The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine imposed by the Hellenic Data Protection Authority (DPA) on HELLENIC POST SERVICES SA for violation of Article 5 Principles related to the processing of personal data and Article 32 Security of processing of GDPR.

“HELLENIC POST SERVICES S.A.” (ELTA S.A.) has reported two personal data breach incidents to the Hellenic SA in compliance with the GDPR. The first incident involved a data encryption breach for the purpose of a ransom request in the company’s system as a result of a malware attack from third parties, while the second incident involved the leak of personal data, which was subsequently published on the Dark Web.

Following investigations, the Hellenic SA found that the controller did not comply with the necessary technical and organizational measures and did not ensure the implementation of the security policy for the processing of personal data. This failure resulted in breaches in the controller’s system, including vulnerability scanning, unauthorized access to system resources, execution of malicious processes, disabling security software and file encryption.

In this context, the Hellenic SA imposed on ELTA S.A. an administrative fine amounting to 1% of the last available annual turnover based on assessment criteria in accordance with EDPB Guidelines 4/2022 on the calculation of administrative fines, namely: the large number of persons affected, the amount of damage, the nature of the breach, the non-compliance with the security policy and the categories of data affected. Mitigating factors were also taken into account, such as: the reinforcement of system security measures after the incident, the fact that the investigation of the incident was entrusted to a specialized company and ELTA S.A. followed its instructions, the data recovery and the unfavorable financial situation of the company.

The NCPDP, as the national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and enforcement, communicates about the administrative fine in the amount of 13.9 million euro imposed by the Czech Data Protection Authority (SA) on a company registered in the Czech Republic for violation of Article 6 Lawfulness of processing and Article 13 Information to be provided where personal data is collected from the data subject of the GDPR.

The case concerns the transfer by controller of personal data collected by it from users of its anti-virus software to an affiliated company. The proceedings were initiated on the basis of media reports and an anonymous file.

Following the investigation, the Czech SA found that the controller transferred personal data of users of anti-virus software and browser extensions to the affiliated company without having a legal basis for such processing. The transferred data related to approximately 100 million users and included in particular the pseudonymized web browsing history of the users linked to a unique identifier. In addition, the Czech SA found that the controller misinformed its users (data subjects) about these data transfers, as it claimed that the transferred data were anonymized and used exclusively for statistical sales analysis. At the same time, the Czech Data Protection Authority concluded that Internet browsing history, even if not complete, may constitute personal data, as re-identification of at least some of the data subjects could occur. The controller’s breach is all the more serious as it is one of the leading experts in the field of cybersecurity, providing the public with data protection and privacy tools.

An administrative fine of €13.9 million (CZK 351 million) was imposed on the data controller. The decision is final and enforceable.

The NCPDP as the national supervisory authority for the processing of personal data, emphasizes the responsibility of data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the applicable legislation.

In the period 14-16 May 2024, representatives of the National Centre for Personal Data Protection (NCPDP) participated in the 32nd Spring Conference of the European Data Protection Authorities in Riga, Latvia.

This year Spring Conference was hosted by the Latvian State Data Protection Inspectorate and brought together Data Protection Authorities from across Europe to establish a common framework for cooperation to protect individuals’ data at European level. The conference also served as a unique European platform for the exchange of experience and best practices in the field of data protection.

During the working sessions, topical issues were presented, such as:

• The role of Data Protection Authorities in the era of evolving digital regulation;

• Managing data protection and privacy in the era of emerging technologies and innovations;

• Health data protection in the age of digitization;

• Shaping data protection through the cooperative experience of Data Protection Authorities;

• Managing the Anti-Money Laundering (AML) and General Data Protection Regulation (GDPR) regulations: challenges, cooperation and compliance;

• Strengthening compliance with AML and GDPR regulations through collaborative strategies.

For the second time, an Open Day was organized as part of a Spring Conference of the European Data Protection Authorities. This gave the opportunity to several institutions, NGOs or other organizations that expressed an interest in the topics addressed during the event to participate, including online.

The event was attended by 145 representatives from 43 countries, such as: Austria, Belgium, Bulgaria, Croatia, Denmark, France, Georgia, Germany, Greece, Hungary, Italy, Malta, Moldova, Portugal, Romania, Spain, Switzerland, Ukraine, etc. Representatives of four organizations attended also the event: FRA, EDPS, EDPB and the European Commission.

