On September 13th 2023, the National Centre for Personal Data Protection organised a training course on personal data protection for internal auditors in public authorities, at the request of the Ministry of Finance (MF). The MF jointly with central public authorities carries out horizontal internal audit missions, the topic of common interest identified for 2023 being “Assessment of personal data processing in public authorities“.

The aim of the training course was to increase the visibility and publicise the role of internal audit in adding value and improving the work of the entity, including risk management, control and governance processes, through the lens of personal data protection legislation.

During the event, important topics were discussed, such as: definition of general notions related to the field of personal data protection, rights of personal data subjects, processing of special categories of personal data, personal data protection requirements in the exercise of official duties, ensuring security and confidentiality of personal data processed, Data Protection Officer (DPO) issues; Data Protection Impact Assessment issues, etc.

The training course was interactive, trainers providing methodological and advisory support to the participants in carrying out the horizontal audit mission. At the same time, multiple practical examples were presented in order to increase the perception of internal auditors on the principles of personal data protection.

The event was attended by about 50 internal auditors from 30 public authorities.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of 70,000 euro imposed by the Romanian National Supervisory Authority for the Processing of Personal Data (ANSPDCP) on UiPath SRL for violation of the provisions of Articles 25 and 32 of the General Data Protection Regulation (GDPR).

The investigation was started as a result of the transmission by the controller of personal data breach notification under the GDPR.

Thus, UiPath SRL notified a violation of the confidentiality of personal data, consisting in the publication of the personal data of a significant number of users of the Academy Platform on a website accessible at a URL address.

During the investigation, the ANSPDCP found that UiPath SRL did not implement adequate technical and organisational measures to ensure that, by default, personal data cannot be accessed, without the intervention of a person, or an unlimited number of people, including the ability to ensure the ongoing confidentiality and resilience of processing systems and services, as well as a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing.

This fact led to the unauthorised disclosure and access to personal data (user name and surname, the unique identifier of each user, e-mail address, the name of the company where the user is employed, the country and details of the level of knowledge obtained in within the UiPath ACADEMY courses) of about 600,000 users of the Academy Platform belonging to the controller UiPath, for a period of about 10 days.

ANSPDCP considered that this violation of the processing of personal data is likely to bring physical, material or moral harm to the data subjects, such as the loss of control over their personal data or the loss of data confidentiality personal.

Following the investigation, ANSPDCP informed the other supervisory authorities involved, following Article 60 of Regulation (EU) 2016/679, regarding the conclusions resulting from the investigations carried out in this case with cross-border impact and, as well as, the proposed measures.

ANSPDCP considered that UiPath SRL carried out cross-border processing, and that the provisions of Article 60 of Regulation (EU) 679/2016, as well as those of Article 16 (3), (5), (6) and (7) of Law no. 102/2005, republished, which provides for the application of sanctions/corrective measures by decision of the president of ANSPDCP, were applicable.

In this situation, the controller UiPath SRL was sanctioned with a fine of 346,598 lei, the equivalent of 70,000 EURO.

At the same time, pursuant to Article 58 (2) d) of Regulation (EU) 2016/679, the Supervisory Authority ordered the corrective measure against the controller to implement a procedure at regular time intervals, regarding the regular testing, assessing and evaluating the effectiveness of the adopted measures, taking into account the risk presented by the processing, in order to ensure an appropriate level of security and to avoid similar security incidents in the future.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On the 5-th of September 2023, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for employees of the Sangerei Police Inspectorate (PI) of the General Inspectorate of Police.

The purpose of the training course was to increase the perception of Sangerei PI employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event, important topics were discussed, such as: the definition of concepts related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the legal way of personal data processing in the activity carried out by police bodies; the requirements for the protection of personal data in the performance of their duties; the obligations of the police body as data controller in relation to the data subject; ensuring the security and confidentiality of personal data processed, etc.

The training course turned to be an interactive one, and aspects related to the correct procedure for accessing personal data through state information systems, the records kept by PI Sangerei, the procedure for granting access to these data to third parties, as well as the legal aspects of transmitting information containing personal data to the parties on file, were of great interest to the course participants.

About 30 representatives of the Sangerei Police Inspectorate were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

On 29 August 2023, the National Centre for Personal Data Protection (NCPDP) organized a training course on personal data protection for employees of the National Public Security Inspectorate Northern Directorate (NPSI).

