Kosovo is in the very early stages of formulating policy measures to foster the development of green digital technologies. The Digital Agenda 2030 strategy represents the first policy initiative outlining a vision for the development of sustainable and secure fixed and mobile green network infrastructure. While this marks a significant step towards integrating environmentally sustainable practices into digital technologies, its implementation is currently pending, as specific initiatives in this domain are yet to be elaborated. Similarly, the Economic Reform Programme 2023-25 outlines activities aimed at harnessing digital technologies to facilitate the green transition, but tangible outcomes have not yet materialised. However, there is presently no formal assessment of the environmental footprint of the digital sector, including ICT-intensive firms, or an evaluation of the impact of government and business digitalisation. Additionally, there is a lack of data collection on indicators measuring enterprises’ and households’ environmental practices, impeding informed policy-making processes. Nevertheless, it is positive that Kosovo has adopted the Integrated Waste Management Strategy (IWMS) 2021-30. The Strategy promotes the development of extended producer responsibility (EPR) mechanisms in four product waste categories, including waste electric and electronic equipment (WEEE, e-waste). These efforts aim to transfer the responsibility for managing end-of-life products from consumers and municipalities to producers, leading to improved environmental outcomes, resource efficiency, and economic development.
Based on the latest data from Eurostat in 2021, a large number of Europeans who use the Internet are mostly located in the northern part of the continent. Kosovo is one of the few exceptions, and it is among the top-performing economies in terms of Internet usage, along with the five Nordic countries (Denmark, Norway, Sweden, Finland, Iceland), the United Kingdom, Ireland, Luxembourg, and Switzerland. These economies have the lowest percentage of individuals who do not use the Internet, ranging from 0% to 4%.
Kosovo’s exceptional performance can be attributed to two primary factors. Firstly, its citizens have embraced the Internet as a means to stay connected with family members living abroad, given Kosovo’s huge diaspora. Secondly, Kosovo has Europe’s youngest population with nearly 50% of its citizens under the age of 30, thus making up an economy with a high percentage of digital natives.
Sources: Big Think (2023[15]); KODE Project (2023[5]).
Kosovo has significantly enhanced its privacy and data protection framework since 2021. Aligning the Law on Personal Data Protection (PDP) with the EU General Data Protection Regulation (GDPR)11 in 2021 marked a crucial step, followed by the adoption of secondary legislation, including practical guidelines for its implementation over the past two years. Despite these advancements, the government has yet to prioritise the development of an e-privacy policy to complement the legal framework in personal data protection. Such a policy would provide a more holistic approach to e-privacy issues, ensuring layered protection for personal data, while striking a balance between privacy and business interests, covering both general processing and specific electronic communication aspects. The Information and Privacy Agency, as the competent public authority for privacy and personal data protection, has actively implemented the personal data protection framework. However, Agency’s current staff size of only 4 officials in the Personal Data Protection Department, coupled with insufficient financial resources funded from the state budget, limits its capacity to effectively implement the PDP framework and assess its impact in the public sector and business sectors. A plan to increase the Agency’s data protection staff to 10 officials is scheduled for 2024.
The Agency’s limited resources are impacting its capacity to conduct adequate awareness-raising and capacity-building activities. In 2022, the Agency had international donor support to implement awareness campaigns for public sector officials and the public, as well as to train its own personnel. These campaigns included presentations at public universities, distributing informative brochures throughout the territory, and participating in televised debates on personal data protection. Additionally, the Agency conducted training sessions for public sector officials at both central and local levels, as well as for judges, prosecutors, and data protection officers in the private sector. The Agency has gained stakeholders’ trust through its proactive measures in safeguarding e-privacy and personal data, as reported by international media freedom organisations and journalists for Kosovo (CPJ, 2022[16]). In 2022, the Agency issued 172 decisions and imposed 8 misdemeanour fines, evenly distributed between public and private auditors. It also inspected the municipalities of Kosovo, regarding personal data processing through camera surveillance systems in public spaces and issuing mandatory decisions to stop the processing and transfer the surveillance system to the Kosovo Police as the competent authority where necessary (AIP, 2023[17]).
