On March 18, 2025, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the National Agency for the Prevention and Combating of Violence against Women and Domestic Violence (NAPCV), at their request.

The aim of the training course was to familiarize the NAPCV representatives with the aspects related to the field of personal data protection, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the normative framework.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the requirements for personal data protection in the exercise of the official duties; issues relating to the appointment of the Data Protection Officer (DPO); the obligations and tasks of a DPO; aspects related to the Data Protection Impact Assessment (DPIA); the stapes and obligation to perform a DPIA, etc.

The training course proved to be a useful and interactive, and the aspects related to the examination of requests for the disclosure of personal data, the term of retention/storage and use of personal data at the end of the processing operations, as well as the new legal provisions in the field of personal data protection, were of great interest to the participants.

During the event 12 representatives of the National Agency for Prevention and Combating Violence against Women and Domestic Violence were trained.

On March 13, 2025, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the representatives of the ASEM High School of Tourism and Hotel Services, at their request.

The aim of the training course was to increase the awareness of travel agencies and tour-operators’ employees on the principles of personal data protection, as well as to ensure the correct application of the legal provisions in the field, in the activity they perform.

During the event important topics were discussed, such as: 

• The definition of general notions related to the field of personal data protection;

• The rights of personal data subjects; 

• The principles and legal grounds for personal data processing;

• The processing of special categories of personal data; 

• The requirements for personal data protection in the exercise of official duties; 

• Ensuring the security and confidentiality of personal data processed;

• Data Protection Impact Assessment (DPIA) issues.

The training course was an interactive one, with multiple practical examples being presented in order to increase the awareness of travel agencies and tour-operators representatives on the principles of personal data protection. At the same time, the legal way of requesting personal data, the storage period of information containing personal data in accordance with the legal provisions, as well as the lawfulness of disclosing information containing personal data via e-mail and instant messaging, were of particular interest to the course participants.

About 50 representatives of the ASEM High School of Tourism and Hotel Services were trained during the event.

On March 12th, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the General Inspectorate of Border Police (GIBP). 

The aim of the training course was to increase the awareness of the GIBP employees on the principles of personal data protection, as well as to ensure the correct application of the legal provisions in the fiel, in the activity they perform.

During the event topics of importance were discussed such as:

• Definition of general notions related to the field of personal data protection;

• Principles and legal grounds for personal data processing;

• The rights of personal data subjects;

• Requirements for personal data protection in the performance of official duties;

• Ensuring the security and confidentiality of personal data processed;

• Examination of requests for disclosure of personal data;

• Legal grounds regarding the processing of personal data through video surveillance systems, etc.

The training course proved to be interactive and useful, and the aspects related to the correct procedure of accessing personal data through the state information systems, the correct procedure of identification of persons who do not have identity documents, as well as the exchange of data/information between countries in the absence of an international agreement/treaty, were of particular interest to the participants.

Approximately 45 GIBP representatives were trained during the event.

The training course is part of the GIBPtraining plan for 2025, which was approved and signed by the heads of the NCPDP and the GIBP on January 28th.

On March 11, 2025, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Basarabeasca Police Inspectorate.

The aim of the training course was to increase the employees of the Basarabeasca Police Inspectorate awareness on the principles of personal data protection and as well as to ensure the correct application of the legal provisions in the activity they perform.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the legal grounds for the processing of personal data in the activity performed by police; the requirements for personal data protection in the exercise of official duties; ensuring the security and confidentiality of personal data processed, etc.

The training course turned out to be very useful and interactive, and the issues related to the correct procedure for accessing personal data through the State Information Systems, including the application of the exceptions and restrictions regulated by Article 15 of the Law 133/2011, as well as the legal aspects of processing personal data through video surveillance systems, were of particular interest to the participants.

During the event 24 representatives of the Basarabeasca Police Inspectorate were trained.

The training course is part of the training plan for the subdivisions of the General Police Inspectorate (GPI) for the year 2025, approved and signed by the heads of the NCPDP and the GPI on January 28 this year.

On March 03-07, 2025, the representative of the National Center for Personal Data Protection (NCPDP) participated at the event Advancing Human-Centric Public Services: Academy on Service Design and Delivery in a Digital Age, which took place in Paris, France.

This first academy marks the beginning of a long-term effort to enhance service design and delivery in the Eastern Partnership (EaP) countries, aiming to foster human-centric public service design through an intensive exchange of knowledge between key state institutions from the EaP countries and EU. It brought together representatives of public service development agencies, e-governance institutions, and personal data protection authorities across the Eastern Partnership region, alongside experts from the Organization for Economic Cooperation and Development (OECD) and the EU, to discuss and explore the latest advancements in service delivery and digital transformation.

The Academy covered topics of importance such as:

• Principles of good administration, with a focus on service delivery;

• OECD recommendations for human-centric public service design;

• Insights from digital transformation efforts across the EaP region;

• Gain of insights on the French strategy on the use of artificial intelligence in human resources; 

• Human-centric digital public service – Ensuring accessibility and efficiency in the digital age;

• National perspectives – Presentations on recent developments and challenges in service delivery, etc.

This academy is part of a series aimed at enhancing public service re-engineering, focusing on digitization, quality management and data protection, in order to ensure lasting, sustainable reforms in public administrations across the region, ensuring citizens have better, faster and more efficient access to services.

The above-mentioned event is the first academy under the regional project “Public Administration Reform in the Eastern Partnership Countries III”, co-organized by the German International Cooperation Agency (GIZ) and SIGMA.

On March 10, 2025, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the representatives of first level of local public authorities from ATU Gagauzia, at the request of the State Chancellery.

