[1] Example: The Law on Electronic Communications establishes that operators are obliged to keep records of all established subscriber relations with users, which should especially contain data on: name, surname, address and social security number. The processing of this data by the operators is carried out in accordance with the law.

[2] Example: The employee’s personal data is processed by the employer in order to exercise the rights, as well as perform the obligations and responsibilities arising from the employment contract. If the legislator with a certain legal solution imposes on the employer the obligation to enter the names of the employees in another collection of personal data for the purpose of exercising certain rights of the employees that do not derive from the employment contract, the employer performs data processing for a purpose other than the original one for which were collected.

[3] Example: If a certain person fills out a registration form in order to participate in a prize game, it is enough to state his first and last name and contact information (residential address or telephone number). The information about his marital status or his unique social security number are irrelevant, inadequate and excessive in relation to the purpose to be achieved. If the employer asks the candidate applying for employment to submit his photo, this personal data is irrelevant, inappropriate and excessive in relation to the goal to be achieved. Regardless of the type of business relationship established, the processing of nationality data by banks for their customers, or by operators of electronic communication services for their users, would be irrelevant, inappropriate and excessive.

[4] Example: The administration for keeping registers, as a body within the Ministry of Justice that keeps the registers in accordance with the Law on Registers, is obliged to continuously update the same, that is, to replace the existing data of the citizens with new ones (change of surname, residential address, etc.)

[5] Example: After the termination of the validity of the insurance contract between the insurance company and its client, and after the expiration of the storage terms, according to the regulations for office and archival operations, the documentation related to that business relationship should be destroyed.

[1] Example: The Law on Electronic Communications establishes that operators are obliged to keep records of all established subscriber relations with users, which should especially contain data on: name, surname, address and social security number. The processing of this data by the operators is carried out in accordance with the law.

[2] Example: The employee’s personal data is processed by the employer in order to exercise the rights, as well as perform the obligations and responsibilities arising from the employment contract. If the legislator with a certain legal solution imposes on the employer the obligation to enter the names of the employees in another collection of personal data for the purpose of exercising certain rights of the employees that do not derive from the employment contract, the employer performs data processing for a purpose other than the original one for which were collected.

[3] Example: If a certain person fills out a registration form in order to participate in a prize game, it is enough to state his first and last name and contact information (residential address or telephone number). The information about his marital status or his unique social security number are irrelevant, inadequate and excessive in relation to the purpose to be achieved. If the employer asks the candidate applying for employment to submit his photo, this personal data is irrelevant, inappropriate and excessive in relation to the goal to be achieved. Regardless of the type of business relationship established, the processing of nationality data by banks for their customers, or by operators of electronic communication services for their users, would be irrelevant, inappropriate and excessive.

[4] Example: The administration for keeping registers, as a body within the Ministry of Justice that keeps the registers in accordance with the Law on Registers, is obliged to continuously update the same, that is, to replace the existing data of the citizens with new ones (change of surname, residential address, etc.)

[5] Example: After the termination of the validity of the insurance contract between the insurance company and its client, and after the expiration of the storage terms, according to the regulations for office and archival operations, the documentation related to that business relationship should be destroyed.

[6] Example: The Electoral Code contains the legal basis for processing the personal data of citizens in the Electoral List.

[7] Example: Operators of electronic communication services, banks, insurance companies or any other companies, after establishing a business relationship with users, customers, policyholders, can use their personal data for direct marketing, only on the basis of their express consent. , which should be in a form that makes it possible to declare whether the data can be used for this purpose or not. Based on such consent, their personal data may be processed solely for direct marketing purposes, but not for other purposes.

[8] Example: Mainly, in every contract, the personal data of natural persons or the representatives of legal persons as contractual parties are processed (name and surname, place of residence, social security number, ID card number), but whether and what other personal data will be processed depends on the subject of the contract and the purpose for which it is concluded.

[9] Example: Natural and legal persons, state authorities or other bodies have the obligation to submit personal data to the competent courts, for the purpose of presenting them as evidence in court proceedings, when these data are requested in a manner established by law.

[10] Example: In exceptional cases, such as natural disasters, emergency or war, etc., the authorized authorities will have the right to disclose certain personal data (name and surname, location) in order to find or rescue a certain person.

[11] Example: The Public Health Institute and the Public Health Centers for the purpose of performing work in the public interest – timely prevention and prevention of the spread of an infectious disease, may process personal data of sick persons, but also of persons with whom the sick were in contact .

[12] Example: The personal data of a certain subject (name and surname and telephone number) are publicly published in a telephone directory for a specific purpose – making contact. These personal data, which have previously been publicly published in a telephone directory, may also be processed for another purpose – to conduct research, if the subject is asked if he agrees to participate in the research. At the same time, such processing of personal data will be considered legitimate, especially because in this way the freedoms and rights of the subject are not threatened. However, the use of data from the telephone directory for performing direct marketing will not be able to be brought under this legal basis, because in the ZZLP it is explicitly stated that direct marketing can be carried out exclusively on the basis of the express consent of the subject of personal data .

[13] “Official Gazette” no. 38/09 and 158/10

[14] The documentation contains: Plan for creating a system of technical and organizational measures to ensure confidentiality and protection of personal data processing; Rulebook on technical and organizational measures to ensure confidentiality and protection of personal data processing; Procedure for determining the obligations and responsibilities of the administrator of the information system and the authorized persons when accessing documents and information-communication equipment; Procedure for reporting, reaction and remediation of incidents; Procedure for the method of making a backup copy, archiving and storage, as well as for restoring saved personal data; Procedure for the destruction of documents, as well as for the destruction, deletion and cleaning of media; Instructions on how to keep records for the authorized persons who process personal data and transmit media outside the controller’s working premises.

[15] The central register is available on the website www.azlp.mk. It is available to controllers so that they can register their collections online through a simple procedure and free of charge.

[16] The content and form of the act that should be adopted by the controller is prescribed by the Rulebook on the content and form of the act on the way of performing video surveillance of DZLP.