On 10 July this year, the National Centre for Personal Data Protection (NCPDP) continued the information and awareness-raising campaign for the school community, organizing the training course “Personal data protection and children’s safety in the online environment” for pupils from the Republican Centre for Children and Youth “Artico” in Chisinau. 

The aim of the information and awareness-raising campaign for the school community is to provide high visibility on personal data protection and children’s safety online at local and national level by promoting empowerment and best practices for intervention and support.

Topics covered in the training covered: 

Getting to grips with personal data (what it means, how we identify it, how we operate with it); 

Attitudes and practices when sending photos/videos online (the privacy of a social networking site, privacy settings, working with photos/videos in a chat room, attitudes and actions to take in case an image/video is taken without your consent and distributed later);

Risks and threats in the online environment (malware, spam, online harassment, online bullying, theft of information, situations that threaten a child’s privacy/security and solutions for such situations); Communication on social networks, etc.

At the same time, the trainers from the NCPDP carried out interactive activities, discussions were held on the basis of the information materials presented, video spots were shown and, at the end, students completed a crossword based on the material presented and participated in a question-answer round. All children were rewarded with prizes.

The event was organized in the context of the celebration of 16 years of NCPDP’s activity and 53 pupils were trained. At the same time, the information materials and the gifts given to the pupils were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on April 15, 2022. During this year alone, around 400 pupils have been trained. The NCPDP aims to continue this format of trainings for school communities both in schools in the Chisinau municipality and in the districts of the Republic of Moldova.

On July 10, 2024, the National Center for Personal Data Protection (the Center) organized the meeting of the Consultative Council of the National Center for Personal Data Protection, in the context of the celebration of the 16 years of activity of the institution.

The meeting was opened and chaired by Ms. Victoria MUNTEAN, Director of the NCPDP, and President of the Consultative Council.

During the event, important topics were discussed such as:

• Brief presentation of the results of the work for the period 2023;
• State of play regarding the harmonization of the national legal framework with the EU acquis in the field of personal data protection;
• Issues concerning access to personal data stored in state information resources, etc.

The Council meeting took place in an interactive manner, the members of the Council concluding that national legislative harmonization with the acquis communautaire is necessary both to maintain the upward trend of personal data protection and not to allow a regression of the field, and to ensure a genuine respect for the rights of personal data subjects, as well as a legally secure territory for personal data controllers. The Republic of Moldova must have balanced and clear rules, without deviating from the European regulatory framework in this area, a broad legislative framework for the protection of personal data, and all areas of activity, such as justice, medical, banking, social protection, economic, etc. interfere with the field of personal data protection. Similarly, the need to strengthen the institutional capacities of the NCPDP was also mentioned, in particular as a result of the increasing workload and the increasingly diversified specificity of personal data processing methods.

At the end, the members of the Consultative Council appreciated the efforts of the Center in terms of the results accumulated over the period of its activity and outlined the need to continue working together at the institutional level in order to develop effective mechanisms for the protection of personal data in the Republic of Moldova.

On July 10, the National Center for Personal Data Protection (NCPDP) celebrates 16 years of activity. During these 16 years, the institution has made considerable progress, contributing to the protection of citizens’ privacy and ensuring compliance with the legislation on the protection of personal data. 

The NCPDP, as an autonomous public authority, independent and impartial in relation to other public authorities, natural and legal persons, informs that its objective remains the same – the protection of the fundamental rights and freedoms of individuals, in particular the right to privacy in relation to the processing and transborder transmission of personal data.

In order to achieve the basic objective, the NCPDP continues and amplifies the actions to sensitize the society on the importance of personal data protection, both from the perspective of respect/knowledge of the data subjects’ rights and ensuring the exercise of the obligations of personal data controllers; contributes to raising the level of correct interpretation and consistent application of the legal provisions in the field of personal data protection by the actors involved in the processing of personal data, including by ensuring the balance between the legal provisions related to the rights of access to information, freedom of expression and personal data protection and sensitizes development partners in the realization of joint projects, in order to ensure the adequate level of personal data protection in the Republic of Moldova.

Therefore, during its 16 years of activity, the NCPDP has continued to monitor and verify the compliance of the processing of personal data by public and private sector operators by carrying out checks on the basis of complaints from personal data subjects and self-reports to the authority, following complaints received for examination, including from public authorities/institutions.

