North MacedoniaLaw on Personal Data Protection (LPDP), special categories, a child's consent and biometric, health and genetic data
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Age verification, Biometric
- Audit expectation
- none
What it requires
- The processing of a child's personal data for an information society service offered directly to the child is lawful where the child is at least 14 years old, or, if younger, only where the child's legal representative has given or authorized the consent; make a reasonable effort to verify that consent, taking available technology into account.
- Get the Agency's prior approval before processing health data, genetic data or biometric data of a person in North Macedonia, including where the processing rests on the data subject's own explicit consent, unless the processing is determined by a law that itself provides safeguards or the genetic data is processed by an expert for preventive medicine, diagnostics or treatment.NIST Privacy FrameworkGV.PO-P5
- Do not process a special category of personal data unless one of Article 13's exceptions applies, such as the data subject's explicit consent, a necessity ground tied to employment or social security law, vital interests, or an important public interest carried out with suitable safeguards.NIST Privacy FrameworkCT.PO-P1
- Process personal data relating to criminal convictions and offences only under the control of an official authority, or under a law that provides appropriate safeguards for the rights and freedoms of data subjects.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 12 to 14 and 84 bar processing of special categories without a ground, require a reasonable effort to verify a guardian's consent for a child under 14, limit conviction data to public control and require the Agency's prior approval for health, genetic and biometric data. They state no duty to create, keep or produce a log or record. The verification effort in art. 12(2) states no record of it. The register of processing is art. 34, which is not cited on this row.
- Kind
- None
- As of
What this law does
Article 12, paragraph 1 makes processing of a child's personal data for an information society service offered directly to the child lawful where the child is at least 14 years old, or, if younger, only where the child's legal representative has given or authorized the consent. Article 12, paragraph 2 requires the controller to make a reasonable effort to verify that the legal representative gave the consent, taking available technology into account.
Article 84, paragraph 1 requires the Agency's prior approval before processing data concerning health. It requires the same approval before processing genetic data, unless experts process it for the needs of preventive medicine, medical diagnosis or care and treatment of the data subject, and before processing biometric data.
Article 84, paragraph 2 extends the approval requirement to processing based on the data subject's explicit consent, and paragraph 3 makes it unnecessary where a law that contains safeguards determines the processing. Article 13, paragraph 1 prohibits processing of the special categories of personal data defined in Article 4, paragraph 1, point 13.
Article 13, paragraph 2 permits it where an exception applies, such as the data subject's explicit consent for one or more specific purposes, necessity in the field of employment and social security under a law or collective agreement, vital interests, the legitimate activities of a non-profit body, data the data subject has manifestly made public, legal claims, or an important public interest based on law.
Article 14 confines processing of personal data relating to convictions and offenses to processing under the control of a competent state authority, or where a law permits it with appropriate safeguards for the rights and freedoms of data subjects.
Article 2 of the amending law published in Official Gazette 294/2021 replaced the words "осуди за кривични дела" ("convictions for criminal offenses") in the first and second sentences of Article 14 with "казнени осуди и казнени дела" ("penal convictions and penal offenses").
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .