On March 22, 2024, representatives of the National Center for Personal Data Protection (CNPDCP) organized a training course for the employees of the Agency for Intervention and Payments for Agriculture (AIPA), entitled: “General aspects of personal data protection”.

The aim of the course was to increase AIPA employees’ awareness of the principles of personal data protection, as well as to ensure the correct implementation of the legal provisions in the field, in their work.

During the event important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection;

– The rights of personal data subjects;

– Processing of special categories of personal data;

– Principles and legal grounds for processing personal data;

– The legal modalities of personal data processing in the activity carried out by AIPA;

– Requirements for the protection of personal data in the performance of duties;

– Ensuring the security and confidentiality of personal data processed;

– Issues relating to the appointment of the Data Protection Officer (DPO);

– Data Protection Impact Assessment (DPIA) issues, etc.

The training course proved to be an interactive one, and aspects related to access to information of public interest though the lens of personal data protection legislation, the correct procedure for accessing personal data through the State Information Systems, as well as keeping correct records of the audit of these accesses, were of great interest to the course participants.

About 40 AIPA representatives were trained during the event, moderated by experts in the field of personal data protection from the NCPDP.

On 26 March 2024, the National Centre for Personal Data Protection (NCPDP) organised a training course on personal data protection for representatives of the Ministry of Economic Development and Digitisation (MEDD), at their request.

The training course aimed to familiarize MEDD officials with the aspects of personal data protection in the public service, the regulation of processing procedures, as well as the personal data confidentiality and security regime in accordance with the legislation in force.

During the event important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• Principles and legal grounds for personal data processing;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Requirements for the protection of personal data in the exercise of official duties;

• Ensuring the security and confidentiality of personal data processed;

• Issues relating to the appointment of the Data Protection Officer (DPO);

• Data Protection Impact Assessment (DPIA) issues and the steps involved in conducting a DPIA, etc.

The training course proved to be an interactive one, participants asking multiple questions, based on their work, and receiving documented answers with practical examples from the trainers.

About 20 representatives of the Ministry of Economic Development and Digitisation were trained during the event, moderated by experts in the field of personal data protection from the NCPDP.

On 27 March 2024, the National Centre for Personal Data Protection (NCPDP) organised two training courses in the field of personal data protection for employees of the Western Regional Directorate of the General Inspectorate of Border Police (IGPF).

The aim of the training courses was to raise the awareness of the employees of the Western Regional Directorate of the IGPF on the principles of personal data protection, as well as on ensuring the correct application of the relevant legal provisions in their work.

During the events important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• Principles and legal grounds for  personal data processing;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Requirements for the protection of personal data in the exercise of official duties;

• Ensuring the security and confidentiality of personal data processed;

• Issues relating to the appointment of the Data Protection Officer (DPO);

• Data Protection Impact Assessment (DPIA) issues, etc.

The training courses proved to be interactive and useful, and the issues of the correct procedure for accessing personal data through state information systems, the legal aspects of  personal data processing through video surveillance systems, as well as what the consequences of non-compliant/illegal processing of personal data may be, were of great interest to the course participants.

Around 60 representatives of the Western Regional Directorate of the IGPF were trained during the events.

The training courses are part of the IGPF training plan for the year 2024, approved and signed by the heads of the NCPDP and IGPF on 21 February this year.

On 3 April 2024, the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the representatives of the Border Police Sector “Chisinau International Airport” of the General Inspectorate of Border Police (IGPF).

The aim of the training course was to increase the perception of the employees of the Border Police Section “Chisinau International Airport” of the IGPF on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the training course important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• Principles and legal grounds for processing personal data;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Requirements for the protection of personal data in the exercise of official duties;

• Ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be interactive and useful, with participants asking multiple questions, based on their work, and receiving documented answers with practical examples from the trainers. At the same time, the aspects of the correct procedure for accessing personal data through state information systems, the examination of requests for disclosure of personal data, as well as the legal aspects of personal data processing through video surveillance systems were of great interest to the course participants.