On 16 May 2024, the National Centre for Personal Data Protection organized a training course on personal data protection for the employees of the Institute for Standardization (ISM) at their request.

The aim of the training course was to increase ISM employees’ awareness on the principles of personal data protection, as well as to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event important topics were discussed, such as:

Definition of general notions related to the field of personal data protection;

The rights of personal data subjects;

Processing of special categories of personal data;

Principles and legal grounds for processing personal data;

Requirements for the protection of personal data in the exercise of official duties;

Issues relating to the appointment of the Data Protection Officer (DPO);

Obligations and tasks of a DPO;

Ensuring the security and confidentiality of personal data processed, etc.

The training course was interactive, participants asking the trainers many questions about the legal aspects of personal data processing through video surveillance systems, as well as the time limit for the retention/storage and use of personal data at the end of processing operations.

The event was attended by about 20 representatives from ISM.

In the light of the multitude information disseminated in the public space in relation to personal data processing in the context of conducting the Population and Housing Census of the Republic of Moldova in 2024, the National Centre for Personal Data Protection (NCPDP) comes with the following clarifications:

The purpose of Law No 133/2011 on the protection of personal data is to ensure the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data, in this regard establishing framework requirements to ensure compliance of the processing of personal data in various sectors, such as: medical, financial-banking, police, education, telecommunications, etc.

In this respect, the law in question contains general provisions and sectoral regulations that may lay down specific rules on the purpose of processing personal data, the categories of data subject to processing, the data subjects, the conditions under which processing takes place, measures to ensure the confidentiality and security of personal data, the entities to which personal data may be disclosed, etc.

The reasoning set out above is also valid in relation to the normative acts regulating the organization and conduct of the Population and Housing Census in the Republic of Moldova in 2024.

It is worth mentioning that, in view of the competences assigned to it, the NCPDP actively participated in the approval process of the normative acts regulating the processing of personal data related to official statistics, submitting comments and proposals to improve their content, in order to comply with the requirements of the legislation on personal data protection.

In view of the issues raised in the public space regarding the processing of personal data in the process of conducting the Population and Housing Census in 2024, it will be emphasized that the processing of personal data is considered lawful when it is carried out on the legal grounds provided for in Article 5 of the Law on the Protection of Personal Data. In this regard, para. (5) of the aforementioned article provides for situations where the consent of the data subject is not required for the processing of personal data, for example, as appropriate to the case at hand, for the fulfilment of an obligation incumbent on the controller by law or for the performance of tasks in the public interest or resulting from the exercise of the prerogatives of public authority vested in the controller or the third party to whom the personal data are disclosed.

Thus, in order to provide information of public interest on the resident population and housing for the elaboration, monitoring and evaluation of policies, for the argumentation of human development decisions, for scientific research and for the development of the business environment, the legislator adopted Law No 231/2022 on the population and housing census, and subsequently approved the related secondary regulatory framework, acts which involve/generate the processing of personal data for the purpose of the census. 

Respectively, the processing of personal data in the framework of this exercise is carried out on the basis of the normative acts regulating the organization and conduct of the Population and Housing Census in the Republic of Moldova in 2024, but the Law on the Protection of Personal Data does not come with specific regulations/conditions in this regard.

Thus, the provisions of Article 7 of the Population and Housing Census Act, which make participation in the census compulsory, are relevant. For example: in para. (1) of this article states that participation in the census of persons who meet the conditions of Art. 3 para. (1)(1)(a) to (c) is compulsory. Further, para. (5) states that if one or more members of the household are missing, the enumerator shall complete the census questionnaires on the basis of information provided by the other members who are fully competent, if they know the answers to the questions in the questionnaires. The necessary information about minor children is provided by their legal representatives. Article 23 of the same Act provides that violations of the provisions of the Act shall give rise to disciplinary, civil, criminal and/or misdemeanour liability, as appropriate.

In the same vein, it should be mentioned that, as a data controller, the National Bureau of Statistics is empowered by law to collect, process and store personal data, ensuring appropriate confidentiality and security of individual data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, through technical, organisational and administrative measures implemented in accordance with the Personal Data Protection Policy and other legislation related to the subject matter.

In addition it should be mentioned that, in accordance with Article 14 para. (4) of the Population and Housing Census Act, the NBS is prohibited from transmitting personal data collected for the purpose of the census to other natural or legal persons.

