Legal analysis of the law
- Title of the law and Official Gazette number (last change or modification)
Law on Primary Education (“Official Gazette of the Republic of Macedonia“ n.103/2008, 33/2010, 116/2010, 156/2010, 18/2011, 42/2011, 51/2011, 6/2012, 100/2012, 24/2013, 41/2014, 116/2014 and 135/2014)
- Does the Law envisage processing of personal data and in what type of Collection? (Evidence, Register, Database)
Integrated database:
- Databases for the students enrolled in the primary school
- Databases for the parents, that is, guardians of the students enrolled in the primary school and
- Databases for the employees in the primary school.
Pedagogical documentation:
- main register of students
- record lists of the students achievement
- student identification card
- certificate and transfer document.
- What is the purpose of collecting personal data? Is that purpose clear?
Personal data collections are created for the purposes of:
- improvement of the processes and procedures necessary for the human resource, finance, and primary school infrastructure management
- provision of timely, consistent, complete, and accurate data that provide support for the decision-making process, education policy implementation, and primary education reform planning
- provision of data necessary for operation of other sub-systems (electronic class register and external examination of students’ achievement) in the primary education, and
- efficient management of funds distribution in the decentralized educational system, planning of the construction and reconstruction of school infrastructure, and improvement of the professional development of the employees in primary schools.
- What categories of personal data are collected? Is the scope in compliance with the purpose?
The database for the students enrolled in the primary school shall contain a PIN, surname, father’s name and name of the student, data and place of birth, sex, community affiliation, student’s mother tongue, address, place of residence, contact telephone, e-mail address, special educational need, student’s status (full time/part time).
The databases for the parents, that is, guardians of students enrolled in primary school shall include kinship with the student, name and surname, data and place of birth, sex, community affiliation, address and place of residence, contact telephone, e-mail address, and degree of education.
The databases for the employees in the school shall include a PIN, surname, father’s name and name of the employee, sex, community affiliation, data and place of birth, address, place of residence, municipality, temporary address and place of residence, nationality, type and degree of education, the last completed school/faculty, previous work experience, employee category, title with number of classes, contact telephone, office telephone number, e-mail address, type of transportation to the working place used by the employee, disability, regional unit of HIF, number of PDIM, date of beginning of employment, date of termination of employment, ground for termination of employment, employee’s status (indefinite/definite period of time).
Personal data are given to the Primary schools by the parents/guardians of the students.
- Who collects the personal data at first instance? (company, institution)
Primary School
Ministry of Education
- Is the Consent of the data subject for personal data protection envisaged by this law?
No. The consent of the data subject is not envisaged for the categories of personal data which are collected in practice. The electronic Register contains health data, blood type, PIN of the parent and for all those data the consent should be envisaged by law. Access to this data should be also regulated in the software.
- Is the keeping period of personal data clearly defined?
It is not precisely defined for every data collection separately.
Main register of students is kept permanently.
- Does the law contain separate provision for personal data protection that clearly states the implementation of technical and organizational measures?
The manner of personal data processing, the persons that are authorized to use the data contained in the separate databases of personal data referred to this Law, the criteria according to which the level of access for the persons authorized to process the personal data are determined, the technical and organizational measures for ensuring secrecy and protection of personal data processing, the manner of destruction upon expiry of the period for keeping the personal data, and other measures shall be prescribed by the minister.
- Is the processing of personal data prescribed by this law connected to implementation of another law?
Law on Archives.
- Are there any exemptions for processing of sensitive data? (PIN, biometrics, video surveillance)
PIN ; Health data.