The Albania AKSHI scandal poses a question that every organization entrusting sensitive data to a third party must now consider: what is your discovery and governance obligation when the custodian of that data turns out to be criminally compromised? The answer, under both U.S. and European law, is more demanding than most organizations realize.
The AKSHI scandal in Albania is, among other things, a data governance catastrophe. The National Agency for Information Society managed the e-Albania platform — the digital portal through which Albanian citizens access government services, submit documents, and interact with state institutions. It managed government IT systems. It processed sensitive data on the entire Albanian population. And according to SPAK's investigation, it was simultaneously operating as a criminal procurement enterprise, with contracts steered to a criminal network through coercion, intimidation, and organized corruption.
The question the AKSHI case poses for legal and governance professionals is not primarily about Albania. It is about the principle it illustrates — one that applies wherever sensitive data is entrusted to a third party whose internal integrity cannot be verified from outside: what are the discovery and governance obligations of the organizations, agencies, and individuals whose data was held by a custodian that turned out to be criminally compromised?
Under U.S. law, the answer to that question has become considerably clearer over the past several years. Under European data protection frameworks, including GDPR, the answer is in some respects even more demanding. The Albania case is extreme in its institutional context. The underlying governance problem it illustrates is not.
Personal data of the entire Albanian population processed through e-Albania — now potentially in a chain of custody that includes criminal actors
Some AKSHI procurement procedures were classified as state secrets — operated by the same network accused of organized crime
SHISH director allegedly communicated classified information to a fugitive AKSHI suspect — the two institutions were not independent
Former police chief questioned. Former deputy PM Balluku implicated. The network connecting the institutions keeps growing.
Under GDPR, the organization that collects and controls personal data — the data controller — is responsible for ensuring that any third party processing that data on its behalf does so lawfully and securely. That responsibility does not transfer to the processor when the processor turns out to be corrupt. It remains with the controller. The data subjects — the individuals whose data was held — have rights against the controller, not the processor, if those rights are violated.
In the AKSHI context, that means the Albanian state — as the data controller that delegated processing to AKSHI — faces the question of whether citizen data was compromised, whether it was accessed by unauthorized persons connected to the criminal network, and whether the data subjects were notified of any breach. AKSHI's alleged criminal operation does not relieve the state of its obligations to the citizens whose data it held. It creates new obligations on top of the existing ones.
For private organizations that use cloud vendors, SaaS platforms, or outsourced IT infrastructure to process sensitive customer or employee data, the AKSHI case is an extreme but instructive version of a problem that arises regularly in corporate discovery. When a vendor is the subject of an investigation, litigation, or regulatory action, the data that the vendor processes on the organization's behalf may become evidence in proceedings the organization did not initiate and cannot control. The organization's agreements with the vendor — the data processing agreement, the security requirements, the audit rights — are the only tools it has to respond to that discovery demand.
AKSHI held the data. AKSHI was the criminal enterprise. The Albanian state was the data controller. Under GDPR, the controller's obligation to the data subject did not disappear because its processor was corrupt. It became more urgent.
When a vendor that processes your sensitive data becomes the subject of a regulatory investigation, a civil lawsuit, or a criminal prosecution, the discovery obligation that follows is not the vendor's alone. The vendor's internal communications about how it handled your data — what it did with it, who had access to it, what its security practices actually were versus what it represented them to be — become evidence in proceedings that directly affect your organization's liability and obligations.
Most organizations have never thought through what that means in practice. The data processing agreements they signed may or may not give them the right to audit the vendor's security practices. The contracts may or may not require the vendor to notify them of a compromise within a specific timeframe. The agreements may or may not specify what happens to the data if the vendor's principals are arrested, the business is seized, or a regulator orders production of vendor records as part of an investigation.
The AKSHI case takes all of those questions to their most extreme conclusion: what happens when the vendor is not just negligent, but criminal? What happens when the data the vendor was supposed to protect was allegedly being managed by people who were simultaneously running a criminal procurement network? The legal answer, under both European and U.S. frameworks, is that the data controller's obligations to its data subjects do not change. The data subject's claim runs against the controller. The controller's claim against the vendor is a separate matter — but the controller still has to respond first.
The AKSHI scandal poses the data governance question in its most extreme form: what do you do when the institution you trusted with sensitive data turns out to have been a criminal enterprise? For private organizations, the analog is more modest in scale but identical in structure: what do you do when a cloud vendor, an IT provider, or a managed services company that processes your data becomes the subject of regulatory action, civil litigation, or criminal investigation?
At Sovereign Discovery, we help organizations understand the discovery implications of their vendor relationships before those implications become urgent. The contracts matter. The audit rights matter. The notification obligations matter. And the plan for what happens to your data if your vendor's operations are disrupted — by investigation, by seizure, or by insolvency — is a governance question that most organizations have not answered. The Albania case makes that question impossible to ignore.
Albania entrusted AKSHI with the digital infrastructure of an entire nation. AKSHI, according to SPAK's investigation, was simultaneously operating as a criminal procurement enterprise. The citizens whose data AKSHI held had no way of knowing. The government that delegated to AKSHI had no effective mechanism for detecting the problem until investigators uncovered it from the outside.
The question the AKSHI case leaves for every organization that entrusts sensitive data to a third party is not hypothetical. It is a current governance gap: what would you do, right now, if you learned that the vendor holding your most sensitive data had been operating corruptly? Do you have the contractual rights, the audit mechanisms, and the data recovery plan to respond? If the answer is not immediately clear, the AKSHI case is the reason to make it clear before the question becomes urgent.