The aim of the training course was to increase the perception of the employees of NPSI Northern Directorate on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event, important topics were discussed, such as: definition of concepts related to the field of personal data protection; rights of personal data subjects; processing of special categories of personal data; requirements for the protection of personal data in the fulfilling of official duties; legal aspects of personal data processing through video surveillance systems; ensuring the security and confidentiality of personal data processed, etc.

At the same time, aspects related to the correct procedure for accessing personal data through state information systems, the records kept by the NPSI Northern Directorate, the procedure for granting access to these data to third parties, as well as the obligations of the police body as data controller in relation to the data subject and the legal way of personal data processing in the work carried out by police bodies were of great interest to the course participants.

About 60 representatives of the National Public Security Inspectorate Northern Directorate were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

On August 3rd, 2023, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Police Inspectorate (PI) Botanica sector of the Chisinau Police Department.

The aim of the training course was to increase the awareness of Botanica PI employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in their work.

During the event important topics were discussed, such as: definition of concepts related to the field of personal data protection; rights of personal data subjects; processing of special categories of personal data; the legal way of processing personal data in the activity carried out by police bodies; requirements for the protection of personal data in exercising  their duties; obligations of the police body as data controller in relation to the data subject; ensuring security and confidentiality of personal data processed; issues related to the Data Protection Officer; issues related to the Data Protection Impact Assessment, etc.

The training course turned to be an interactive one, participants asking multiple questions to which they received answers/explanations in the field of personal data protection. At the same time, the aspects related to the correct procedure of accessing personal data through state information systems, the records kept by the PI Botanica sector, the procedure of granting access to these data to third parties, as well as the legal aspects of processing personal data via video surveillance systems, were of great interest to the participants.

About 80 representatives of Botanica Police Inspectorate were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

On 11 July 2023, the representatives of the National Centre for Personal Data Protection organized a training course for employees of the Ialoveni Police Inspectorate of the GPI.

The aim of the course was to increase the perception of the employees of the Ialoveni Police Inspectorate on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event, important topics have been discussed, such as: definition of general notions related to the field of personal data protection; rights of personal data subjects; processing of special categories of personal data; principles and legal grounds for the processing of personal data; legal manner of processing personal data in the activity carried out by the representatives of the Ialoveni Police Inspectorate of the GPI; obligations of the Ialoveni Police Inspectorate of the GPI as data controller in relation to the data subject; ensuring the security and confidentiality of personal data processed, etc.

The training course was moderated by the representatives of the Prevention, Surveillance and Evidence Directorate and proved to be very useful and interactive. The NCPDP’s trainers provided the participants with practical answers to their many questions. At the same time, the aspects related to the correct procedure for accessing and disclosing information containing personal data, the analysis carried out by the Ialoveni Police Inspectorate of the GPI regarding access to such data, as well as the requirements for the protection of personal data in the exercise of their duties, were of great interest to the participants.

More than 40 representatives of the Ialoveni Police Inspectorate of the GPI were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

Today, the 10th of July, the National Centre for Personal Data Protection (NCPDP) in collaboration with TAIEX Project experts is organising the workshop “Data Protection Impact Assessment and the Role of the Data Protection Officer”.

The aim of the workshop is the takeover of legal and operational best practices by the representatives of public institutions on Data Protection Impact Assessment (DPIA) mechanisms, processing operations requiring a DPIA, and the role of the Data Protection Officer (DPO) within public sector personal data controllers.

The event was opened by NCPDP’s Director Victoria Muntean: “Current aspirations to digitise society, as well as the rapid technological developments widely used by both EU countries and the rest of the world, underline the pressing need for strong protection of personal data – a right guaranteed by both European Union and Council of Europe instruments. The collection, storage and use of personal data at an unprecedented level expose the data subjects whose data are processed to certain risks. These risks range from identity theft or inadvertent disclosure of personal data to the use of personal data for unknown purposes. A Data Protection Impact Assessment, in this case, is more than necessary, as it describes a process designed to identify the risks arising from the personal data processing, to minimise these risks and to detect them as early as possible.”