At the same time, more and more petitions from personal data subjects are coming to the NCPDP, and developments in recent years demonstrate this. The most frequent themes reflected in the complaints are:

• Processing personal data without the data subject’s consent and/or legal basis;

• Processing of personal data through video/audio surveillance systems;

• Processing personal data by disclosure on social media; 

• Realizing the rights of personal data subjects (access, information, intervention, objection), etc.

At the same time, the field of personal data protection continues to be promoted by strengthening international collaboration – a strategic aspect, being materialized through the active participation of representatives of the NCPDP at the plenary meetings of the European Data Protection Board (EDPB) and the Council of Europe. It is worth mentioning that the Republic of Moldova has been an observer member of the EDPB since 2017, and the acceptance of the Republic of Moldova as a member with observer status is a premiere and a major achievement in the Eastern space, being an important step towards the recognition of the Republic of Moldova as a third state ensuring an equivalent level of personal data protection to that of the EU.

In the same way, during the 16 years of our activity, 19 cooperation agreements were concluded at national level (National Social Insurance House, General Inspectorate of Border Police, General Inspectorate of Police, National Institute of Justice, Union of Lawyers of the Republic of Moldova, ULIM, Department of Penitentiary Institutions, Academy of Public Administration, National Association of Information Technology and Communications Companies, etc. ) and 10 at international level (bilateral Cooperation Agreements with the Data Protection Authorities of Romania, Ukraine, Italy, Hungary, Georgia, Latvia, Malta, Poland, Italy, Latvia, Malta and Romania), which allows us to have a faster and more efficient collaboration with our partners.

The NCPDP, as a personal data protection authority, will continue its mission to ensure a fair balance between the right to protection of personal data and the rights guaranteed by the Constitution of the Republic of Moldova, and will strive to achieve further progress in promoting and strengthening the field of personal data protection.

On July 10, the National Center for Personal Data Protection (NCPDP) celebrates 16 years of activity. It is 16 years since NCPDP obtained the status of autonomous public authority, independent from other public authorities, natural and legal persons, the objective of which is – the protection of fundamental rights and freedoms of natural persons, in particular the right to privacy in relation to the processing and transborder transmission of personal data.

On the occasion of this day, the institution organizes specific activities to raise awareness and promote best practices in privacy and data protection. These activities include street actions addressed to the general public to inform and sensitize them to the field of personal data protection.

In this context, on July 9, several employees of the NCPDP distributed to passers-by, in front of the Triumphal Arch in mun. Chisinau, information materials, informing them about the concept of personal data, the rights of data subjects, data security and confidentiality measures, as well as about the principles of personal data protection. At the same time, citizens were informed about possible situations of non-compliant processing of personal data and were given practical guidance and recommendations that should be taken in such cases.

In the current year, the NCPDP aims to organize several information and awareness-raising activities for the general public in order to educate, motivate and encourage Moldovan citizens to pay more attention to the protection of personal data concerning them.

Recognizing the need to inform, promote and ensure the protection of the rights of individuals with regard to the processing of personal data, as well as the need for joint efforts to implement these values, on July 8, 2024, the National Center for Personal Data Protection (NCPDP), represented by the Director Victoria MUNTEAN and the National Social Insurance House (NSIH), represented by the Director General Elena ȚÎBÎRRNĂ, signed the Training Plan in the field of personal data protection for employees of the structural subdivisions of NSIH.

The primary goal established by the Training Plan mentioned above is to increase the awareness of the employees within the NSIH structural subdivisions on the principles of personal data protection and on ensuring the correct implementation/application of the legal provisions in the field of data protection in their daily work. The training plan has been developed and approved by mutual agreement and provides for hybrid (offline/online) training in the NSIH structural subdivisions.

At the same time, we mention that strengthening inter-institutional collaboration at the national level in order to increase the awareness of the society on the importance of personal data protection, as well as raising the level of correct interpretation and application of the legal provisions in the field of personal data protection by the actors involved in the processing of personal data, remains one of the priorities of the NCPDP, and, only during 2024, collaboration agreements were concluded with two other state institutions, such as the General Inspectorate of Police, General Inspectorate of Border Police.

The training plan mentioned above is also part of the activities planned to be organized in the context of the celebration of the 16 years of activity of NCPDP.