In another context, it should be noted that, by Law No 175/2021, the power of the NCPDP to authorize the processing of personal data was excluded, as well as the obligation of data controllers to notify the NCPDP of personal data processing operations, while at the same time Article 28 of Law No 133/2011 was repealed, which led to the liquidation of the Register of personal data controllers. In these circumstances, we draw attention to the fact that the National Bureau of Statistics, including the census takers involved in the collection of census data in the territory, must not hold and, respectively, present respondents with any authorization issued by the NCPDP to process personal data.

In the context of the above subject, it should be noted that, to date, the NCPDP has not received any complaints from data subjects regarding the possible non-compliant processing of their personal data carried out in the framework of the Population and Housing Census of the Republic of Moldova 2024, including with regard to alleged transmissions of personal data to unauthorized persons.

Finally, the NCPDP recommends the population to get information from official sources, and when there are any uncertainties regarding the legal regime of personal data protection or official statistics, to contact the competent authorities.

Every year, on 9 May is celebrated Europe Day, a celebration of peace and unity in Europe. The date marks the historic day on which the Schuman declaration was made. This year we celebrate 74 years after it was signed. In a speech in Paris in 1950, then French Foreign Minister Robert Schuman proposed establishing a new form of political cooperation in Europe that would eliminate forever the possibility of another war between the nations of Europe. Robert Schuman’s proposal is considered the cornerstone of the European Union. In order to mark Europe Day, the EU institutions open their doors to the public in Brussels and Strasbourg in early May. Local EU offices in Europe and around the world organise various activities and events for all ages.

This year, Europe Day will be celebrated under the slogan “Freedom, Peace, Prosperity – Europe is you!”. The traditional European Village will take place in the Great National Assembly Square under the aegis of the Government, the Delegation of the European Union to the Republic of Moldova, together with the embassies of EU Member States and EU-funded projects.

The National Centre for Personal Data Protection (NCPDP), together with other institutions in the Republic of Moldova as well as in the EU, celebrates Europe Day every year. Throughout its years of activity, the NCPDP has followed the European vector, has worked closely with and received support from EU institutions.

Only during 2024, the NCPDP, in collaboration with the Technical Assistance and Information Exchange Instrument (TAIEX), organised on 26 January the national conference “Raising Awareness of Convention 108+” for about 100 representatives from both public institutions and the private sector. At the same time, from 11 to 13 March 2024, representatives of the NCPDP conducted the study visit “Processing of personal data through video surveillance systems”. The event was hosted by the Spanish Data Protection Authority (AEPD) – Agencia Española de Protección de Datos. These events, organised with the support of the TAIEX team, served as an opportunity to share experiences and best practices with EU experts on raising awareness and informing the public sector on the field of personal data protection.

At the same time, international cooperation continues to be the promoter of the NCPDP’s institutional development objectives. Successes in this respect have been achieved thanks to the exchange of experience, knowledge, best practices with data protection authorities, training provided by EU experts, the uptake and application in practice of international personal data protection standards. Cooperation, both at European and international level, is a strategic issue that requires involvement in all initiatives under development. In this context, the plenary meetings of the European Data Protection Board and the meetings of the Bureau of the Convention 108 Committee are regularly attended.

The NCPDP believes that solidarity, freedom, peace and the rule of law are the pillars on which the functioning of the European Union is based, and that Europe Day marks the values on which it was founded. Europe Day is about and for the people, about the future of every European citizen, while the EU represents a democratic model of values and principles that have been and remain fundamental to their prosperity.

The National Centre for Personal Data Protection (CNPDCP), for information and enforcement purposes, communicates about the administrative fine of 525 000 euros imposed by the French Data Protection Authority (CNIL) on HUBSIDE.STORE for breach of Article 6 (Lawfulness of processing) and Article 14 (Information to be provided where personal data have not been obtained from the data subject) of the GDPR.

HUBSIDE.STORE conducts telephone and SMS prospecting campaigns to promote products sold in its stores (mobile phones, laptops, etc.), acquiring data from data brokers and publishers of competing product testing websites.

As a result of the investigations, the CNIL found several violations of the GDPR, such as:

• Failure to have a legal basis for processing personal data (Article 6 GDPR);

• The misleading aspect of the data collection forms used by data brokers responsible for data collection did not allow valid consent to be obtained from data subjects. Therefore, HUBSIDE.STORE did not have a valid legal basis for collecting data (Article 6 of the GDPR) for commercial marketing via telephone calls. It is also a violation of the French Postal and Electronic Communications Code (Article L.34-5) for the purpose of marketing via SMS;

• Failure to comply with the obligation to inform individuals (Article 14 of the GDPR). Investigations revealed that individuals contacted by telephone did not have all the necessary information on the collection and use of their personal data (e.g. the identity and contact details of the company, the purposes for which the data was used, the retention periods, the source of the data, their rights or even the possibility to lodge a complaint with the French Data Protection Authority).

