Stakeholders in the processing of personal data
Personal Data Subject
The only users of the rules for personal data protection are the identified natural persons, i.e. the natural persons that can be identified. Legal entities cannot appear as holders of the right to personal data protection but can appear as holders of the right to privacy (right to reputation).
Identified person
Identification implies the existence of elements that describe the individual in a way that distinguishes him from other entities (e.g. the unique identification number of the citizen). Also, the personal name (name and surname) of the individual can be considered as such information. However, since the names are often repeated, additional information may be necessary to establish the identity of the person (e.g.: date of birth, address of residence, etc.). In other cases, other identifiers may be used to establish the identity of the person (e.g. for public office holders, it is sufficient to indicate the function of the person in order to establish his or her identity).
A person who can be identified
It is considered that the person can be identified if the information contains elements through which the identity of the person can be directly or indirectly determined.
Additional information for this purpose can be used: HTTP cookies, mobile phone bills, IP-address, location data, consumer habits of the person, etc. Thereby, it is necessary to have a reasonable possibility to identify the person, which means that such information can be obtained at a reasonable cost, at a reasonable time by all potential users of the information. In other words, if the identification of a person requires unreasonable time, effort, means, such a person will not be considered as an identifiable person, and hence such data will not fall under the rules of personal data protection.
Personal Data Controller
A controller can be a natural or legal person, a body of state power or a legal entity established by the state to exercise public authority, an agency or another body, which independently or together with others determines the purposes and manner of processing personal data. For example: Although the human resources department in a particular company processes employee data, the company, not its department, acts as a controller. In the recent case law „Google vs. Spain“ of the EU Court of Justice, the definition of controller is visibly extended to search engines. According to the Court, the browser operator determines the purposes and means of the activity, making the entered data on the websites available to any Internet user who searches for the name of the data subject, due to which it falls under the scope of “personal data controller”.
Personal Data Processor
Processor is a natural or legal person, body of state authority, state body or legal entity established by the state to exercise public authority, agency or other body that processes personal data on behalf of the controller.
Personal Data Protection Officer (DPO)
The personal data protection officer is an authorized person for personal data protection, appointed by the personal data controller, in the following cases:
- Тhe processing is performed by a body of state authority, except for the courts when acting within their competences, which will appoint an officer for other processing of personal data that is performed in accordance with the law;
- The basic activities of the controller or processor consist of processing operations which due to their nature, scope and / or objectives require a large extent regular and systematic monitoring of personal data subjects; or
- The basic activities of the controller or processor consist of extensive processing of special categories of personal data or personal data related to criminal convictions and criminal offences.
The personal data protection officer may be employed by the controller or processor or perform the work on the basis of a service contract (external collaborator).
A group of legal entities may designate one personal data protection officer, provided that the personal data protection officer is easily accessible to any legal entity within the group, the Agency and the personal data entities.
The personal data protection officer is determined on the basis of his / her professional qualifications, and especially on the basis of expert knowledge of the legislation and practices in the field of personal data protection, whereby it should:
- to meet the conditions for employment;
- to actively use the Macedonian language;
- he / she has not been pronounced a punishment or a misdemeanor sanction of prohibition to perform a profession, activity or duty at the moment of appointment;
- to have completed higher education; and
- to have acquired knowledge and skills regarding the practices and regulations for personal data protection, in accordance with the provisions of the Law on Personal Data Protection.
The controller or processor shall publicly disclose the contact details of the personal data protection officer and shall notify the Personal Data Protection Agency.
Personal Data User
User of personal data is a natural or legal person, body of state authority, state body or legal entity established by the state to exercise public authority, agency or other body to which personal data is disclosed, whether it is a third party or not, except when personal data are disclosed to the state authorities and the state bodies in the framework of a special investigation in accordance with the law, in which case the processing must be in accordance with the applicable rules for personal data protection according to the purposes of processing.
Third person
A third party is a natural or legal person, body of state authority, state body or legal entity established by the state to exercise public authority, agency or other body, which is not a personal data subject, controller, processor or a person under direct authorization. The controller or processor is authorized to process the data.
If you need legal help regarding above mentioned stakeholders, click here to find out more.
