The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 1 300 000 euro imposed by the Swedish Data Protection Authority (SA) on Avanza Bank AB for breach of Article 5 Principles relating to processing of personal data, Article 32 Security of processing and Article 83 General conditions for imposing administrative fines of the GDPR.

A Swedish bank has reported a personal data breach to the Swedish SA. The notification states that the bank has used the Facebook pixel (now the Meta Pixel) on its website and in its app to optimize the bank’s marketing on Facebook. An incorrect setting of the Meta Pixel meant that personal data was transferred to Meta over a longer period of time. The bank’s notification states that during November 15, 2019 and to June 2, 2021, personal data of up to one million customers was wrongly transferred to Meta.

When the bank became aware of the incident, the Meta pixel was deactivated and the personal data collected through the pixel was deleted by Meta. The bank also revised its internal procedures to ensure correct and secure processing of personal data.

Avanza Bank AB has violated the legal provisions stipulated in the GDPR by failing to implement appropriate technical and organizational measures to ensure an adequate level of security for the personal data of website visitors and app users.

In this context the Swedish SA has imposed an administrative fine of approx. 1 300 000 euro on Avanza Bank AB.

As the national supervisory authority for the processing of personal data, the NCPDP emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

From 9 to 13 September, representatives of the National Center for Personal Data Protection (NCPDP) participated in the Data Protection Academy of the Western Balkans and Eastern Partnership Region, which took place in Brussels, Belgium.

The Data Protection Academy is a project set up by the European Commission (DG JUST) to provide support and training for Data Protection Authorities (DPAs) from  Non -EU countries, giving them a platform to exchange views, best practices and lessons learned with their counterparts in the EU.

The aim of the event was to present the experience of the relevant EU institutions and bodies in implementing the GDPR, providing a comprehensive and practical overview of the challenges encountered in the GDPR implementation process.

In the framework of Data Protection Academy for the Western Balkans and Eastern Partnership Region, topics of importance were addressed, such as:

• Key data protection issues as of September 2023, with focus on legislation, implementation and international cooperation;

• Principles of public administration, with a focus on service delivery and the digital sphere, the role of privacy and personal data protection;

• The role of an Independent Data Protection Authority in the data protection ecosystem;

• The role of Data Protection Officers;

• Data protection in the era of digitization of services and artificial intelligence;

• Balancing data protection legal requirements and freedom of information legislation;

• Data protection in the context of cooperation agreements with EUROPOL and Eurojust;

• EU Digital Regulation: interaction between GDPR and new European data regulations (DSA, DMA, DGA, Data Act);

• International transfers and regulation of global data flows, etc.

The event, organized by the European Commission in cooperation with the SIGMA program, the Eastern Partnership Regional Fund for Public Administration Reforms of GIZ, the Regional Cooperation Council and the Regional School of Public Administration, brought together representatives of Data Protection Authorities from 10 countries such as: Albania, Armenia, Bosnia and Herzegovina, Georgia, Kosovo, Georgia, Kosovo, Moldova, Montenegro, North Macedonia, Serbia and Ukraine.

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, informs about the administrative fine in the amount of 2 385 276 euro imposed by the Lithuanian Data Protection Authority (SA) on the controller of the online platform  Vinted, UAB for trading and exchange of second-hand clothes. The controller breached Article 5 – Principles relating to the processing of personal data, Article 6 – Lawfulness of processing, Article 12 – Transparency of information, communication and arrangements for exercising the data subject’s rights and Article 83 – General conditions for imposing administrative fines, of the GDPR.

Lithuanian SA initiated an investigation following complaints from applicants (users of the Vinted platform) submitted by French SA and Polish SA in 2021 and 2022, respectively, alleging that the company did not properly implement their requests regarding the right to erasure (“right to be forgotten”) and the right of access.

Upon investigation, the Lithuanian SA found that the company in its responses to the requests for erasure of personal data stated that it would not act on a specific request because the applicant in question did not identify a specific ground under Article 17(1) of the GDPR and did not identify all the purposes for which the applicants’ specific personal data would continue to be processed after the request was submitted.