About 40 representatives of the Border Police Section “Chisinau International Airport” of the IGPF were trained during the event.

The training course is part of the IGPF training plan for 2024, approved and signed by the heads of the NCPDP and IGPF on February 21, 2024.

On April 4, 2024 the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the representatives of the territorial offices of State Chancellery, at their request.

The training course aimed at familiarizing the officials of the territorial offices of the State Chancellery with the aspects of personal data protection in the public service, the regulation of processing procedures, as well as the regime of confidentiality and security of personal data in accordance with the legislation in force.

During the event, important topics were discussed, such as: definition of general concepts related to the field of personal data protection; principles and legal grounds for personal data processing; rights of personal data subjects; processing of special categories of personal data; requirements for the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of personal data processed; issues related to the appointment of the Data Protection Officer (DPO), as well as his/her obligations and tasks, etc.

The training course proved to be interactive and the topics related to access to information of public interest in the light of personal data protection legislation, issues related to online registration and transmission of local council meetings, as well as the obligation to anonymise/de-identify excessive personal data when publishing legal acts, were of great interest to the course participants.

The event was moderated by experts in the field of personal data protection from the NCPDP and trained about 55 representatives of the territorial offices of the State Chancellery.

The National Centre for Personal Data Protection (NCPDP), for information purposes, communicates the fact that, following its investigation, the European Data Protection Supervisor (EDPS) has found that the European Commission (EC) has infringed several provisions of Regulation (EU) 2018/1725, the EU Data Protection Act for EU institutions, bodies, offices and agencies, including those on transfers of personal data outside the EU/European Economic Area (EEA), imposing corrective measures. At the same time, the EC failed to provide adequate safeguards to ensure that personal data transferred outside the EU/EEA benefit from an adequate level of protection equivalent to that guaranteed in the EU/EEA. In addition, in its contract with Microsoft, the EC did not sufficiently specify what types of personal data are to be collected and for what purposes when using Microsoft 365. The EC’s breaches as data controller also relate to data processing, including transfers of personal data, carried out on its behalf.

The EDPS has therefore decided to order the EC, since 9 December 2024, to suspend all data flows resulting from the use of Microsoft 365 to Microsoft and its affiliates and subcontractors located in non-EU/EEA countries that are not subject to a adequacy decision and to bring its processing operations resulting from its use of Microsoft 365 into compliance with Regulation (EU) 2018/1725. The EC must demonstrate compliance with both provisions by 9 December 2024.

The EDPS considers that the corrective measures it imposes are appropriate, necessary and proportionate, taking into account the seriousness and duration of the breaches found. Many of the breaches found relate to all processing operations carried out by or on behalf of the EC when using Microsoft 365 and impact on a large number of individuals. The EDPS also takes into account the need not to compromise the EC’s ability to perform its public interest tasks or to exercise its duties as an official authority vested in it, as well as the need to give it adequate time to implement the envisaged suspension of relevant data flows and to bring data processing into compliance with Regulation (EU) 2018/1725.

The NCCDP, as the national supervisory authority for personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On 15 March 2024, the National Centre for Personal Data Protection (NCPDP) organized a training course on personal data protection for the representatives of Riscani District Prosecutor’s Office, at their request.

The training course aimed at familiarizing the officials of Riscani District Prosecutor’s Office with the aspects of personal data protection in the public service, the regulation of processing procedures, as well as the confidentiality and security regime of personal data in accordance with the legislation in force.

During the event important topics were discussed, such as: 

Definition of general notions related to the field of personal data protection; 

Principles and legal grounds for processing personal data;

The rights of personal data subjects; 

Processing of special categories of personal data; 

Requirements for the protection of personal data in the exercise of official duties; 

Legal aspects of the processing of personal data by means of video surveillance systems; 

Ensuring the security and confidentiality of personal data processed;

Issues relating to the appointment of the Data Protection Officer (DPO); 

Data Protection Impact Assessment (DPIA) issues, etc.

The training course proved to be interactive and the topics related to the examination of requests for disclosure of personal data, as well as aspects related to the professional qualities that a DPO should possess and the position of DPO within the entity they represent, were of great interest to the course participants.