In this context, the CNIL imposed an administrative fine of €525,000 on HUBSIDE.STORE, which has been made public. The CNIL cooperated closely with its counterparts (Belgium, Italy, Spain, Portugal) in examining the draft decision under the single procedure, as HUBSIDE.STORE processes data from customers and potential customers in several EU Member States. The amount of the fine, which represents approximately 2% of the company’s turnover, was decided according to the seriousness of the infringement and the responsibility assumed by the company using the data collected. The CNIL also took into account the fact that HUBSIDE.STORE made extensive use of commercial marketing.

The NCPDP, as the national surveillance authority for the processing of personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On April 23, the National Center for Personal Data Protection (NCPDP) continued the information and awareness-raising campaign for the school community, organizing the training course “Personal data protection and children’s safety in the online environment” for the public institution Theoretical Lyceum “Iulia Hasdeu” from Chisinau. The event took place in the framework of the Personal Development class, the target audience being the students of classes IV “A”, IV “B” and IV “C”.

The aim of the school community information and awareness campaign was to provide high visibility on data protection and child safety online at local and national level by promoting empowerment and best practice intervention and support.

The topics covered in the training included: general notions on personal data; posting and correct use of pictures on social networks; creative, useful and safe use of the internet; risks of using the internet; aspects that can have negative consequences; attitudes and practices for sending pictures/videos online; communication on social networks, etc.

At the same time, the NCPDP trainers carried out interactive activities, there were discussions based on the information material presented, videos were shown and, at the end, students completed a crossword based on the material presented, the best ones being awarded with gifts.

The event was organised at the initiative of the NCPDP and 110 students were trained. Information materials and gifts for the students were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on 15 April 2022, and the CNPDCP aims to continue this training format in schools both in Chisinau municipality and the districts of the Republic of Moldova.

On April 19, the National Center for Personal Data Protection (NCPDP) continued the information and awareness-raising campaign for the school community, organizing the training course “Personal data protection and children’s safety in the online environment” for the public institution Lyceum “Liviu Rebreanu” from Chisinau. The event took place in the framework of the Personal Development class, the target audience being the students of classes IV “A”, IV “B” and IV “C”.

The aim of the school community information and awareness campaign is to provide high visibility on data protection and child safety online at local and national level by promoting empowerment and best practice intervention and support.

The topics covered in the training included:

• General notions of personal data (what they mean, how we identify them, how we operate with them);

• Attitudes and practices when sending pictures/videos online (the privacy of a social networking page, privacy settings, working with pictures/videos in a chat, attitude and actions taken in case a picture/video is taken without your consent and subsequently distributed);

• Online risks and threats (malware, spam, online harassment, information theft, situations that threaten your child’s privacy/security and solutions for such situations);

• Communication on social media, etc.

During the training, students played interactive games, completed a crossword based on the material presented and participated in a question and answer round, and the best were rewarded with presents.

The event was organised at the initiative of the NCPDP and 86 students were trained. The information materials and gifts given to the students were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on 15 April 2022, and the NCPDP aims to continue this training format both in schools in the Chisinau municipality and in the districts of the Republic of Moldova.

On 18 April 2024, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for representatives of the State Pedagogical University “Ion Creanga”.

The aim of the training course was to increase the awareness of employees in the educational sector on the principles of personal data protection and on ensuring the correct application of the legal provisions in the field in their work.

During the event important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• Principles and legal grounds for processing personal data;

• Processing of special categories of personal data;

• Requirements for the protection of personal data in the exercise of official duties;

• Ensuring the security and confidentiality of personal data processed, etc.

The training course was an interactive one, with multiple practical examples presented in order to increase the perception of the University representatives on the principles of personal data protection. At the same time, the legal way of requesting and disclosing personal data, as well as the period of storage of information containing personal data in accordance with legal provisions, were of great interest to the course participants.

During the event, moderated by experts in the field of personal data protection from the NCPDP, about 40 representatives of the State Pedagogical University “Ion Creanga” were trained.