On June 26, 2024, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for the representatives of the State Tax Service (SFS) from the region in the field of personal data protection, at their request.

The purpose of the training session was to familiarize tax officials with aspects related to the protection of personal data in the public service, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event the following topics of importance were discussed:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal grounds for processing personal data;

Data Protection Officer (DPO) designation issues and the duties and tasks of a DPO;

Data Protection Impact Assessment issues;

Ensuring security and confidentiality of personal data by SFS employees;

Requirements for the protection of personal data in the performance of their duties;

Reviewing requests for disclosure of personal data, etc.

The training course was an interactive one, participants asking the trainers multiple questions on issues related to access to information of public interest from the point of view of the personal data protection legislation, as well as the legality of storing, keeping and disclosing personal data.

About 300 tax officials attended the event, which was organized in an online format.

On June 21, 2024, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for employees of the State Tax Service (SFS) in the field of personal data protection, at their request.

The purpose of the training was to familiarize tax officials with aspects related to the protection of personal data in the public service, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event were discussed such topics as:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal bases for the processing of personal data;

Data Protection Officer (DPO) designation issues;

Duties and tasks of a DPO;

Data Protection Impact Assessment (DPIA) issues;

Requirements for personal data protection in carrying out official duties, etc.

The training course was an interactive one, participants asking multiple questions on the legality of storing, keeping and disclosing personal data, examining requests for disclosure of personal data, as well as ensuring the security and confidentiality of such data.

The event was attended by about 20 representatives from the SFS

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 856 000 euro imposed by the Finnish Data Protection Authority (SA) on Verkkokauppa.com for breach of Article 5 Principles relating to the processing of personal data and 25 Ensuring data protection from the time of conception and by default of the GDPR.

The Finnish SA investigated the activities of online retailer Verkkokauppa.com following a complaint from a customer. The controller had asked the customer to register as a customer before shopping online. Shopping in the online shop was not possible without creating a customer account.

The investigations found that the controller did not specify the storage period of the data collected for the customer accounts in its online shop and that they were stored indefinitely. Furthermore, the controller’s practice of requiring the creation of a customer account in order to make online purchases violated data protection legislation. The creation of a customer account or the storage of personal data resulting from such creation may not be a mandatory requirement to make individual purchases online.

In this context, the Finnish SA has imposed an administrative fine of € 856 000 on the controller for failing to define the storage period for personal data relating to customer accounts. The controller was required to specify an appropriate storage period for customer account data and to rectify its mandatory registration practice. Verkkokauppa.com was also reprimanded for practices in breach of data protection legislation.

The NCPDP as the national supervisory authority for the processing of personal data emphasizes the responsibility of data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the applicable legislation.

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine imposed by the Hellenic Data Protection Authority (DPA) on HELLENIC POST SERVICES SA for violation of Article 5 Principles related to the processing of personal data and Article 32 Security of processing of GDPR.

“HELLENIC POST SERVICES S.A.” (ELTA S.A.) has reported two personal data breach incidents to the Hellenic SA in compliance with the GDPR. The first incident involved a data encryption breach for the purpose of a ransom request in the company’s system as a result of a malware attack from third parties, while the second incident involved the leak of personal data, which was subsequently published on the Dark Web.

Following investigations, the Hellenic SA found that the controller did not comply with the necessary technical and organizational measures and did not ensure the implementation of the security policy for the processing of personal data. This failure resulted in breaches in the controller’s system, including vulnerability scanning, unauthorized access to system resources, execution of malicious processes, disabling security software and file encryption.

In this context, the Hellenic SA imposed on ELTA S.A. an administrative fine amounting to 1% of the last available annual turnover based on assessment criteria in accordance with EDPB Guidelines 4/2022 on the calculation of administrative fines, namely: the large number of persons affected, the amount of damage, the nature of the breach, the non-compliance with the security policy and the categories of data affected. Mitigating factors were also taken into account, such as: the reinforcement of system security measures after the incident, the fact that the investigation of the incident was entrusted to a specialized company and ELTA S.A. followed its instructions, the data recovery and the unfavorable financial situation of the company.

