Where can people turn for help following the security incident affecting government e-services?

       In light of the numerous requests received from citizens concerned about the possible impact on their personal data following the cyberattack on public digital services, we remind them that they have the right to obtain information and clarification regarding how their data has been affected and, where appropriate, to exercise the rights guaranteed under Law No. 195/2024 on personal data protection.

       The National Center for Personal Data Protection of the Republic of Moldova (hereinafter referred to as the Center) reiterates that the authorities take into account citizens’ concerns regarding personal data protection and access to public services. At the same time, determining the impact of the incident requires technical verifications and confirmation of the findings by the institutions involved, each acting within the scope of its respective powers. In this context, citizens will be informed about the restoration of services, the security measures taken, the confirmed results of the verifications, as well as the manner in which individuals whose data have been affected will be informed.

       Individuals who have noticed suspicious access to their personal data or who wish to obtain clarification regarding a possible impact on their data may contact the institution responsible for administering government electronic services – the e-Government Agency (AGE) – by submitting an electronically signed petition to office@egov.md or a paper petition bearing a handwritten signature. In this regard, individuals may request information concerning the reported access events, the institutions that carried them out, the purposes and legal bases indicated by those institutions, as well as any potential consequences of the incident for their personal data.

       Data subjects are advised to retain any notifications received, relevant screenshots indicating the date and time of the access events, as well as responses from the authorities or controllers contacted. This information may serve as evidence and may, where appropriate, be attached to a complaint submitted to the Center or to other proceedings aimed at safeguarding their rights and legitimate interests.

       We reiterate that the Center does not manage databases or filing systems and has no powers to administer them or to directly ensure the security and confidentiality of personal data stored therein.

       Under the law, responsibility for implementing appropriate technical and organizational measures to ensure an adequate level of data security belongs to data controllers. They are required to demonstrate that the processing activities they carry out comply with the provisions of Law No. 195/2024.

       Within the limits of its statutory powers, the Center supervises and monitors compliance with personal data protection legislation and investigates reported violations.

       In this regard, the Center has initiated an investigation to clarify the circumstances surrounding the incident and verify whether the entities involved in managing the information systems concerned have complied with their legal obligations. The findings established and the measures ordered by the Center will be communicated publicly.

       With regard to complaints submitted to the Center in connection with this incident, it should be noted that their examination and the formulation of a position on the merits of the issues raised will only be possible following the verification of the circumstances and the completion of the relevant investigation into the incident, resulting in a reasoned decision in each case concerning the compliance of the personal data processing operations.

       A complaint addressed to the Center may be submitted using the standard complaint form of the NCPDP, available on the website www.datepersonale.md under the section dedicated to complaints, or in paper form, bearing a handwritten signature. The use of the form is not mandatory; however, the complaint must meet the requirements set out in Article 79 of Law No. 195/2024. Where submitted electronically, the complaint must be electronically signed in accordance with the law, together with any documents and evidence that the complainant considers relevant in support of their complaint.

       It is important to contact the controller first in order to clarify the situation, as only the controller holds the information regarding the processing operations in which the data was accessed and the technical and organisational measures applied, and is therefore in a position to verify whether or not the individual’s data was affected by the incident. The information requested from the controller and the response received will be included in the complaint submitted to the Centre, helping to clarify the circumstances of the complaint.

       The Center will examine the submissions within the limits of its statutory powers, with a view to ensuring respect for the fundamental rights and freedoms of natural persons with regard to the processing of personal data.

       Furthermore, in relation to the matters brought to the Center’s attention, it should be noted that, pursuant to Article 74 of Law No. 195/2024, individuals who consider that their rights have been infringed as a result of the processing of personal data may bring an action before a court against the controller or the processor. This legal remedy is distinct from the procedure for examining complaints by the Center.