On 11 July 2023, the representatives of the National Centre for Personal Data Protection organized a training course for employees of the Ialoveni Police Inspectorate of the GPI.

The aim of the course was to increase the perception of the employees of the Ialoveni Police Inspectorate on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event, important topics have been discussed, such as: definition of general notions related to the field of personal data protection; rights of personal data subjects; processing of special categories of personal data; principles and legal grounds for the processing of personal data; legal manner of processing personal data in the activity carried out by the representatives of the Ialoveni Police Inspectorate of the GPI; obligations of the Ialoveni Police Inspectorate of the GPI as data controller in relation to the data subject; ensuring the security and confidentiality of personal data processed, etc.

The training course was moderated by the representatives of the Prevention, Surveillance and Evidence Directorate and proved to be very useful and interactive. The NCPDP’s trainers provided the participants with practical answers to their many questions. At the same time, the aspects related to the correct procedure for accessing and disclosing information containing personal data, the analysis carried out by the Ialoveni Police Inspectorate of the GPI regarding access to such data, as well as the requirements for the protection of personal data in the exercise of their duties, were of great interest to the participants.

More than 40 representatives of the Ialoveni Police Inspectorate of the GPI were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

Today, the 10th of July, the National Centre for Personal Data Protection (NCPDP) in collaboration with TAIEX Project experts is organising the workshop “Data Protection Impact Assessment and the Role of the Data Protection Officer”.

The aim of the workshop is the takeover of legal and operational best practices by the representatives of public institutions on Data Protection Impact Assessment (DPIA) mechanisms, processing operations requiring a DPIA, and the role of the Data Protection Officer (DPO) within public sector personal data controllers.

The event was opened by NCPDP’s Director Victoria Muntean: “Current aspirations to digitise society, as well as the rapid technological developments widely used by both EU countries and the rest of the world, underline the pressing need for strong protection of personal data – a right guaranteed by both European Union and Council of Europe instruments. The collection, storage and use of personal data at an unprecedented level expose the data subjects whose data are processed to certain risks. These risks range from identity theft or inadvertent disclosure of personal data to the use of personal data for unknown purposes. A Data Protection Impact Assessment, in this case, is more than necessary, as it describes a process designed to identify the risks arising from the personal data processing, to minimise these risks and to detect them as early as possible.”

The conference is moderated by data protection experts from Italy and Malta. Amongst the topics addressed by the experts are: assessment of the necessity and proportionality of processing operations subject to the requirement to carry out a data protection impact assessment; scenarios for personal data protection impact assessment; practical mechanisms for carrying out prior consultations if the data protection impact assessment indicates that the processing would generate an increased risk and that this risk cannot be mitigated by reasonable means in terms of available technologies and implementation costs by DPA employees; the means given to the DPO to carry out his/her tasks; examples of best practices to assist state institutions/organisations in appointing and supporting the DPO in order to avoid possible conflicts of interest; etc.

Around 60 representatives of the public sector are participating in the event.

The workshop is organised and funded by the European Commission’s Technical Assistance and Information Exchange Instrument (TAIEX).

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 150 000 euros applied by the French Supervisory Authority (CNIL) to KG COM for the failure to comply with its obligations stipulated in GDPR and French Data Protection Act.

KG COM operates several websites to offer its customers clairvoyance readings by chat or phone. Following the publication of a press article in 2020 revealing the existence of a personal data breach involving the company, the CNIL carried out three investigations into KG COM.

Following the investigations, CNIL found several violations, such as:

• Failure to minimise the personal data collected and used (Article 5.1.c GDPR)
• Failure to have a legal basis for the use of banking data (Article 6 GDPR)
• Failure to obtain prior consent to the collection of special categories of data (Article 9 GDPR)
• Failure to ensure data security (Article 32 GDPR)
• Failure to notify the CNIL of data breaches (Article 33 GDPR)
• a breach of the obligations related to the use of cookies (Article 82 of the French Data Protection Act)

Consequently, the CNIL imposed two fines on KG COM:

• a fine of 120 000 euros for infringements of the GDPR. This fine was taken in cooperation with the European CNIL counterparts (Belgium, Luxembourg, Italy, Spain, Portugal, Bulgaria, Berlin et Ireland) within the framework of the one-stop shop procedure, as KG COM has customers and prospects from several Member States of the European Union;
• a fine of 30 000 euros for non-compliance relating to use of cookies (Art. 82 of the French Data Protection Act).

