Signing of the Decree approving the signing of the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223)

The National Centre for Personal Data Protection, for information purposes, communicates that on December, 22 this year, the President of the Republic of Moldova, Maia SANDU, signed the Decree approving the signing of the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223).

The Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data provides a multilateral, robust and flexible legal framework to facilitate cross-border data flows and effective safeguards on the use of personal data. This instrument was opened for signature by the Council of Europe (CoE) on October 10, 2018 and up to now, has been signed by 44 states, 5 of which are not members of the CoE (Argentina, Tunisia, Mauritius, Uruguay and the Russian Federation) and ratified by 20 states.

The Protocol is a multilateral treaty drawn up under the auspices of the CoE which, according to Article 36, is open for signature by States Parties to Convention 108.

The purpose of this Convention is to protect every individual, whatever his or her nationality or residence, with regard to the processing of their personal data, thereby contributing to respect for his or her human rights and fundamental freedoms, and in particular the right to privacy.

The Protocol itself provides for a number of innovations, such as:

–    Stricter proportionality requirements, data minimisation principles and lawfulness of processing;

–   Expansion of the types of sensitive data, which will now include genetic and biometric data, trade union membership and ethnic origin;

–   Obligation to notify data breaches;

–   Greater transparency of data processing;

–   New rights of individuals in a decision-making context, which are particularly relevant in relation to the development of artificial intelligence;

–   Increased accountability of data controllers;

–   Requirement to apply the principle of ‘privacy by design’

–   Application of data protection principles to all processing activities;

–   The regime for cross-border flows of personal data;

–   Strengthened powers and independence of data protection authorities and improved legal basis for international cooperation.

The Decree on the signing of the Protocol entered into force on 23 December this year and was published in the Official Gazette of the Republic of Moldova No. 428-430 Article 790.