The conference is moderated by data protection experts from Italy and Malta. Amongst the topics addressed by the experts are: assessment of the necessity and proportionality of processing operations subject to the requirement to carry out a data protection impact assessment; scenarios for personal data protection impact assessment; practical mechanisms for carrying out prior consultations if the data protection impact assessment indicates that the processing would generate an increased risk and that this risk cannot be mitigated by reasonable means in terms of available technologies and implementation costs by DPA employees; the means given to the DPO to carry out his/her tasks; examples of best practices to assist state institutions/organisations in appointing and supporting the DPO in order to avoid possible conflicts of interest; etc.

Around 60 representatives of the public sector are participating in the event.

The workshop is organised and funded by the European Commission’s Technical Assistance and Information Exchange Instrument (TAIEX).

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 150 000 euros applied by the French Supervisory Authority (CNIL) to KG COM for the failure to comply with its obligations stipulated in GDPR and French Data Protection Act.

KG COM operates several websites to offer its customers clairvoyance readings by chat or phone. Following the publication of a press article in 2020 revealing the existence of a personal data breach involving the company, the CNIL carried out three investigations into KG COM.

Following the investigations, CNIL found several violations, such as:

• Failure to minimise the personal data collected and used (Article 5.1.c GDPR)
• Failure to have a legal basis for the use of banking data (Article 6 GDPR)
• Failure to obtain prior consent to the collection of special categories of data (Article 9 GDPR)
• Failure to ensure data security (Article 32 GDPR)
• Failure to notify the CNIL of data breaches (Article 33 GDPR)
• a breach of the obligations related to the use of cookies (Article 82 of the French Data Protection Act)

Consequently, the CNIL imposed two fines on KG COM:

• a fine of 120 000 euros for infringements of the GDPR. This fine was taken in cooperation with the European CNIL counterparts (Belgium, Luxembourg, Italy, Spain, Portugal, Bulgaria, Berlin et Ireland) within the framework of the one-stop shop procedure, as KG COM has customers and prospects from several Member States of the European Union;
• a fine of 30 000 euros for non-compliance relating to use of cookies (Art. 82 of the French Data Protection Act).

In order to determine the amount of the fine, the CNIL took into account the particularly high number of infringements of the data protection rules, the sensitivity of the personal data processed (health data, information relating to sexual orientation) and the number of data subjects.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 40 million euros applied by the French Supervisory Authority (CNIL) to CRITEO for the infringement of the legal provisions stipulated in GDPR.

CRITEO specialises in “behavioral retargeting”, which consists of tracking the navigation of Internet users in order to display personalised advertisements. To this end, the company collects the browsing data of Internet users thanks to the CRITEO tracker (cookie) which is placed on their terminals when they visit certain CRITEO partner websites. Then, it participates in real time bidding and displays personalised advertising if it has won the bid.

Following complaints lodged by the organizations Privacy International and None of Your Business, the CNIL carried out several investigations into CRITEO.

The French SA found five breaches of the GDPR:

·        Failure to demonstrate that the person has given consent (Article 7.1 GDPR)

·        Failure to comply with the obligation of information and transparency (Articles 12 and 13 GDPR)

·        Failure to respect the right of access (Article 15.1 GDPR)

·        Failure to comply with the right to withdraw consent and erasure of data (Articles 7.3 and 17.1 GDPR)

·        Failure to provide for an agreement between joint controllers (Article 26 GDPR)

In this context, the CNIL imposed a fine of 40 million euros on CRITEO. Pursuant to the one-stop shop set up by the GDPR, this decision was submitted to all the other 26 European supervisory authorities, since they were all concerned by this cross-border case and they all approved it.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

On June 28, 2023, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for employees of the University Primary Health Care Clinic with the title: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them about the field of personal data protection.

·        The event covered important topics such as:

·        Definition of personal health data;

·        Processing of general categories of personal data;

·        Processing of special categories of personal data;

·        Legal grounds for processing of personal data concerning health;

·        Principles of personal data processing;

·        Patients’ rights;

·        Obligation of confidentiality of personal data;

·        Confidentiality and professional secrecy;

·        Disclosure of personal health data;

·        Obligation to ensure confidentiality and security of personal data

·        Data minimization and storage limitation, etc.

The representatives of the Prevention, Surveillance and Evidence Directorate moderated the training course and it turned to be an interactive and useful one. The participants asked the trainers many questions about the legal way of personal data processing in their daily work.

At the same time, the specific cases of non-compliant processing of personal health data examined by the NCPDP, as well as the correctness of disclosure of personal health data to third parties, were of great interest.

About 40 representatives of the University Primary Health Care Clinic were trained in the training course.