At the same time, in order to ensure the security of the platform and its users, the company unlawfully applied “shadow blocking” (the processing of personal data with the intention that a person who is alleged to be in breach of the Vinted Platform Operating Principles would leave the platform without being aware of this processing of their personal data) in respect of some of the applicants in breach of the principles of fairness and transparency, and the improper implementation of these principles adversely affected the ability of platform users to exercise their other rights and seek redress under the GDPR.

In addition, the company did not ensure sufficient technical and organizational measures to implement the principle of accountability and to be able to demonstrate that it has taken (or reasonably refused to take) measures with respect to the right of access.

In this context, the Lithuanian SA decided to impose an administrative fine in the amount of EUR 2 385 276 on Vinted, UAB. When deciding on the amount of the fine, the Lithuanian SA relied on the European Data Protection Board’s Guidelines 04/2022 of May 24, 2023 on the calculation of administrative fines under the GDPR and took into account the cross-border scope of the processing carried out by the company, the fact that the breaches affected a large number of data subjects and lasted for a long period of time. 

As the national supervisory authority for the processing of personal data, the NCPDP emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the applicable legislation.

On August 29, 2024, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Police Inspectorate (PI) of the Riscani District of the Police Directorate of the Chisinau municipality.

The aim of the training course was to increase the PI employees’ awareness on the principles of personal data protection, as well as to ensure the correct application of the legal provisions in the field in the activity they perform.

The event discussed topics of importance such as:

Definition of general concepts related to the field of personal data protection;

Rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal grounds for processing personal data;

The lawful way of processing personal data in the work of law enforcement bodies;

Requirements for the protection of personal data in the performance of police duties;

Ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be very useful and interactive. The trainers from the NCPDP provided practical answers to the many questions asked by the participants. At the same time, the issues related to the disclosure of information containing personal data, the analysis carried out by the data controller in terms of access to these data, the correct procedure for accessing personal data through the State Information Systems and the correct auditing of these accesses, as well as the term of retention/storage and use of personal data at the end of the processing operations, were of great interest to the participants.

During the event were trained about 75 representatives of the Police Inspectorate of the Riscani District.

The training course is part of the training plan 2024 for the GPI subdivisions, approved and signed by the heads of the NCPDP and the GPI on January 26.

On 08 August 2024, the National Center for Personal Data Protection organized two training courses in the field of personal data protection for the representatives of the central office of the National Social Insurance House (CNAS), at their request.

The aim of the training course was to increase the CNAS employees’ awareness on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

The event discussed topics of importance such as:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal bases for the processing of personal data;

Data Protection Officer (DPO) designation issues;

Data Protection Impact Assessment issues;

Ensuring security and confidentiality of personal data by CNAS employees, etc.

The training course was an interactive one. The participants asked the trainers multiple questions regarding the processing of personal data in the daily work carried out by the CNAS representatives, the legality of requests for disclosure of personal data to third parties, the correct procedure for accessing personal data through the State Information Systems, as well as the conditions for restricting access to personal data and the unrestricted conditions for providing them.

During the events, which took place both in person and online, about 250 representatives of both the central office of CNAS and the territory offices were trained.

The training courses are part of the training plan within the CNAS structural subdivisions for the year 2024, approved and signed by the heads of NCPDP and CNAS on July 8.

On 9 August 2024, the National Center for Personal Data Protection organized two training courses in the field of personal data protection for the representatives of the Territorial Social Insurance House (CTAS), at the request of the National Social Insurance House.

The purpose of the training course was to increase the CTAS employees’ awareness of the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; principles and legal grounds for processing personal data; the requirements for the protection of personal data in the exercise of their duties; ensuring the security and confidentiality of personal data by CTAS employees; issues related to the appointment of the Data Protection Officer; issues related to the Data Protection Impact Assessment, etc.

The training course proved to be interactive, and the topics related to the disclosure of information containing personal data, as well as the analysis carried out by the data controller (CNAS), in terms of access to these data, the term of storage and use of personal data at the end of processing operations, as well as ensuring technical and organizational measures in accordance with the provisions of the legislation in the field, were of great interest to the participants.

About 165 CTAS representatives from Chisinau, Anenii Noi, Ialoveni, Causeni, Hâncesti and Stefan Voda municipalities were trained during the events, which took place both in person and online.

