On July 10, the National Center for Personal Data Protection (NCPDP) celebrates 16 years of activity. During these 16 years, the institution has made considerable progress, contributing to the protection of citizens’ privacy and ensuring compliance with the legislation on the protection of personal data. 

The NCPDP, as an autonomous public authority, independent and impartial in relation to other public authorities, natural and legal persons, informs that its objective remains the same – the protection of the fundamental rights and freedoms of individuals, in particular the right to privacy in relation to the processing and transborder transmission of personal data.

In order to achieve the basic objective, the NCPDP continues and amplifies the actions to sensitize the society on the importance of personal data protection, both from the perspective of respect/knowledge of the data subjects’ rights and ensuring the exercise of the obligations of personal data controllers; contributes to raising the level of correct interpretation and consistent application of the legal provisions in the field of personal data protection by the actors involved in the processing of personal data, including by ensuring the balance between the legal provisions related to the rights of access to information, freedom of expression and personal data protection and sensitizes development partners in the realization of joint projects, in order to ensure the adequate level of personal data protection in the Republic of Moldova.

Therefore, during its 16 years of activity, the NCPDP has continued to monitor and verify the compliance of the processing of personal data by public and private sector operators by carrying out checks on the basis of complaints from personal data subjects and self-reports to the authority, following complaints received for examination, including from public authorities/institutions.

At the same time, more and more petitions from personal data subjects are coming to the NCPDP, and developments in recent years demonstrate this. The most frequent themes reflected in the complaints are:

• Processing personal data without the data subject’s consent and/or legal basis;

• Processing of personal data through video/audio surveillance systems;

• Processing personal data by disclosure on social media; 

• Realizing the rights of personal data subjects (access, information, intervention, objection), etc.

At the same time, the field of personal data protection continues to be promoted by strengthening international collaboration – a strategic aspect, being materialized through the active participation of representatives of the NCPDP at the plenary meetings of the European Data Protection Board (EDPB) and the Council of Europe. It is worth mentioning that the Republic of Moldova has been an observer member of the EDPB since 2017, and the acceptance of the Republic of Moldova as a member with observer status is a premiere and a major achievement in the Eastern space, being an important step towards the recognition of the Republic of Moldova as a third state ensuring an equivalent level of personal data protection to that of the EU.

In the same way, during the 16 years of our activity, 19 cooperation agreements were concluded at national level (National Social Insurance House, General Inspectorate of Border Police, General Inspectorate of Police, National Institute of Justice, Union of Lawyers of the Republic of Moldova, ULIM, Department of Penitentiary Institutions, Academy of Public Administration, National Association of Information Technology and Communications Companies, etc. ) and 10 at international level (bilateral Cooperation Agreements with the Data Protection Authorities of Romania, Ukraine, Italy, Hungary, Georgia, Latvia, Malta, Poland, Italy, Latvia, Malta and Romania), which allows us to have a faster and more efficient collaboration with our partners.

The NCPDP, as a personal data protection authority, will continue its mission to ensure a fair balance between the right to protection of personal data and the rights guaranteed by the Constitution of the Republic of Moldova, and will strive to achieve further progress in promoting and strengthening the field of personal data protection.

On July 10, the National Center for Personal Data Protection (NCPDP) celebrates 16 years of activity. It is 16 years since NCPDP obtained the status of autonomous public authority, independent from other public authorities, natural and legal persons, the objective of which is – the protection of fundamental rights and freedoms of natural persons, in particular the right to privacy in relation to the processing and transborder transmission of personal data.

On the occasion of this day, the institution organizes specific activities to raise awareness and promote best practices in privacy and data protection. These activities include street actions addressed to the general public to inform and sensitize them to the field of personal data protection.

In this context, on July 9, several employees of the NCPDP distributed to passers-by, in front of the Triumphal Arch in mun. Chisinau, information materials, informing them about the concept of personal data, the rights of data subjects, data security and confidentiality measures, as well as about the principles of personal data protection. At the same time, citizens were informed about possible situations of non-compliant processing of personal data and were given practical guidance and recommendations that should be taken in such cases.

In the current year, the NCPDP aims to organize several information and awareness-raising activities for the general public in order to educate, motivate and encourage Moldovan citizens to pay more attention to the protection of personal data concerning them.