In order to determine the amount of the fine, the CNIL took into account the particularly high number of infringements of the data protection rules, the sensitivity of the personal data processed (health data, information relating to sexual orientation) and the number of data subjects.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 40 million euros applied by the French Supervisory Authority (CNIL) to CRITEO for the infringement of the legal provisions stipulated in GDPR.

CRITEO specialises in “behavioral retargeting”, which consists of tracking the navigation of Internet users in order to display personalised advertisements. To this end, the company collects the browsing data of Internet users thanks to the CRITEO tracker (cookie) which is placed on their terminals when they visit certain CRITEO partner websites. Then, it participates in real time bidding and displays personalised advertising if it has won the bid.

Following complaints lodged by the organizations Privacy International and None of Your Business, the CNIL carried out several investigations into CRITEO.

The French SA found five breaches of the GDPR:

·        Failure to demonstrate that the person has given consent (Article 7.1 GDPR)

·        Failure to comply with the obligation of information and transparency (Articles 12 and 13 GDPR)

·        Failure to respect the right of access (Article 15.1 GDPR)

·        Failure to comply with the right to withdraw consent and erasure of data (Articles 7.3 and 17.1 GDPR)

·        Failure to provide for an agreement between joint controllers (Article 26 GDPR)

In this context, the CNIL imposed a fine of 40 million euros on CRITEO. Pursuant to the one-stop shop set up by the GDPR, this decision was submitted to all the other 26 European supervisory authorities, since they were all concerned by this cross-border case and they all approved it.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

On June 28, 2023, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for employees of the University Primary Health Care Clinic with the title: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them about the field of personal data protection.

·        The event covered important topics such as:

·        Definition of personal health data;

·        Processing of general categories of personal data;

·        Processing of special categories of personal data;

·        Legal grounds for processing of personal data concerning health;

·        Principles of personal data processing;

·        Patients’ rights;

·        Obligation of confidentiality of personal data;

·        Confidentiality and professional secrecy;

·        Disclosure of personal health data;

·        Obligation to ensure confidentiality and security of personal data

·        Data minimization and storage limitation, etc.

The representatives of the Prevention, Surveillance and Evidence Directorate moderated the training course and it turned to be an interactive and useful one. The participants asked the trainers many questions about the legal way of personal data processing in their daily work.

At the same time, the specific cases of non-compliant processing of personal health data examined by the NCPDP, as well as the correctness of disclosure of personal health data to third parties, were of great interest.

About 40 representatives of the University Primary Health Care Clinic were trained in the training course.

On 23 June 2023, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Police Department of ATU Gagauzia.

The aim of the training course was to increase the perception of the employees of the Police Directorate of ATU Gagauzia on the principles of personal data protection, as well as on ensuring the correct application of legal provisions in the field, in the activity they carry out.

During the event, important topics such as: definition of general notions related to the field of personal data protection; the legal way of personal data processing in the activity carried out by the employees of the Police Department of ATU Gagauzia; requirements for the protection of personal data in the performance of their duties; obligations of the police body as data controller in relation to the data subject; issues concerning the disclosure of information containing personal data, as well as the analysis carried out by the data controller in terms of access to such data; ensuring the security and confidentiality of personal data processed, etc.

The training course was moderated by the representatives of the Prevention, Surveillance and Evidence Diepartment and it turned to be a useful one, as the trainers from the NCPDP provided the participants with practical answers to the many questions they asked. At the same time, the aspects related to the correct procedure of accessing personal data through the state information systems, the records kept by the Police Department of ATU Gagauzia, as well as the correct auditing of these accesses, were of great interest to the participants.

More than 40 representatives of the Police Department of ATU Gagauzia were trained during the event.

The training course is part of the training plan in the GPI subdivisions for 2023, approved and signed by the heads of the NCPDP and GPI on 25 January this year.

