Legal analysis of the law
- Title of the law and Official Gazette number (last change or modification)
Law on Secondary Education (“Official Gazette of the Republic of Macedonia“ n.44/1995, 24/1996, 34/1996, 35/1997, 82/1999, 29/2002, 40/2003, 42/2003, 67/2004, 55/2005, 113/2005, 35/2006, 30/2007, 49/2007, 81/2008, 92/2008, 33/2010, 116/2010, 156/2010, 18/2011, 42/2011, 51/2011, 6/2012, 100/2012, 24/2013, 41/2014, 116/2014 and 135/2014)
- Does the Law envisage processing of personal data and in what type of Collection? (Evidence, Register, Data Base)
Integrated database:
- Databases for the students enrolled in the secondary school
- Databases for the parents, that is, guardians of the students enrolled in the secondary school and
- Databases for the employees in the primary school
Pedagogical documentation:
- Main register of students
- Main register of final exam
- Main register of graduation exam
- Main register of international graduation exam
- Main register of secondary specialized education
- Diploma, certificate, certificate of specialized education, certificate of work ability, transfer documents.
- What is the purpose of collecting personal data? Is that purpose clear?
Secondary school collects, processes, keeps, sends and uses personal data contained in the personal data collections for the needs of the integrated data base kept by the Ministry of Education.
Personal data collections are created for the purposes of:
- improvement of the processes and procedures necessary for the human resource, finance, and secondary school infrastructure management
- provision of timely, consistent, complete, and accurate data that provide support for the decision-making process, education policy implementation, and secondary education reform planning
- provision of data necessary for operation of other sub-systems (electronic class register and external examination of students’ achievement) in the secondary education, and
- efficient management of funds distribution in the decentralized educational system, planning of the construction and reconstruction of school infrastructure, and improvement of the professional development of the employees in secondary schools
- What categories of personal data are collected? Is the scope in compliance with the purpose?
The database for the students enrolled in the secondary school shall contain a PIN, surname, father’s name and name of the student, data and place of birth, sex, community affiliation, student’s mother tongue, address, place of residence, contact telephone, e-mail address, special educational need, student’s status (full time/part time).
The databases for the parents, that is, guardians of students enrolled in secondary school shall include kinship with the student, name and surname, data and place of birth, sex, community affiliation, address and place of residence, contact telephone, e-mail address, and degree of education.
The databases for the employees in the school shall include a PIN, surname, father’s name and name of the employee, sex, community affiliation, data and place of birth, address, place of residence, municipality, temporary address and place of residence, nationality, type and degree of education, the last completed school/faculty, previous work experience, employee category, title with number of classes, contact telephone, office telephone number, e-mail address, type of transportation to the working place used by the employee, disability, regional unit of HIF, number of PDIM, date of beginning of employment, date of termination of employment, ground for termination of employment, employee’s status (indefinite/definite period of time).
Personal data are given to the Secondary schools by the parents/guardians of the students.
- Who collects the personal data at first instance? (company, institution)
Secondary school
Ministry of Education
- Is the Consent of the data subject for personal data protection envisaged by this law?
The consent of the data subject is not envisaged for the categories of personal data which are collected in practice. The electronic Register contains health data, blood type, PIN of the parent and for all those data the consent should be envisaged by law.
- Is the keeping period of personal data clearly defined?
It is not clearly defined for every data collection separately.
Main register of students, main register of final exam, main register of graduation exam, main register of international graduation exam, main register of secondary specialized education are kept permanently.
- Does the law contain separate provision for personal data protection that clearly states the implementation of technical and organizational measures?
No. A separate provision on the manner of processing should be added as it is defined in the Law on Primary Education.
„The manner of personal data processing, the persons that are authorized to use the data contained in the separate databases of personal data referred to this Law, the criteria according to which the level of access for the persons authorized to process the personal data are determined, the technical and organizational measures for ensuring secrecy and protection of personal data processing, the manner of destruction upon expiry of the period for keeping the personal data, and other measures shall be prescribed by the minister.“
- Is the processing of personal data prescribed by this law connected to implementation of another law?
Law on Archives.
- Are there any exemptions for processing of sensitive data? (PIN, biometrics, video surveillance)
PIN ; Health data.