Recognizing the need to inform, promote and ensure the protection of the rights of individuals with regard to the processing of personal data, as well as the need for joint efforts to implement these values, on July 8, 2024, the National Center for Personal Data Protection (NCPDP), represented by the Director Victoria MUNTEAN and the National Social Insurance House (NSIH), represented by the Director General Elena ȚÎBÎRRNĂ, signed the Training Plan in the field of personal data protection for employees of the structural subdivisions of NSIH.

The primary goal established by the Training Plan mentioned above is to increase the awareness of the employees within the NSIH structural subdivisions on the principles of personal data protection and on ensuring the correct implementation/application of the legal provisions in the field of data protection in their daily work. The training plan has been developed and approved by mutual agreement and provides for hybrid (offline/online) training in the NSIH structural subdivisions.

At the same time, we mention that strengthening inter-institutional collaboration at the national level in order to increase the awareness of the society on the importance of personal data protection, as well as raising the level of correct interpretation and application of the legal provisions in the field of personal data protection by the actors involved in the processing of personal data, remains one of the priorities of the NCPDP, and, only during 2024, collaboration agreements were concluded with two other state institutions, such as the General Inspectorate of Police, General Inspectorate of Border Police.

The training plan mentioned above is also part of the activities planned to be organized in the context of the celebration of the 16 years of activity of NCPDP.

On June 28, 2024, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the “South” Patrol Directorate of the National Public Security Inspectorate (INSP).

The aim of the training course was to increase the awareness of the employees of the “South” Patrol Directorate of INSP on the principles of personal data protection and on ensuring the correct application of the legal provisions in the field in the work they perform.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the legal way of processing personal data in the activity carried out by police bodies; the requirements for the protection of personal data in the exercise of their duties; the obligations of the police body as data controller in relation to the data subject; ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be very useful and interactive. The trainers from the NCPDP provided practical answers to the many questions asked by the participants. At the same time, the issues related to the correct procedure for accessing personal data through the State Information Systems, the correct audit trail of such accesses, as well as the examination of requests for disclosure of personal data, were of great interest to the participants.

About 60 representatives of the INSP “South” Patrol Directorate were trained during the event.

The training course is part of the training plan of the GIP subdivisions for 2024, approved and signed by the heads of the NCPDP and the GIP on January 26 , 2024.

On 27 June 2024, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the employees of the Land Registration and Propriety Valuation Project (LRPVP), at their request.

The aim of the training course was to increase the awareness of LRPVP employees on the principles of personal data protection, as well as to familiarize them with the confidentiality and security of personal data in accordance with the provisions of the legislation in force.

During the event were discussed topics of importance such as:

Definition of general concepts related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal grounds for processing personal data;

Requirements for the protection of personal data in the exercise of official duties;

Ensuring the security and confidentiality of personal data, etc.

The training course was a useful one, the participants asked the trainers about the legal way of processing personal data in the daily work of the LRPVP employees, as well as the correctness of publishing information containing personal data, including employee’s data.

All LRPVP representatives were trained during the event

On June 26, 2024, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for the representatives of the State Tax Service (SFS) from the region in the field of personal data protection, at their request.

The purpose of the training session was to familiarize tax officials with aspects related to the protection of personal data in the public service, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event the following topics of importance were discussed:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal grounds for processing personal data;

Data Protection Officer (DPO) designation issues and the duties and tasks of a DPO;

Data Protection Impact Assessment issues;

Ensuring security and confidentiality of personal data by SFS employees;

Requirements for the protection of personal data in the performance of their duties;

Reviewing requests for disclosure of personal data, etc.

The training course was an interactive one, participants asking the trainers multiple questions on issues related to access to information of public interest from the point of view of the personal data protection legislation, as well as the legality of storing, keeping and disclosing personal data.

About 300 tax officials attended the event, which was organized in an online format.

On June 21, 2024, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for employees of the State Tax Service (SFS) in the field of personal data protection, at their request.

The purpose of the training was to familiarize tax officials with aspects related to the protection of personal data in the public service, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event were discussed such topics as:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal bases for the processing of personal data;

Data Protection Officer (DPO) designation issues;

Duties and tasks of a DPO;

Data Protection Impact Assessment (DPIA) issues;

Requirements for personal data protection in carrying out official duties, etc.