Kosovo has enhanced its policies and programmes on consumer protection in e-commerce, although emphasis on necessary legal reforms has been insufficient. The Consumer Protection Programme 2021‑25 aims to harmonise relevant legislation, strengthen and develop administrative capacities in consumer protection, and educate consumers. However, its implementation has been slow. The Consumer Protection Department (CPD) in the Ministry of Trade employs only seven staff members and despite recommendations from the EC, the Law on Consumer Protection is not yet amended to address problematic articles and increase consumer awareness in e-commerce (European Commission, 2022[18]). The Law does not align with the EU Consumer Rights Directive12 or the relevant Consumer Rights Directive Guidance13 ensuring better enforcement and modernisation of consumer protection rules. Alignment is required regarding alternative dispute resolution, effective enforcement and consumer rights protection against unfair commercial practices.
The limited capacities of the CPD, co-ordinating the Consumer Protection Programme’s implementation, hamper effective awareness-raising activities on consumer rights and trader obligations in online purchases. Over the past three years, the CPD received 336 complaints regarding online purchases, resolving 77.68% of them (261 complaints), but leaving 75 complaints unprocessed. This small number of complaints reveals a low level of consumer awareness regarding their rights. Although the programme recognises e-commerce consumer protection as a priority, limited progress has been made in ensuring online consumer education. The CPD distributed approximately 6 000 fliers during “Consumer Week” in March 2023 around the five main regions of Kosovo, informing e-consumers about safe online shopping practices, and published a relevant e-consumer guide on its website. However, the significant increase in e-commerce since 2021 underscores the need for stronger public campaigns, particularly as the percentage of individuals engaged in e-commerce surged from 23.1% in 2021 to 51% in 2022 (KAS, 2024[19]), closely following the EU average of 55.79% (Eurostat, 2024[20]). Additionally, while the trade/market inspectorate conducts inspections according to trading and quality standards of goods and services, inspection activities in e-commerce businesses are not emphasised.
Kosovo strengthened its cybersecurity policy and legal framework in 2023 aiming to enhance the economy’s resilience against cybercrime. However, the implementation of relevant initiatives is pending and cybersecurity capacities remain inadequate. The new Cybersecurity Strategy 2023-27 with an Action Plan, adopted in late 2023, seeks to reinforce cybersecurity capacities and promote investments in the field, focusing on critical infrastructure protection through technological innovation and capacity-building initiatives. However, as of February 2024, the implementation of this action plan remains in its early stages. The strategy’s monitoring and evaluation processes are expected to improve the availability of cybersecurity indicators and statistical data in the next assessment period.
Furthermore, the adoption of the Law on Cybersecurity in April 2023, improved Kosovo’s alignment with the EU NIS Directive14 on networks and information systems security, but implementation efforts are in the initial phase. The government has initiated the drafting of eight by-laws for the Law’s implementation, pending adoption, and plans to finalise the framework with another five by-laws in 2024. However, full alignment with the EU acquis on cybersecurity will remain incomplete, until Kosovo amends legislation according to the EU NIS2 Directive,15 enforced in 2023, which extends the scope of the NIS Directive and strengthens the role of the NIS Co-operation Group. Such an alignment would establish the same high level of cybersecurity in Kosovo as in EU Member States and facilitate stronger co-operation between Kosovo’s forthcoming National Cybersecurity Agency and its counterpart authorities in the EU. The Agency, mandated by the current Law, is projected to be operational in 2025.
Meanwhile, the national CERT operates as a unit of the electronic communications regulator, ARKEP, awaiting its integration into the National Cybersecurity Agency. Progress on establishing sectoral Computer Emergency Response Teams (CERTs) is slow and a shortage of expert cybersecurity capacities hinders the creation of private and public sector Computer Security Incident Response Teams (CSIRTs). Addressing the shortage of cybersecurity talent is imperative, given its critical role in Kosovo's economy and social stability, especially with the significant reliance on digital services outsourced from EU and US markets. Additional challenges to be addressed include inadequate awareness raising on security risks and the adoption of effective mitigation measures. Moreover, Kosovo lacks a cybersecurity certification framework for ICT products, services and processes, in line with the EU Cybersecurity Certification Framework. Despite awarding commercial 5G licenses, Kosovo is yet to adopt measures on 5G networks’ cybersecurity.
