In many buildings in Kosovo, electricity bills are delivered without envelopes and left in communal hallways of apartment blocks for anyone to see. Despite privacy concerns, little is being done to resolve the issue.
Any curious neighbour could easily see exactly how much Mimoza owes on her electricity bills, because they are dumped, open for everyone to read, in her communal hallway.
“They no longer leave the bills at my door. There is no mailbox at the entrance, and recently, my electricity bills have gone missing,” says Mimoza, a woman in her early-70s living in Qamil Bala street in Pristina, whose name has been changed to protect her identity.
Her case is not isolated. In many apartment blocks in Pristina, and other cities in Kosovo, electricity bills don’t arrive in envelopes, they are just left open in communal hallways. Bills delivered without envelopes was normal practice in Yugoslavia for years. Although other countries have since modernised, Kosovo seems to have maintained the practice.
Despite the availability of Kosovo Electricity Supply Company’s (KESCO) electronic billing app in 2019, many Kosovo residents, especially the elderly, still rely on physical electricity bills. But they are often delivered insecurely – left in hallways and elevators exposing sensitive personal data. Each bill carries a name, an address, and the price, visible to anyone who passes by. Yet it’s a routine delivery that often goes unquestioned.
The Agency for Information and Privacy (AIP) told BIRN it had received complaints from citizens concerned about the exposure of personal data through electricity bills.
“The complaints primarily originate from residents of collective housing units, where bills are left in corridors or in partially exposed mailboxes, enabling third parties to access the information contained in them,” AIP told BIRN.
Electricity bills at the entrance of an apartment in Prishtina. Photo: Erlida Mulaku
Data protection laws in Kosovo are in line with European Union standards. For example, the General Data Protection Regulation (GDPR) requires that personal information is collected and used only for clear and legitimate reasons.
AIP has issued two fines against KESCO, citing violations of citizens’ personal data protection rights during the distribution of electricity bills.
The first fine, imposed on August 16, 2024, amounts to €20,000 and came after AIP approved four separate complaints from citizens. These complaints concerned the unauthorised exposure of personal data as a result of how electricity bills were delivered, with sensitive information reportedly accessible to individuals other than the intended recipients.
The second fine, totaling €25,000, was issued on April 1, 2025, following a formal complaint submitted by a citizen via email on March 16, 2025. In this complaint, the individual raised concerns about a breach of privacy in their apartment building in Pristina. According to the report, KESCO was leaving printed electricity bills in the hallway and in front of the building’s elevator, without applying adequate safety measures to protect customer data.
Despite this, KESCO insists that the current practice of sending bills with no enveloped complies with the law in Kosovo, and that it is legally required to continue this kind of physical bill distribution.
Spokesperson Margarita Rashiti did not address questions from BIRN about the potential privacy violations involved in current delivery practices, and what actions are being taken to promote digital billing. Instead, she referred to the current legal obligations. “Currently, the legislation in force obliges us to send bills in physical form. So, until another legislative change, we must send them in the form that we are currently sending them,” she said.
According to the information and privacy agency AIP, KESCO on 28.02.2024 was sent a formal notice outlining its legal obligation to take appropriate security steps when distributing bills and to ensure that the chosen method respects the privacy of individuals. It stated: “The processing of personal data (including the distribution of documents or bills containing personal information) must be conducted in accordance with the legal provisions defined in Law No. 06/L-082 on the Protection of Personal Data (LMDhP),” the Agency stated in its warning. “Any processing that contradicts these provisions constitutes a violation of the law. In this specific case, the security measures prescribed by the LMDhP must be implemented to prevent access to personal data by unauthorised third parties.”
When BIRN asked KESCO spokesperson Margarita Rashiti to respond to this, she repeated that the company had an obligation to send paper bills.
It appears that paying bills physically in Kosovo is still the norm. For water bill payments, Arjeta Mjeku, spokesperson for the Regional Water Supply Company KRU Prishtina said that in 2024 a total of 85,329 payments were completed through the electronic system, while 259,345 payments were made physically.
Mjeku explained that physical payments remain more common due to lack of digital literacy, stronger trust of in-person transactions, the high number of pensioners making payments, and the convenience offered by physical payment points.
“The challenges are not related to the availability of electronic options – they exist and are accessible – but rather to citizens’ habits, digital education, personal financial management, and the demographic profile of consumers,” she said.
Institutions in breach of privacy
Electricity bills in exposed mailboxes at the entrance of an apartment in Prishtina. Photo: Erlida Mulaku
Aside from the stress of missing bills and potential late payments, Mimoza feels her privacy is being breached. “It’s not right”, if there’s no mailbox, the person delivering the bills should hand it directly to the apartment door, not just leave it in the hallway at the entrance.”
For Mimoza, the issue has become distressing. “I haven’t contacted anyone about it,” she said. “Honestly, I just hoped I would run into someone from KESCO in the hallway and mention it. But the worst part is that they don’t even ring the bell to hand the bill over,” she added.
A resident of Shefki Kuleta Street in Fushë Kosovë also mentioned that electricity bills are left outside her apartment without envelopes. She says she complained to KESCO workers at the time, but her concerns were dismissed.
“The collector who delivers the bills is not the one who makes the decisions, so it’s pointless to talk to them,” she added.
According to cybersecurity expert Blerta Thaqi from Open Data Kosovo, this method of distribution could constitute a violation of the Law on the Protection of Personal Data.
“At the national level, the Law on the Protection of Personal Data and the guidelines of the Information and Privacy Agency require that data be processed securely and not exposed in public spaces. At the European level, the GDPR and the recommendations of the European Data Protection Board (EDPB) prohibit the dissemination of sensitive documents in places where unauthorized individuals could access them,” Thaqi explained.
Despite being available for several years, KESCO’s EKesco app has yet to see widespread adoption among users, with many still relying on physical paper bills. KESCO serves more than 700,000 consumers, including households, businesses, and public institutions, and, according to a press release published on its official website on February 7 this year, the number of users of the eKESCO mobile application has surpassed 304,000.
Electronic bills are seen by the AIP as far more secure than paper bills. “Regarding the electronic electricity bills used by citizens, in the context of personal data protection, the Agency considers this a security measure for personal data, as access to personal information by unauthorised persons is considered limited,” it said.