The NCPDP, as the national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and enforcement, communicates about the administrative fine in the amount of 13.9 million euro imposed by the Czech Data Protection Authority (SA) on a company registered in the Czech Republic for violation of Article 6 Lawfulness of processing and Article 13 Information to be provided where personal data is collected from the data subject of the GDPR.

The case concerns the transfer by controller of personal data collected by it from users of its anti-virus software to an affiliated company. The proceedings were initiated on the basis of media reports and an anonymous file.

Following the investigation, the Czech SA found that the controller transferred personal data of users of anti-virus software and browser extensions to the affiliated company without having a legal basis for such processing. The transferred data related to approximately 100 million users and included in particular the pseudonymized web browsing history of the users linked to a unique identifier. In addition, the Czech SA found that the controller misinformed its users (data subjects) about these data transfers, as it claimed that the transferred data were anonymized and used exclusively for statistical sales analysis. At the same time, the Czech Data Protection Authority concluded that Internet browsing history, even if not complete, may constitute personal data, as re-identification of at least some of the data subjects could occur. The controller’s breach is all the more serious as it is one of the leading experts in the field of cybersecurity, providing the public with data protection and privacy tools.

An administrative fine of €13.9 million (CZK 351 million) was imposed on the data controller. The decision is final and enforceable.

The NCPDP as the national supervisory authority for the processing of personal data, emphasizes the responsibility of data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the applicable legislation.

In the period 14-16 May 2024, representatives of the National Centre for Personal Data Protection (NCPDP) participated in the 32nd Spring Conference of the European Data Protection Authorities in Riga, Latvia.

This year Spring Conference was hosted by the Latvian State Data Protection Inspectorate and brought together Data Protection Authorities from across Europe to establish a common framework for cooperation to protect individuals’ data at European level. The conference also served as a unique European platform for the exchange of experience and best practices in the field of data protection.

During the working sessions, topical issues were presented, such as:

• The role of Data Protection Authorities in the era of evolving digital regulation;

• Managing data protection and privacy in the era of emerging technologies and innovations;

• Health data protection in the age of digitization;

• Shaping data protection through the cooperative experience of Data Protection Authorities;

• Managing the Anti-Money Laundering (AML) and General Data Protection Regulation (GDPR) regulations: challenges, cooperation and compliance;

• Strengthening compliance with AML and GDPR regulations through collaborative strategies.

For the second time, an Open Day was organized as part of a Spring Conference of the European Data Protection Authorities. This gave the opportunity to several institutions, NGOs or other organizations that expressed an interest in the topics addressed during the event to participate, including online.

The event was attended by 145 representatives from 43 countries, such as: Austria, Belgium, Bulgaria, Croatia, Denmark, France, Georgia, Germany, Greece, Hungary, Italy, Malta, Moldova, Portugal, Romania, Spain, Switzerland, Ukraine, etc. Representatives of four organizations attended also the event: FRA, EDPS, EDPB and the European Commission.

On 16 May 2024, the National Centre for Personal Data Protection organized a training course on personal data protection for the employees of the Institute for Standardization (ISM) at their request.

The aim of the training course was to increase ISM employees’ awareness on the principles of personal data protection, as well as to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event important topics were discussed, such as:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal grounds for processing personal data;

Requirements for the protection of personal data in the exercise of official duties;

Issues relating to the appointment of the Data Protection Officer (DPO);

Obligations and tasks of a DPO;

Ensuring the security and confidentiality of personal data processed, etc.

The training course was interactive, participants asking the trainers many questions about the legal aspects of personal data processing through video surveillance systems, as well as the time limit for the retention/storage and use of personal data at the end of processing operations.

The event was attended by about 20 representatives from ISM.

In the light of the multitude information disseminated in the public space in relation to personal data processing in the context of conducting the Population and Housing Census of the Republic of Moldova in 2024, the National Centre for Personal Data Protection (NCPDP) comes with the following clarifications:

The purpose of Law No 133/2011 on the protection of personal data is to ensure the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data, in this regard establishing framework requirements to ensure compliance of the processing of personal data in various sectors, such as: medical, financial-banking, police, education, telecommunications, etc.

In this respect, the law in question contains general provisions and sectoral regulations that may lay down specific rules on the purpose of processing personal data, the categories of data subject to processing, the data subjects, the conditions under which processing takes place, measures to ensure the confidentiality and security of personal data, the entities to which personal data may be disclosed, etc.