Kosovo’s progress on implementing CO 2021 Recommendations has been mixed. The economy has made strong advancements in personal data protection and enhanced its government digitalisation efforts. Progress has been limited in aligning the electronic communications framework with the EU acquis, facilitating data-driven innovation and ensuring web content accessibility. Table 11.2 shows the economy’s progress in implementing past recommendations for developing a digital society.
Considering the level of the previous recommendations’ implementation, there are still areas in which Kosovo could enhance the digital society policy framework and further improve access to electronic communications and public data, digitalisation of government and businesses, inclusiveness of the digital society and trust in digital technologies. As such, policy makers may wish to:
Accelerate the adoption of the new Law on Electronic Communications and secondary legislation to facilitate investments in mobile 5G networks. Although Kosovo has already granted 5G licences, implementing a permit-exempt deployment regime will streamline and expedite 5G network installations, specifying the characteristics of small-area wireless access points (small antennas), according to regulation (EU) 2020/1070.16 Further alignment with the EU Connectivity Toolbox17 and the (EU) 5G Security Toolbox18 is crucial to developing new high-speed network infrastructure.
Update the legal framework on open data to foster the growth of a data-driven digital economy. The government should adopt new legislation aligned with the Open Data Directive and the EU Data Governance Act, expanding the legal obligations of public institutions to enable re‑use of public sector data. This legislation should regulate licences, dataset formats and metadata content, while identifying high-value datasets (e.g. geospatial, meteorological, statistics, mobility, etc.) and establishing trustworthy data services for data sharing and pooling. It is vital to reinforce the implementation of the framework with systematic capacity building for public officials in managing and distributing data, co-ordinating standards and processes for data re-use, and fostering partnerships with the private sector and civil society on data-driven e-service development (Box 11.2).
Prioritise the connection of all public registers and ensure utilisation of the interoperability platform for all data exchanges. The government should promote these reforms to facilitate the rapid development of e-government services and effectively implement the “once only” principle for a user-centred digital government. Additionally, completing alignment with the EU interoperability framework will facilitate future development of cross-border services. Adequate planning and co-ordination of the e-Government and public administration reforms (PAR) strategies, as well as the Programme for the reduction of administrative burden, are vital to ensure that administrative simplification does not interfere with the plan for public services’ digitalisation, causing further delays or creating a recurring need for e-services re-design. The government should engage in informing, educating, and garnering public support to ensure the continuity and success of ongoing and future reforms.
Developing trustworthy data partnerships requires a holistic approach that addresses technical, legal, ethical, and organisational aspects while promoting collaboration, transparency, and accountability among partners. Data partnerships should deliver mutual benefits and value to all parties involved. Ensuring the security and privacy of data shared between partners is paramount, while compliance with data protection regulations, as well as contractual agreements outlining data usage, ownership, and liability is crucial.
The establishment of sustainable public-public, public-private and private-private partnerships across sectors and borders enables participants to share information, good practice and experience on risk and its management. They can also help improve public policies. However, trust among stakeholders is essential for such partnerships to emerge, in part because of the sensitivity of the information to be exchanged.
The OECD Critical Activities Recommendation provides a list of conditions to establish trust. They include the need for clear aims, values and rules, mutual benefits over time, respect for personal data protection and other regulation protecting the confidentiality of information such as trade secrets.
Source: OECD (2022[21]).
Ensure stronger horizontal interministerial co-ordination of activities and monitoring of digital inclusion activities. The government should consider appointing a public body wit high‑level political commitment and operational capacity to co-ordinate and support the implementation of digital inclusion activities across various public sector institutions. Regular monitoring of a specific set of digital inclusion indicators is essential for informing future policy design. Additionally, swift adoption and enforcement of compliance with EU19 and international e‑accessibility standards for all public sector websites and applications are recommended. It is also important to adopt an accessibility certification scheme and integrate accessibility requirements into public procurement processes for ICT products and services.
Allocate adequate resources to cybersecurity and continue aligning with the EU cybersecurity framework. While the adoption of the new Law on Cybersecurity in 2023 is a positive step forward, the government should allocate significant human, technological and financial resources for its implementation and further alignment with the EU NIS2 Directive and the Cybersecurity Act.20 Operationalising the National Cybersecurity Agency with integration of the national KOS-CERT by the end of 2024 is critical for managing cybersecurity challenges through increased international co-operation and knowledge sharing. Effective capacity-building efforts for public sector officials and private sector professionals, along with awareness-raising initiatives for the general public, are necessary investments.
