North MacedoniaLaw on Personal Data Protection (LPDP), automated individual decision-making
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
As of .
What it requires
- Because Article 122 suspends Chapter III until North Macedonia's accession to the European Union, Article 26's protection from a decision based solely on automated processing does not currently bind a controller under this Law.
- Once Chapter III takes effect, give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them, under Article 26.
- Once Chapter III takes effect, where a decision based solely on automated processing rests on a contract with the data subject or their explicit consent, implement suitable measures to safeguard their rights, freedoms and legitimate interests, under Article 26(3).
What this law does
Article 26 would give a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them. The right would not apply to a decision necessary for a contract with the data subject, authorised by a law that lays down suitable safeguards, or based on their explicit consent.
In the contract and consent cases the controller would have to implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests. Article 122 suspends Chapter III, which carries Article 26, until North Macedonia's accession to the European Union, so none of it currently binds a controller.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.