GPS and worker monitoring in North Macedonia: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Mandatory information to workers and a legal basis (LPDP 2020)

  Yesrequired

  The employer must inform workers of the monitoring and rely on one of the legal bases under art. 10; for video surveillance the law expressly requires that employees be notified.

  Legge sulla protezione dei dati (LPDP, Gazzetta 42/20) - testo ufficiale

• Prior authorisation from an authority before installing

  Nonot required

  The 2020 law mirrors the GDPR accountability model; the old registration has been abolished. Prior consultation of the authority is triggered only if a DPIA shows a high residual risk.

  Legge sulla protezione dei dati (LPDP, Gazzetta 42/20) - testo ufficiale

• Basis = legitimate interest (art. 10), not consent

  Yesrequired

  The usual basis is legitimate interest, with a balancing test; consent in the employment relationship is normally not valid because of the imbalance of power.

  Legge sulla protezione dei dati (LPDP, Gazzetta 42/20) - testo ufficiale

• No continuous tracking; data minimisation (art. 4)

  Yesrequired

  Continuous location tracking is the most intrusive form and must undergo the strictest assessment of necessity and proportionality; data minimisation and purpose limitation apply.

  Legge sulla protezione dei dati (LPDP, Gazzetta 42/20) - testo ufficiale

• Impact assessment (DPIA) for GPS/location tracking of workers (AZLP blacklist, art. 39)

  Yesrequired

  The AZLP blacklist of processing operations that require an impact assessment includes tracking the location or behaviour of a person, such as GPS.

  AZLP, atti subordinati (regolamento videosorveglianza e lista DPIA, Gazzetta 122/20)

The procedure, step by step

1. 1

   Identify a valid legal basis (legitimate interest, art. 10) with a balancing test.

2. 2

   Inform the workers of the monitoring.

3. 3

   Carry out the impact assessment (DPIA) for GPS tracking of workers.

4. 4

   Limit the processing to what is necessary: no continuous tracking.

5. 5

   Configure the system in line with data minimisation and purpose limitation.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge sulla protezione dei dati (LPDP, Gazzetta 42/20) - testo ufficiale
• AZLP, atti subordinati (regolamento videosorveglianza e lista DPIA, Gazzetta 122/20)
• AZLP (Garante macedone), pagina ufficiale e reclami
• Schoenherr, la legge macedone sulla protezione dei dati (sanzioni)
• Regolamento UE 2016/679 (GDPR) - riferimento comparativo