Amendment of certain legal provisions in the field of personal data protection

On 10 December 2021, Law No. 175 of 11 November 2021 on the amendment of certain legal acts was published in the Official Gazette of the Republic of Moldova, which contains amendments in the field of personal data protection.

By the mentioned normative act, some provisions of the Law no. 133/2011 on personal data protection were amended, including:

–         New wording of the notion “consent of the data subject”, being excluded the obligation to express consent in written or electronic form.

–         Exclusion of the obligation for personal data controllers to notify the National Centre for Personal Data Protection (NCPDP). Thus, the notification procedure has been replaced by an obligation for the controller to carry out a Data Protection Impact Assessment, if personal data processing is likely to result in an increased risk to the rights and freedoms of individuals.

–          Introduction of the obligation for the controller and for the processor to designate the Data Protection Officer.

–         Repeal of art. 28 of Law 133/2011 on personal data protection, following that the Record Register of personal data controllers will be deleted, within two months from the publication of Law no. 175/2021 in the Official Gazette.

–         Rewording of Article 32 of Law 133/2011 on personal data protection, with amendments relating to the cross-border transfer of personal data and approval of the list of states ensuring an adequate level of personal data protection.

Similarly, amendments have been made to the provisions of the Contravention Code of the Republic of Moldova, in terms of contraventions attributable to the processing of personal data in violation of the legislation on personal data protection.

It should be noted that Law no. 175/2021 will enter into force within 30 days of its publication in the Official Gazette.