During the event, moderated by experts in the field of personal data protection from NCPDP, about 20 representatives of the Râșcani District Prosecutor’s Office were trained.

The National Centre for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine in the amount of EUR 24,000 imposed by the Polish Data Protection Authority (SA) on an insurance company for violation of Article 35 (Data Protection Impact Assessment) and 83 (General conditions for imposing administrative fines) of the GDPR.

The Polish SA has been informed that an unauthorised recipient has received a document confirming the granting of compensation in an email attachment. The e-mail from the insurance company contained personal data such as: name, surname, postal address, model and registration number of the car, policy number and the amount of compensation granted. The unauthorised recipient informed the insurance company that he had received an e-mail with an attachment containing another person’s personal data, but received no reply.

Following the investigations, the Polish SA decided to impose an administrative fine under Article 83(2)(a) of the GDPR, taking into account aggravating circumstances such as: the long duration of the breach, the intentional nature of the finding of a breach of data protection regulations in other ongoing proceedings against the company, the unsatisfactory level of cooperation with the Supervisory Authority.

At the same time, the Polish SA pointed out that the company is subject to specific obligations imposed by Article 35(1) of the Law of 11 September 2015 on insurance and reinsurance activities, according to which the insurance company and its employees, as well as persons and entities through which it carries out insurance operations, are obliged to keep the individual insurance contract secret. 

The NCPDP, as the national supervisory authority for personal data processing, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for personal data protection and to ensure that personal data processing operations comply with the legislation in force.

On 20 March 2024, the National Centre for Personal Data Protection (NCPDP) organised two training courses on personal data protection for employees of the Eastern Regional Directorate of the General Inspectorate of Border Police (IGPF).

The aim of the training courses was to increase the awareness of the employees of the Eastern Regional Directorate of the IGPF on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the trainings important topics were discussed, such as: 

Definition of general notions related to the field of personal data protection; 

Principles and legal grounds for personal data processing; 

The rights of personal data subjects; 

Processing of special categories of personal data; 

Requirements for the protection of personal data in the exercise of official duties; 

Ensuring the security and confidentiality of personal data processed; 

Issues relating to the appointment of the Data Protection Officer (DPO);

Data Protection Impact Assessment (DPIA) issues; 

Legal aspects of personal data processing through video surveillance systems, etc.

The training courses proved to be interactive and useful, and issues related to the examination of requests for disclosure of personal data, the correct procedure for accessing personal data through state information systems, as well as the correct procedure for identifying persons who do not have identity documents, were of great interest to the course participants.

About 60 representatives of the Eastern Regional Directorate of the IGPF were trained during the events.

The training courses are part of the IGPF training plan for 2024, approved and signed by the heads of the NCPDP and IGPF on 21 February this year.

From 11 to 13 March 2024, the representatives of the National Centre for Personal Data Protection (NCPDP) made the study visit “Processing of personal data through video surveillance systems”. The event was hosted by the Spanish Data Protection Authority (AEPD) – Agencia Española de Protección de Datos.

The purpose of the event was both to take up legal and operational best practices on the use of video surveillance means, and to provide employees of the NCPDP with the skills and resources necessary to effectively address issues related to the processing of personal data through video surveillance systems, in accordance with current legislation and in the interest of protecting the rights of data subjects.

During the study visit, moderated by experts in the field of personal data protection from the AEPD, topics of importance were analysed in depth, such as: the evolution of video-surveillance regulations, the latest legislative changes and regulations related to personal data processing through video-surveillance systems, with a focus on GDPR regulations; data subjects’ rights and ethics in video-surveillance; reception and classification of complaints; inspection procedures and instructions; technical and organisational measures to ensure the security of personal data; promotion of technologies applied to video-surveillance, etc.

The study visit was organised with the support of the EU TAIEX Project – Technical Assistance and Information Exchange Instrument, managed and funded by the Directorate-General for European Neighbourhood Policy and Enlargement Negotiations (DG NEAR) of the European Commission.