On June 28, 2024, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the “South” Patrol Directorate of the National Public Security Inspectorate (INSP).

The aim of the training course was to increase the awareness of the employees of the “South” Patrol Directorate of INSP on the principles of personal data protection and on ensuring the correct application of the legal provisions in the field in the work they perform.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the legal way of processing personal data in the activity carried out by police bodies; the requirements for the protection of personal data in the exercise of their duties; the obligations of the police body as data controller in relation to the data subject; ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be very useful and interactive. The trainers from the NCPDP provided practical answers to the many questions asked by the participants. At the same time, the issues related to the correct procedure for accessing personal data through the State Information Systems, the correct audit trail of such accesses, as well as the examination of requests for disclosure of personal data, were of great interest to the participants.

About 60 representatives of the INSP “South” Patrol Directorate were trained during the event.

The training course is part of the training plan of the GIP subdivisions for 2024, approved and signed by the heads of the NCPDP and the GIP on January 26 , 2024.

On 27 June 2024, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the employees of the Land Registration and Propriety Valuation Project (LRPVP), at their request.

The aim of the training course was to increase the awareness of LRPVP employees on the principles of personal data protection, as well as to familiarize them with the confidentiality and security of personal data in accordance with the provisions of the legislation in force.

During the event were discussed topics of importance such as:

Definition of general concepts related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal grounds for processing personal data;

Requirements for the protection of personal data in the exercise of official duties;

Ensuring the security and confidentiality of personal data, etc.

The training course was a useful one, the participants asked the trainers about the legal way of processing personal data in the daily work of the LRPVP employees, as well as the correctness of publishing information containing personal data, including employee’s data.

All LRPVP representatives were trained during the event

On June 26, 2024, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for the representatives of the State Tax Service (SFS) from the region in the field of personal data protection, at their request.

The purpose of the training session was to familiarize tax officials with aspects related to the protection of personal data in the public service, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event the following topics of importance were discussed:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal grounds for processing personal data;

Data Protection Officer (DPO) designation issues and the duties and tasks of a DPO;

Data Protection Impact Assessment issues;

Ensuring security and confidentiality of personal data by SFS employees;

Requirements for the protection of personal data in the performance of their duties;

Reviewing requests for disclosure of personal data, etc.

The training course was an interactive one, participants asking the trainers multiple questions on issues related to access to information of public interest from the point of view of the personal data protection legislation, as well as the legality of storing, keeping and disclosing personal data.

About 300 tax officials attended the event, which was organized in an online format.

On June 21, 2024, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for employees of the State Tax Service (SFS) in the field of personal data protection, at their request.

The purpose of the training was to familiarize tax officials with aspects related to the protection of personal data in the public service, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event were discussed such topics as:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal bases for the processing of personal data;

Data Protection Officer (DPO) designation issues;

Duties and tasks of a DPO;

Data Protection Impact Assessment (DPIA) issues;

Requirements for personal data protection in carrying out official duties, etc.

The training course was an interactive one, participants asking multiple questions on the legality of storing, keeping and disclosing personal data, examining requests for disclosure of personal data, as well as ensuring the security and confidentiality of such data.

The event was attended by about 20 representatives from the SFS

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 856 000 euro imposed by the Finnish Data Protection Authority (SA) on Verkkokauppa.com for breach of Article 5 Principles relating to the processing of personal data and 25 Ensuring data protection from the time of conception and by default of the GDPR.

The Finnish SA investigated the activities of online retailer Verkkokauppa.com following a complaint from a customer. The controller had asked the customer to register as a customer before shopping online. Shopping in the online shop was not possible without creating a customer account.

The investigations found that the controller did not specify the storage period of the data collected for the customer accounts in its online shop and that they were stored indefinitely. Furthermore, the controller’s practice of requiring the creation of a customer account in order to make online purchases violated data protection legislation. The creation of a customer account or the storage of personal data resulting from such creation may not be a mandatory requirement to make individual purchases online.

In this context, the Finnish SA has imposed an administrative fine of € 856 000 on the controller for failing to define the storage period for personal data relating to customer accounts. The controller was required to specify an appropriate storage period for customer account data and to rectify its mandatory registration practice. Verkkokauppa.com was also reprimanded for practices in breach of data protection legislation.

The NCPDP as the national supervisory authority for the processing of personal data emphasizes the responsibility of data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the applicable legislation.