References
[17] AIP (2023), Summary of AIP Activities for 2022, Information and Privacy Agency, https://aip.rks-gov.net/download/summary-of-aip-activities-for-2022/.
[6] ARKEP (2023), Summary of the Main Indicators of Electronic Communications No.04/2023, Regulatory Authority of Electronic and Postal Communications, https://www.arkep-rks.org/desk/inc/media/1e267bbd-b2b1-4c0d-a5db-d4acebc22165.pdf.
[15] Big Think (2023), “Europe’s stunning digital divide, in one map”, https://bigthink.com/strange-maps/europe-digital-divide.
[16] CPJ (2022), Political Pressure on Journalists Risks Undermining Media Freedom Progress in Kosovo, Committee to protect Journalists, The John S. and James L. Knight Foundation Press Freedom Center, https://cpj.org/wp-content/uploads/2022/11/Joint-mission-findings-Kosovo-2022-Google-Docs.pdf.
[9] European Commission (2023), Kosovo 2023 Report, Commission Staff Working Document SWD(2023) 692 Final, European Commission, https://neighbourhood-enlargement.ec.europa.eu/document/download/760aacca-4e88-4667-8792-3ed08cdd65c3_en?filename=SWD_2023_692%20Kosovo%20report_0.pdf.
[18] European Commission (2022), Kosovo 2022 Report, Commission Staff Working Document SWD(2022) 334 Final, European Commission, https://neighbourhood-enlargement.ec.europa.eu/system/files/2022-10/Kosovo%20Report%202022.pdf.
[12] Eurostat (2024), Individuals - Internet Use, https://ec.europa.eu/eurostat/databrowser/product/page/ISOC_CI_IFP_IU (accessed on 27 May 2024).
[20] Eurostat (2024), Internet Purchases by Individuals (2020 onwards), https://ec.europa.eu/eurostat/databrowser/product/page/ISOC_EC_IB20 (accessed on 28 May 2024).
[13] Eurostat (2024), Websites and Functionalities by Size Class of Enterprise, https://doi.org/10.2908/ISOC_CIWEB (accessed on 1 March 2024).
[8] Eurostat (2022), Fixed Broadband Subscriptions Per 100 inhabitants, https://doi.org/10.2908/ISOC_CI_IN_H (accessed on 11 June 2024).
[19] KAS (2024), Purchase or Order of Goods and Services Online the Last Time, https://askdata.rks-gov.net/pxweb/sq/ASKdata/ASKdata__ICT__ICT%20in%20Households/TIK4point1.px/table/tableViewLayout1/ (accessed on 1 March 2024).
[11] KAS (2024), Use of Internet by Individuals in the Last 12 Months, https://askdata.rks-gov.net/pxweb/sq/ASKdata/ASKdata__ICT__ICT%20in%20Households/TIK2point1.px/ (accessed on 27 January 2024).
[3] KAS (2023), Results of the Survey on the Use of ICT in Household Economies 2023, Kosovo Agency of Statistics, https://askapi.rks-gov.net/Custom/5d0263eb-07bb-4df6-96da-0e50ed13ed88.pdf.
[14] KAS (2022), Use of Information and Communication Technology (ICT) in Enterprises, https://askapi.rks-gov.net/Custom/618b86f2-af16-4031-af17-afbaf37fff69.pdf.
[4] KAS (2022), Use of the Internet for Private Purposes for Public Services, Government Agencies or Administration, over the Last 12 Months, https://askdata.rks-gov.net/pxweb/sq/ASKdata/ASKdata__ICT__ICT%20in%20Households/TIK3point1_1.px/ (accessed on 12 June 2024).
[5] KODE Project (2023), “Europe’s Stunning Digital Divide, in One Map”, https://kodeproject.org/en/blog/2023/02/03/europes-stunning-digital-divide-in-one-map.
[2] MIA (2023), Kosovo’s Strategy for Electronic Government 2023-2027, Ministry of Internal Affairs, https://mpb.rks-gov.net/Uploads/Documents/Pdf/EN/2700/e-Government%20Strategy%20Kosovo%202023-2027.pdf.
[7] OECD (2022), “OECD going digital toolkit, fixed broadband subscriptions per 100 inhabitants”, https://goingdigital.oecd.org/en/indicator/10.