On 21 June 2023, the representatives of the National Centre for Personal Data Protection organized a training course for employees of the Central Territorial Medical Association entitled: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them with the field of personal data protection.

The event addressed important topics such as: definition of personal health data; processing of special categories of personal data; legal grounds for processing personal health data; patients’ rights; obligation of secrecy of personal data; disclosure of personal health data; data minimisation and storage limitation, etc.

The training course was moderated by representatives of the Prevention, Surveillance and Evidence Directorate. It proved to be very useful, the participants asking the trainers many questions about the legal processing of personal data in their daily work. At the same time, the aspects related to the examination of requests for disclosure of personal data on health status to the patient’s legal representative were of great interest to the  participants of the course.

 The event, which took place both in person and online, was attended by about 120 representatives of the Central Territorial Medical Association.

The representatives of the National Centre for Personal Data Protection (NCPDP) attended the 44th plenary meeting of the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), which took place in Strasbourg, France, from 14 to 16 June.

Several topics were discussed during the meeting, including:

– Convention 108+, ratifications and current accessions;

– Data protection for the processing of personal data for anti-money     laundering/countering financing of terrorism purposes;

– Model contractual clauses for transborder data flows of personal data;

– Interpretation of Article 11 of the modernised Convention 108;

– Protection of personal data, including biometric data in the electoral process;

– Cooperation with other Council of Europe bodies and entities;

– Main developments and activities in the field of data protection, etc.

At the same time, the NCPDP delegation reported on the status of ratification of the Protocol amending CETS no. 223 to Convention 108. It should be noted that on 9 February 2023, on the basis of Presidential Decree No. 757/2002, the Republic of Moldova signed the Protocol amending Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, and the Action Plan of the Government of the Republic of Moldova for the current year includes the promotion of measures to ratify the Protocol.

The NCPDP, as the national supervisory authority for the personal data  processing, emphasizes the importance of the participation of  the Republic of Moldova in the plenary meetings of the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as the importance of the documents adopted in these meetings.

On 16 June 2023, the National Centre for Personal Data Protection organised a training course on personal data protection for employees of the National Agency of Road Transport (ANTA), at their request.

The aim of the training course was to increase ANTA employees’ awareness of the principles of personal data protection, as well as of ensuring the correct application of the legal provisions in this field, arising from their obligation to ensure the protection of the fundamental rights and freedoms of individuals with regard to the processing of personal data.

During the event important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection;

– Data Protection Officer issues;

– Data Protection Impact Assessment issues;

– Examination of requests for disclosure of personal data;

– Personal data protection requirements in the performance of duties;

– Correct procedure for accessing personal data through state information systems and keeping correct audit trails of such accesses;

– Ensuring the security and confidentiality of personal data processed, etc.

The training course was an interactive one, with participants asking the trainers many questions about the legal processing of personal data in the daily work of ANTA employees.

The event was attended by the representatives from the two key branches of the institution: the branch dealing with the one-stop-shop activity – issuing of permit documents and the branch dealing with road control activity

On 14 June 2023, the representatives of the National Centre for Personal Data Protection organized a training course for the employees of the Ministry of Internal Affairs, entitled: “Ensuring the protection of personal data in the activity of the Ministry of Internal Affairs”.

The aim of the course was to increase the perception of MIA’s employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection;

– The rights of personal data subjects;

– Processing of special categories of personal data;

– Principles and legal grounds for personal data processing;

– The legal modalities of personal data processing in the activity carried out by the MIA;

– Requirements for the protection of personal data in the performance of duties;

– MAI’s obligations as data controller in relation to the data subject;

– Aspects concerning the disclosure of information containing personal data, as well as the analysis carried out by the MIA regarding access to such data;

– The correct procedure for accessing personal data through the State Information Systems, as well as the correct audit trail of such accesses;

– Ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be an interactive one, with participants asking multiple questions, based on their work, to which they received documented answers with practical examples from the trainers.

During the event, moderated by representatives of the Directorate General for Surveillance and Compliance, about 50 representatives of the MIA were trained.