The reasoning set out above is also valid in relation to the normative acts regulating the organization and conduct of the Population and Housing Census in the Republic of Moldova in 2024.

It is worth mentioning that, in view of the competences assigned to it, the NCPDP actively participated in the approval process of the normative acts regulating the processing of personal data related to official statistics, submitting comments and proposals to improve their content, in order to comply with the requirements of the legislation on personal data protection.

In view of the issues raised in the public space regarding the processing of personal data in the process of conducting the Population and Housing Census in 2024, it will be emphasized that the processing of personal data is considered lawful when it is carried out on the legal grounds provided for in Article 5 of the Law on the Protection of Personal Data. In this regard, para. (5) of the aforementioned article provides for situations where the consent of the data subject is not required for the processing of personal data, for example, as appropriate to the case at hand, for the fulfilment of an obligation incumbent on the controller by law or for the performance of tasks in the public interest or resulting from the exercise of the prerogatives of public authority vested in the controller or the third party to whom the personal data are disclosed.

Thus, in order to provide information of public interest on the resident population and housing for the elaboration, monitoring and evaluation of policies, for the argumentation of human development decisions, for scientific research and for the development of the business environment, the legislator adopted Law No 231/2022 on the population and housing census, and subsequently approved the related secondary regulatory framework, acts which involve/generate the processing of personal data for the purpose of the census. 

Respectively, the processing of personal data in the framework of this exercise is carried out on the basis of the normative acts regulating the organization and conduct of the Population and Housing Census in the Republic of Moldova in 2024, but the Law on the Protection of Personal Data does not come with specific regulations/conditions in this regard.

Thus, the provisions of Article 7 of the Population and Housing Census Act, which make participation in the census compulsory, are relevant. For example: in para. (1) of this article states that participation in the census of persons who meet the conditions of Art. 3 para. (1)(1)(a) to (c) is compulsory. Further, para. (5) states that if one or more members of the household are missing, the enumerator shall complete the census questionnaires on the basis of information provided by the other members who are fully competent, if they know the answers to the questions in the questionnaires. The necessary information about minor children is provided by their legal representatives. Article 23 of the same Act provides that violations of the provisions of the Act shall give rise to disciplinary, civil, criminal and/or misdemeanour liability, as appropriate.

In the same vein, it should be mentioned that, as a data controller, the National Bureau of Statistics is empowered by law to collect, process and store personal data, ensuring appropriate confidentiality and security of individual data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, through technical, organisational and administrative measures implemented in accordance with the Personal Data Protection Policy and other legislation related to the subject matter.

In addition it should be mentioned that, in accordance with Article 14 para. (4) of the Population and Housing Census Act, the NBS is prohibited from transmitting personal data collected for the purpose of the census to other natural or legal persons.

In another context, it should be noted that, by Law No 175/2021, the power of the NCPDP to authorize the processing of personal data was excluded, as well as the obligation of data controllers to notify the NCPDP of personal data processing operations, while at the same time Article 28 of Law No 133/2011 was repealed, which led to the liquidation of the Register of personal data controllers. In these circumstances, we draw attention to the fact that the National Bureau of Statistics, including the census takers involved in the collection of census data in the territory, must not hold and, respectively, present respondents with any authorization issued by the NCPDP to process personal data.

In the context of the above subject, it should be noted that, to date, the NCPDP has not received any complaints from data subjects regarding the possible non-compliant processing of their personal data carried out in the framework of the Population and Housing Census of the Republic of Moldova 2024, including with regard to alleged transmissions of personal data to unauthorized persons.

Finally, the NCPDP recommends the population to get information from official sources, and when there are any uncertainties regarding the legal regime of personal data protection or official statistics, to contact the competent authorities.

Every year, on 9 May is celebrated Europe Day, a celebration of peace and unity in Europe. The date marks the historic day on which the Schuman declaration was made. This year we celebrate 74 years after it was signed. In a speech in Paris in 1950, then French Foreign Minister Robert Schuman proposed establishing a new form of political cooperation in Europe that would eliminate forever the possibility of another war between the nations of Europe. Robert Schuman’s proposal is considered the cornerstone of the European Union. In order to mark Europe Day, the EU institutions open their doors to the public in Brussels and Strasbourg in early May. Local EU offices in Europe and around the world organise various activities and events for all ages.