The training course was an interactive one, participants asking multiple questions on the legality of storing, keeping and disclosing personal data, examining requests for disclosure of personal data, as well as ensuring the security and confidentiality of such data.

The event was attended by about 20 representatives from the SFS

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 856 000 euro imposed by the Finnish Data Protection Authority (SA) on Verkkokauppa.com for breach of Article 5 Principles relating to the processing of personal data and 25 Ensuring data protection from the time of conception and by default of the GDPR.

The Finnish SA investigated the activities of online retailer Verkkokauppa.com following a complaint from a customer. The controller had asked the customer to register as a customer before shopping online. Shopping in the online shop was not possible without creating a customer account.

The investigations found that the controller did not specify the storage period of the data collected for the customer accounts in its online shop and that they were stored indefinitely. Furthermore, the controller’s practice of requiring the creation of a customer account in order to make online purchases violated data protection legislation. The creation of a customer account or the storage of personal data resulting from such creation may not be a mandatory requirement to make individual purchases online.

In this context, the Finnish SA has imposed an administrative fine of € 856 000 on the controller for failing to define the storage period for personal data relating to customer accounts. The controller was required to specify an appropriate storage period for customer account data and to rectify its mandatory registration practice. Verkkokauppa.com was also reprimanded for practices in breach of data protection legislation.

The NCPDP as the national supervisory authority for the processing of personal data emphasizes the responsibility of data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the applicable legislation.

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine imposed by the Hellenic Data Protection Authority (DPA) on HELLENIC POST SERVICES SA for violation of Article 5 Principles related to the processing of personal data and Article 32 Security of processing of GDPR.

“HELLENIC POST SERVICES S.A.” (ELTA S.A.) has reported two personal data breach incidents to the Hellenic SA in compliance with the GDPR. The first incident involved a data encryption breach for the purpose of a ransom request in the company’s system as a result of a malware attack from third parties, while the second incident involved the leak of personal data, which was subsequently published on the Dark Web.

Following investigations, the Hellenic SA found that the controller did not comply with the necessary technical and organizational measures and did not ensure the implementation of the security policy for the processing of personal data. This failure resulted in breaches in the controller’s system, including vulnerability scanning, unauthorized access to system resources, execution of malicious processes, disabling security software and file encryption.

In this context, the Hellenic SA imposed on ELTA S.A. an administrative fine amounting to 1% of the last available annual turnover based on assessment criteria in accordance with EDPB Guidelines 4/2022 on the calculation of administrative fines, namely: the large number of persons affected, the amount of damage, the nature of the breach, the non-compliance with the security policy and the categories of data affected. Mitigating factors were also taken into account, such as: the reinforcement of system security measures after the incident, the fact that the investigation of the incident was entrusted to a specialized company and ELTA S.A. followed its instructions, the data recovery and the unfavorable financial situation of the company.

The NCPDP, as the national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and enforcement, communicates about the administrative fine in the amount of 13.9 million euro imposed by the Czech Data Protection Authority (SA) on a company registered in the Czech Republic for violation of Article 6 Lawfulness of processing and Article 13 Information to be provided where personal data is collected from the data subject of the GDPR.

The case concerns the transfer by controller of personal data collected by it from users of its anti-virus software to an affiliated company. The proceedings were initiated on the basis of media reports and an anonymous file.

Following the investigation, the Czech SA found that the controller transferred personal data of users of anti-virus software and browser extensions to the affiliated company without having a legal basis for such processing. The transferred data related to approximately 100 million users and included in particular the pseudonymized web browsing history of the users linked to a unique identifier. In addition, the Czech SA found that the controller misinformed its users (data subjects) about these data transfers, as it claimed that the transferred data were anonymized and used exclusively for statistical sales analysis. At the same time, the Czech Data Protection Authority concluded that Internet browsing history, even if not complete, may constitute personal data, as re-identification of at least some of the data subjects could occur. The controller’s breach is all the more serious as it is one of the leading experts in the field of cybersecurity, providing the public with data protection and privacy tools.

An administrative fine of €13.9 million (CZK 351 million) was imposed on the data controller. The decision is final and enforceable.

The NCPDP as the national supervisory authority for the processing of personal data, emphasizes the responsibility of data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the applicable legislation.