[21] OECD (2022), OECD Policy Framework on Digital Security: Cybersecurity for Prosperity, https://doi.org/10.1787/a69df866-en.
[10] PM Office (2024), Report of the Implementation of the Program for the Prevention and Reduction of the Administrative Burden 2022-2027 and the Action Plan 2022-2024, https://kryeministri.rks-gov.net/blog/raporti-i-zbatimit-te-programit-per-parandalimin-dhe-zvogelimin-e-barres-administrative-2022-2027-dhe-planit-te-veprimit-2022-2024/.
[1] STIKK (2023), Kosovo IT Barometer 2021-2022, Kosovo ICT Association (STIKK), https://stikk.org/wp-content/uploads/2023/07/IT_Barometer_2021-2022_STIKK.pdf.
← 1. Coaxial cable technology is the dominant fixed access technology in Kosovo. Most users in coaxial networks can have access to broadband connections up to 100 Mbps, which is not sufficient to underpin gigabit society access targets.
← 2. Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast) Text with EEA relevance, http://data.europa.eu/eli/dir/2018/1972/oj.
← 3. Directive 2014/61/EU of the European Parliament and of the Council of 15 May 2014 on measures to reduce the cost of deploying high-speed electronic communications networks Text with EEA relevance, https://eur-lex.europa.eu/eli/dir/2014/61.
← 4. Commission Implementing Regulation (EU) 2020/1070 of 20 July 2020 on specifying the characteristics of small-area wireless access points pursuant to Article 57 paragraph 2 of Directive (EU) 2018/1972 of the European Parliament and the Council establishing the European Electronic Communications Code (Text with EEA relevance), http://data.europa.eu/eli/reg_impl/2020/1070/oj.
← 5. Kosovo’s national open data portal https://opendata.rks-gov.net.
← 6. Open Data Directive: Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information (recast), http://data.europa.eu/eli/dir/2019/1024/oj.
← 7. Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act) (Text with EEA relevance), http://data.europa.eu/eli/reg/2022/868/oj.
← 8. The “once-only” principal refers to the citizen’s obligation to provide information to the digital administration only once, while from that point onwards the administration can access this information automatically.
← 9. Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC, http://data.europa.eu/eli/reg/2014/910/oj.
← 10. World Bank, “Strengthening Digital Governance for Service Delivery” project (Project ID: P178162), approved on March 20, 2023, Total Project Cost US$ 20.00 million
← 11. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), http://data.europa.eu/eli/reg/2016/679/oj.
← 12. Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019 amending Council Directive 93/13/EEC and Directives 98/6/EC, 2005/29/EC and 2011/83/EU of the European Parliament and of the Council as regards the better enforcement and modernisation of Union consumer protection rules (Text with EEA relevance), http://data.europa.eu/eli/dir/2019/2161/oj.
← 13. Commission notice Guidance on the interpretation and application of Directive 2011/83/EU of the European Parliament and of the Council on consumer rights (Text with EEA relevance) 2021/C 525/01, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52021XC1229%2804%29&qid=1640961745514.
← 14. Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union, http://data.europa.eu/eli/dir/2016/1148/oj.
← 15. Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA relevance), http://data.europa.eu/eli/dir/2022/2555/oj.
← 16. Commission Implementing Regulation (EU) 2020/1070 of 20 July 2020 on specifying the characteristics of small-area wireless access points pursuant to Article 57 paragraph 2 of Directive (EU) 2018/1972 of the European Parliament and the Council establishing the European Electronic Communications Code (Text with EEA relevance), http://data.europa.eu/eli/reg_impl/2020/1070/oj
← 17. The Connectivity Toolbox, https://digital-strategy.ec.europa.eu/en/policies/connectivity-toolbox.
← 18. Cybersecurity of 5G networks - EU Toolbox of risk mitigating measures, https://digital-strategy.ec.europa.eu/en/library/cybersecurity-5g-networks-eu-toolbox-risk-mitigating-measures.
← 19. Directive (EU) 2016/2102 of the European Parliament and of the Council of 26 October 2016 on the accessibility of the websites and mobile applications of public sector bodies (Text with EEA relevance), http://data.europa.eu/eli/dir/2016/2102/oj
← 20. Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (Text with EEA relevance), http://data.europa.eu/eli/reg/2019/881/oj.