This year, Europe Day will be celebrated under the slogan “Freedom, Peace, Prosperity – Europe is you!”. The traditional European Village will take place in the Great National Assembly Square under the aegis of the Government, the Delegation of the European Union to the Republic of Moldova, together with the embassies of EU Member States and EU-funded projects.

The National Centre for Personal Data Protection (NCPDP), together with other institutions in the Republic of Moldova as well as in the EU, celebrates Europe Day every year. Throughout its years of activity, the NCPDP has followed the European vector, has worked closely with and received support from EU institutions.

Only during 2024, the NCPDP, in collaboration with the Technical Assistance and Information Exchange Instrument (TAIEX), organised on 26 January the national conference “Raising Awareness of Convention 108+” for about 100 representatives from both public institutions and the private sector. At the same time, from 11 to 13 March 2024, representatives of the NCPDP conducted the study visit “Processing of personal data through video surveillance systems”. The event was hosted by the Spanish Data Protection Authority (AEPD) – Agencia Española de Protección de Datos. These events, organised with the support of the TAIEX team, served as an opportunity to share experiences and best practices with EU experts on raising awareness and informing the public sector on the field of personal data protection.

At the same time, international cooperation continues to be the promoter of the NCPDP’s institutional development objectives. Successes in this respect have been achieved thanks to the exchange of experience, knowledge, best practices with data protection authorities, training provided by EU experts, the uptake and application in practice of international personal data protection standards. Cooperation, both at European and international level, is a strategic issue that requires involvement in all initiatives under development. In this context, the plenary meetings of the European Data Protection Board and the meetings of the Bureau of the Convention 108 Committee are regularly attended.

The NCPDP believes that solidarity, freedom, peace and the rule of law are the pillars on which the functioning of the European Union is based, and that Europe Day marks the values on which it was founded. Europe Day is about and for the people, about the future of every European citizen, while the EU represents a democratic model of values and principles that have been and remain fundamental to their prosperity.

The National Centre for Personal Data Protection (CNPDCP), for information and enforcement purposes, communicates about the administrative fine of 525 000 euros imposed by the French Data Protection Authority (CNIL) on HUBSIDE.STORE for breach of Article 6 (Lawfulness of processing) and Article 14 (Information to be provided where personal data have not been obtained from the data subject) of the GDPR.

HUBSIDE.STORE conducts telephone and SMS prospecting campaigns to promote products sold in its stores (mobile phones, laptops, etc.), acquiring data from data brokers and publishers of competing product testing websites.

As a result of the investigations, the CNIL found several violations of the GDPR, such as:

• Failure to have a legal basis for processing personal data (Article 6 GDPR);

• The misleading aspect of the data collection forms used by data brokers responsible for data collection did not allow valid consent to be obtained from data subjects. Therefore, HUBSIDE.STORE did not have a valid legal basis for collecting data (Article 6 of the GDPR) for commercial marketing via telephone calls. It is also a violation of the French Postal and Electronic Communications Code (Article L.34-5) for the purpose of marketing via SMS;

• Failure to comply with the obligation to inform individuals (Article 14 of the GDPR). Investigations revealed that individuals contacted by telephone did not have all the necessary information on the collection and use of their personal data (e.g. the identity and contact details of the company, the purposes for which the data was used, the retention periods, the source of the data, their rights or even the possibility to lodge a complaint with the French Data Protection Authority).

In this context, the CNIL imposed an administrative fine of €525,000 on HUBSIDE.STORE, which has been made public. The CNIL cooperated closely with its counterparts (Belgium, Italy, Spain, Portugal) in examining the draft decision under the single procedure, as HUBSIDE.STORE processes data from customers and potential customers in several EU Member States. The amount of the fine, which represents approximately 2% of the company’s turnover, was decided according to the seriousness of the infringement and the responsibility assumed by the company using the data collected. The CNIL also took into account the fact that HUBSIDE.STORE made extensive use of commercial marketing.

The NCPDP, as the national surveillance authority for the processing of personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.