The Metamorphosis Foundation through its Human Rights Online program focuses on protecting privacy by enhancing the capacities and knowledge of citizens and digital society institutions. Metamorphosis promotes access for all through innovative use and dissemination of knowledge and ethical use of new technologies. In this regard, Metamorphosis analyzed the aspect of informing the citizens about the processing of personal data while using the mobile application “MOJ DDV”.

The mobile app “MOJ DDV” is available on the Google Play Store and App Store, and before installation, citizens can be informed about technical specifications, how to scan the bills, and they can also find answers to frequently asked questions. What is missing is a Privacy Policy that in an understandable way explains the measures taken by the Public Revenue Office for the security and protection of the personal data of citizens that are processed while using the application.

According to the General Data Protection Regulation (GDPR), the controller of the Public Revenue Office should take appropriate measures to provide citizens with a concise, transparent and easily accessible form of information on:

  • What are the objectives and legal basis for the processing of personal data and whether in the future this data may be processed for purposes other than using the mobile application “MOJ DDV”?
  • Will personal data be disclosed to other users outside the Public Revenue Office?
  • What are the deadlines for data retention by the Public Revenue Office?
  • How can citizens exercise their right to correct and erase the personal data they provided for the purpose of using the mobile app “MOJ DDV”?

An additional confusion for citizens wishing to be informed about their right to privacy is the presentation of the 2017 UJP.GOV.MK Usage Policy as a document that regulates the protection of personal data of “MOJ DDV” users. This Policy cannot be treated as a Privacy Policy for users of the mobile app “MOJ DDV” because the purpose for which data is processed while using the application and the amount of data being processed does not correspond to the purposes and scope of the use of UJP.GOV.MK.

Metamorphosis recommends creating separate privacy policies for each application through which citizens disclose personal information to exercise their rights.