The aim of the training course was to increase the representatives of first level of local public authorities from ATU Gagauzia’ awareness on the principles of personal data protection, as well as to ensure the correct application of the legal provisions in the activity they perform.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the principles and legal grounds for personal data processing; the rights of personal data subjects; the requirements for personal data protection in the exercise of official duties of representatives of first level of local public authorities from ATU Gagauzia; ensuring the security and confidentiality of personal data processed, etc.

The training course was interactive and useful, as the participants asked multiple questions arising from their work, to which they received documented answers with practical examples from the trainers. At the same time, the issues related to access to information of public interest from the point of view of the legislation on personal data protection, the correct procedure for accessing personal data through state information systems and the record of such accesses by the representatives of first level of local public authorities, the examination of requests for personal data disclosure, as well as the lawfulness of recording and online transmission of local council meetings, were of particular interest to the participants. 

The event was attended by about 55 representatives of first level of local public authorities from ATU Gagauzia.

On 26 February 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the employees of the General Inspectorate for Migration (GIM), South Regional Department, at their request.

The purpose of the training course was to increase the level of perception of employees of the GIM South Regional Department ​​on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

Important topics were discussed during the event, such as:

• The definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• The processing of special categories of personal data;

• The principles and legal grounds for the processing of personal data;

• The requirements for the protection of personal data in the exercise of official duties;

• Data Protection Officer (DPO) designation issues;

• The obligations and tasks of a DPO;

• Ensuring the security and confidentiality of personal data processed, etc.

The training course was an interactive one, the participants asking multiple questions to the trainers about the requests for personal data disclosure coming from countries that do not ensure an adequate level of data protection, the issues related to the proper procedure for accessing personal data through the State Information Systems, the proper audit trail of these accesses, as well as the correct depersonalization of information containing personal data.

During the event 21 representatives from GIM, South Regional Department were trained.

On 25 February 2025, a study visit of a group of students – members of the European Law Students Association of the Republic of Moldova (ELSA) – the largest international, independent, apolitical and non-profit organization managed by/and for students – took place at the National Center for Personal Data Protection.

The aim of the event focused on raising awareness among young generation/university community on the field of personal data protection, strengthening knowledge in the field, as well as exploring the applicable legal framework, the rights and obligations of the parties involved and the importance of compliance with various areas.

At the same time, the students were informed about the organization and functioning of the NCPDP, the attributions of the NCPDP’s subdivisions, structure, mission, and the role of the authority in monitoring compliance with the legislation on personal data protection.

The students were also familiarized with: general notions related to the field of personal data protection; the rights of personal data subjects; principles and legal grounds for processing personal data; processing of special categories of personal data; ensuring the security and confidentiality of personal data processed, etc.

The event ended with a question and answer session documented with practical examples, and the NCPDP aims to continue to support such efforts to educate and raise awareness among young people about the importance of personal data protection.

 The study visit was organized at the request of the European Association of Law Students, an organization which currently has 40,000 members in 42 countries from Europe.

On 14 February, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for maib representatives, at their request.

The aim of the training course was to increase the banking sector employees’ awareness of the principles of personal data protection and the correct application of the legal provisions in the field in their work.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the principles and legal grounds for processing personal data; the requirements for the protection of personal data in the exercise of official duties; the assurance of  the security and confidentiality of processed personal data, etc.

The training course was an interactive one, with multiple practical examples being presented in order to increase the perception of maib representatives on the principles of personal data protection. At the same time, the new legal provisions in the field of personal data protection, the aspects related to the obligations of the controller/ processor in relation to the appointment of the Data Protection Officer, his/her obligations and tasks, the conditions under which it is necessary to perform the Data Protection Impact Assessment, anonymization/pseudonymization of personal data, as well as the financial penalties in case of a breach of the legislation in the field, were of great interest to the participants.

About 100 maib representatives were trained at the event, moderated by personal data protection experts from the NCPDP.

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, informs about the administrative fine of 240 000 euros imposed by the French Data Protection Authority (CNIL) on KASPR for violation of Article 5 – Principles relating to processing of personal data, Article 6 – Lawfulness of processing, Article 12 – Transparent information, communication and modalities for the exercise of the rights of the data subject, Article 14 – Information to be provided where personal data have not been obtained from the data subject, Article 15 – Right of access by the data subject. 

KASPR markets an extension for the Chrome browser that enables paying customers to obtain the professional contact details of people whose profiles they visit on the LinkedIn social network. To do this, the company builds a database of contact details from LinkedIn and other websites such as domain name registries. The contact details thus collected generally enable the company’s customers to contact the target persons, for example for commercial prospecting, recruitment or identity verification. KASPR’s database contains about 160 million contacts.

The French Supervisory Authority, CNIL received many complaints from people who had been canvassed by entities that obtained their contact details via the KASPR extension.

The CNIL found several breaches of the GDPR:

• Failure to comply with the obligation to have a legal basis (Article 6 of the GDPR)

• Failure to comply with the obligation to define and respect a data retention period proportionate to the purpose of the processing (Article 5-1-e of the GDPR)

• Failure to comply with the obligation to provide transparency and information to individuals (Articles 12 and 14 of the GDPR)

In this context, CNIL imposed a fine of 240,000 euros on KASPR for all these breaches, and ordered the company to: cease collecting the data of persons who chose to limit the visibility of their contact details, and delete the data collected in this way. If it is impossible to distinguish the data whose visibility had been limited, the company will have to inform the persons concerned, within 3 months, of the processing of their data and of the possibility of objecting to it, and to use their data solely for this purpose; stop the automatic renewal of the storage of personal data of target persons; inform the people whose data is collected in a language they understand; respond to requests for access from individuals, providing all available information on the sources of data collection.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.