The training courses are part of the training plan within the CNAS structural subdivisions for the year 2024, approved and signed by the heads of NCPDP and CNAS on July 08.

On August 13, 2024, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the employees of the Center for Strategic Communication and Combating Disinformation (the Center), at their request.

The aim of the training course was to increase the awareness of the Center’s employees on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection:;

– The rights of personal data subjects;

– Processing of special categories of personal data;

– Principles and legal grounds for processing personal data;

– Requirements for the protection of personal data in the exercise of official duties;

– Ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be an interactive one. Participants asked multiple questions, based on the work they do, to which they received documented answers with practical examples from the trainers.

Employees of the Center for Strategic Communication and Combating Disinformation were trained during the event.

On August 14, 2024, representatives of the National Center for Personal Data Protection, organized a training course in the field of personal data protection for representatives of the Buiucani Police Inspectorate (PI).

The aim of the course was to increase the level of awareness of Buiucani PI employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field of work they perform.

During the event have been discussed topics of importance such as:

• Definition of general concepts related to the field of personal data protection;
• Rights of personal data subjects;
• Processing of special categories of personal data;
• Principles and legal grounds for processing personal data;
• The lawful way of processing personal data in the activity carried out by the representatives of Buiucani PI;
• Obligations of Buiucani PI in relation to the data subject;
• Ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be an interactive one, and the topics related to the correct procedure for accessing personal data through the State Information Systems, the records kept by Buiucani PI, the procedure for granting access to these data to third parties, as well as the term of storage and use of personal data at the end of the processing operations, were of great interest to the representatives at the course.

About 60 representatives of the Buiucani Police Inspectorate were trained during the event.

The training course is part of the training plan within the GPI subdivisions for the year 2024, approved and signed by the heads of the NCPDP and the GPI on January 26 this year.

On August 21, 2024, representatives of the National Center for Personal Data Protection organized a training course in the field of personal data protection for representatives of the Botanica Police Inspectorate (PI).

        The purpose of the course was to increase the awareness of Botanica PI employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they perform.

Within the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the legal manner of processing personal data in the activity carried out by the representatives of IP Botanica; ensuring the security and confidentiality of personal data processed, etc.

The training course turned out to be an interactive one, and the topics related to the correct procedure of accessing personal data through the State Information Systems for the purpose of identification of persons who do not have identity documents, the examination of requests for disclosure of personal data, as well as the legal aspects of processing personal data through video surveillance systems, were of great interest to the representatives attending the course.

About 60 representatives of Botanica Police Inspectorate were trained during the event. 

The training course is part of the 2024 training plan in the subdivisions of the GIP for 2024, approved and signed by the heads of the NCPDP and the GPI on January 26 this year.

On 10 July this year, the National Centre for Personal Data Protection (NCPDP) continued the information and awareness-raising campaign for the school community, organizing the training course “Personal data protection and children’s safety in the online environment” for pupils from the Republican Centre for Children and Youth “Artico” in Chisinau. 

The aim of the information and awareness-raising campaign for the school community is to provide high visibility on personal data protection and children’s safety online at local and national level by promoting empowerment and best practices for intervention and support.

Topics covered in the training covered: 

Getting to grips with personal data (what it means, how we identify it, how we operate with it); 

Attitudes and practices when sending photos/videos online (the privacy of a social networking site, privacy settings, working with photos/videos in a chat room, attitudes and actions to take in case an image/video is taken without your consent and distributed later);

Risks and threats in the online environment (malware, spam, online harassment, online bullying, theft of information, situations that threaten a child’s privacy/security and solutions for such situations); Communication on social networks, etc.

At the same time, the trainers from the NCPDP carried out interactive activities, discussions were held on the basis of the information materials presented, video spots were shown and, at the end, students completed a crossword based on the material presented and participated in a question-answer round. All children were rewarded with prizes.

The event was organized in the context of the celebration of 16 years of NCPDP’s activity and 53 pupils were trained. At the same time, the information materials and the gifts given to the pupils were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on April 15, 2022. During this year alone, around 400 pupils have been trained. The NCPDP aims to continue this format of trainings for school communities both in schools in the Chisinau municipality and in the districts of the Republic of Moldova.