North MacedoniaLaw on Personal Data Protection (LPDP), video surveillance
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Retention
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Kept
What it requires
- Publish a clear, visible notice that video surveillance is in place before operating it, naming the controller and explaining how to learn the place and storage period of the recordings, and notify employees of video surveillance on official or business premises.NIST Privacy FrameworkCM.AW-P1
- Limit video surveillance to the area sufficient for the goal it was installed for, and never install it in changing rooms, dressing rooms, toilets or similar rooms.NIST Privacy FrameworkGV.PO-P1
- Store video surveillance recordings for no longer than 30 days unless another law sets a longer period with its own safeguards, and remove, at your own expense, any camera installed contrary to this Law.NIST Privacy FrameworkCT.DM-P5
- Obtain the written consent of at least 70% of the owners or tenants of a single-unit or multi-unit residential building before introducing video surveillance there, and never transmit its recordings over cable television, the internet or another electronic means, or record the entrances to other individual apartments.NIST Privacy FrameworkCT.PO-P1
- Analyse the goal of a video surveillance system before installing it, and reassess it every two years, covering the continuing need for it, its goals, and feasible technical alternatives.NIST Privacy FrameworkID.RA-P5NIST Privacy FrameworkGV.MT-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.MT-P1Privacy risk is re-evaluated on an ongoing basis and as key factors, including the organization’s business environment (e.g., introduction of new technologies), governance (e.g., legal obligations, risk tolerance), data processing, and systems/products/services change.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Access record
Logging duty
Article 92 requires the controller to analyze the purpose before setting up video surveillance (paragraphs 1 and 2), to evaluate the results every two years (paragraph 3) and to prepare a report, as part of the system's documentation, that must include statistics on access to the recordings and on how they were used (paragraphs 4 and 5). The Agency's director prescribes the content of the analysis and the report (paragraph 6). The evaluation is the controller's own, on a two-year clock, with no independence condition, so it is coded as a self review. Article 89(8) keeps the recordings no longer than 30 days unless another law sets a longer period; the recordings are the personal data and not a record about them, so that limit is not coded as a log retention period. Article 93(4) lets the supervisor ask for camera screen captures and a statement as evidence in a complaint. The Law names no one entitled to see the report, so no access is coded.
- Kind
- Explicit
- As of
- Provision
- Article 92(3) to (5)
- Trigger
- personal_data_processing
What this law does
Articles 89 to 93 hold North Macedonia's dedicated video surveillance regime. A controller performing video surveillance must publish a clear, visible notice that it is in place. The notice must state that video surveillance is carried out, name the controller, and explain how to obtain information on where and for how long the recordings are kept. Article 89, paragraph 7 requires the controller to notify employees of video surveillance on official or business premises.
Article 89, paragraph 6 allows video surveillance only of the area sufficient for the goals for which it was installed. Article 90, paragraph 3 prohibits video surveillance in cloakrooms, changing rooms, toilets and similar rooms. Article 89, paragraph 8 allows recordings to be stored for no longer than 30 days unless another law sets a longer period with its own safeguards.
Under Article 89, paragraph 9 the owner of a camera installed contrary to the Law must take measures to remove it at their own expense. Article 91, paragraph 1 requires the written consent of at least 70% of the owners, tenants or lessees of the housing units for video surveillance in single-unit and multi-unit residential buildings.
Article 91 bars transmitting those recordings over cable television, the internet or other electronic means of data transmission, and bars recording the entrances to other owners' or tenants' individual apartments. Article 92, paragraph 1 requires the controller to analyze the goal of a video surveillance system before establishing it.
Article 92, paragraph 3 requires a periodic assessment of the system's results every two years, covering the continuing need for it, its goals and possible technical alternatives.
When LexLint raises it
When your app profile says your app runs an essential service or processes personal data.
Back to the example · Lint your app
Page updated .