On June 9, 2023, the representatives of the National Center for Personal Data Protection organized a training course for the employees of the Family Doctors Center from Balti municipality, entitled: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them about the field of personal data protection.

The event covered important topics such as:

– Definition of personal health data;

– Processing of special categories of personal data;

– Legal grounds for processing personal data concerning health;

– Patients’ rights;

– The mandatory secrecy of personal data;

– Disclosure of personal health data;

– Data minimisation and storage limitation, etc.

The training course was moderated by representatives of the Prevention, Surveillance and Evidence Directorate and proved to be a useful and interactive one, with participants asking the trainers many questions about practical examples in the field of personal data protection.

The event was attended by about 50 representatives of the Family Doctors Center from Balti municipality.

The National Centre for Personal Data Protection (NCPDP), for information and enforcement purposes, informs about the fine of 300,000 euros imposed by the German Federal Data Protection Authority (DPA) on a bank for lack of transparency in an automated individual decision.

An automated decision is a decision made by an IT system based solely on algorithms and without human intervention. In this case, Regulation (EU) 2016/679 (GDPR) provides for special transparency obligations. Personal data must be processed in a way that is easy to understand for data subjects. Data subjects have the right to an explanation of the decision taken after a proper assessment.

In this case, however, the bank did not take this into account in its digital application for a credit card. Using an online form, the bank requested various data about the applicant’s income, occupation and personal details. Based on the requested information and additional data from external sources, the bank’s algorithm rejected the customer’s application without any specific justification. The algorithm is based on criteria and rules previously defined by the bank. As the customer had a good Credit Score and a high regular income, he doubted the automated rejection and complained to the DPA in Germany.

A bank is obliged to inform its customers of the main reasons for rejection when making an automated decision on a credit card application. This includes factual information on the database and the decision-making factors as well as the criteria for rejection.

As a result of the investigation, the German DPA found that the bank violated Articles 22(3), 5(1)(a) and 15(1)(h) of the GDPR. In imposing the fine, the bank’s high turnover, the intentional structure of the application and information request process were in particular taken into account.

The NCPDP, as the national supervisory authority for the personal data processing, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On 26 May 2023, the representatives of the National Centre for Personal Data Protection (NCPDP) participated as trainers in the training course entitled: “Processing of personal data in the educational sector”, organized for the General Directorate of Education Cahul.

The aim of the training course was to increase the awareness of employees in the education sector on the principles of personal data protection and on ensuring the correct application of the relevant legal provisions in their work.

During the event important topics were discussed, such as:

– General notions of personal data protection;

– Principles of personal data protection;

– Data Protection Officer (DPO) issues;

– Data Protection Impact Assessment issues;

– Ensuring security and confidentiality of personal data by employees of educational institutions;

– The active role of the teacher in informing students about the consequences of disclosing personal data;

– Installation and management of video surveillance systems in educational institutions;

– Storage, retention and disclosure of personal data;

– Electronic transmission of information containing personal data, etc.

The training course was an interactive one, with participants asking multiple questions to which they received answers/explanations in the field of personal data protection.

The course took place online, 85 representatives of the General Directorate of Education Cahul being trained.

The National Centre for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the fine of €1.2 billion, imposed following the binding dispute resolution decision of the European Data Protection Board (EDPB), on Meta Platforms Ireland Limited (Meta IE) for serious breach of the legal provisions, stipulated in Regulation (EU) 2016/679 (GDPR). This fine, which is the largest GDPR fine to date, was imposed for personal data transfers made by Meta IE to the US under standard contractual clauses from 16 July 2020.

In its binding decision of 13 April 2023, the EDPB ordered the Irish Data Protection Authority (DPA) to amend its draft decision, imposing a fine on Meta IE (formerly Facebook Ireland Limited). Given the seriousness of the breach, the EDPB found that the starting point for calculating the fine should be between 20% and 100% of the applicable legal maximum. The Irish DPA is also required to order Meta IE to bring its processing operations into compliance with Chapter V of the GDPR by ceasing unlawful processing, including storage, in the US of European users’ personal data transferred in breach of the legal provisions of the GDPR within 6 months of notification of its final decision.

The Irish DPA’s final decision incorporates the legal assessment expressed by the EDPB in its binding decision under Article 65(1)(a) of the GDPR after the Irish DPA, as lead supervisory authority, initiated a dispute resolution procedure regarding objections raised by several supervisory authorities concerned.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the personal data protection and to ensure that personal data processing operations comply with the legislation in force.

The National Centre for Personal Data Protection, for information purposes, announces the appointment of Ms Anu Talus as Chair of the European Data Protection Board (EDPB), replacing the current Chair, Andrea Jelinek. She was elected by 19 votes out of 27 in two ballots on 25 May at the 80th Plenary Session.

Anu Talus is Director of the Finnish Data Protection Authority, a position she will combine with that of Chair of the EDPB.

In accordance with Article 73 of Regulation (EU) 2016/679, the Council elects a Chair and two Vice-Chairs from among its members by an absolute majority and by secret ballot. Their term of office is for a period of five years and may be renewed once. The EDPB Chair supervises all tasks of the Board and ensures that they are carried out in a timely manner.

At the same time, Ms Irene Loizidou Nikolaidou (Commissioner of the Cyprus Data Protection Authority), was elected as the new EDPB Vice-Chair, while Vice-Chair Aleid Wolfsen remains in office, his term of office ending on 15 May 2024.

The EDPB is an independent European body that contributes to the consistent application of data protection rules across the European Union and promotes cooperation between EU data protection authorities (DPAs). The EDPB was established under Article 68 of Regulation (EU) 2016/679 and is supported in its work by the EDPB Secretariat. The Secretariat carries out its tasks as instructed by the Chair. It provides analytical, administrative and logistical support to the Council; organises all meetings of the Administrative Board and manages the IT platforms used by the EDPB. In addition, the Secretariat has a major role in providing legal analysis.

On May 17, the National Center for Personal Data Protection (NCPDP) organized the training course “Personal data protection and children’s safety in the online environment” for the public institution “Mircea Eliade” Theoretical High School from Chisinau, the target audience being 5th grade students. The event took place within the Personal Development class.

The aim of the information and awareness campaign is to provide high visibility on personal data protection and children’s safety in the online environment at local and national level by promoting empowerment and best practice intervention and support.

The topics covered in the training included: general notions on personal data; posting and correct use of pictures on social networks; creative, useful and safe use of the internet; risks of using the internet; aspects that can have negative consequences; attitudes and practices for sending pictures/videos online; communication on social networks, etc.

At the same time, the NCPDP’s trainers carried out interactive activities, there were discussions based on the information material presented, videos were shown and, at the end, students completed a crossword based on the material presented.

The event was organised at the initiative of the NCPDP, 39 students being trained.

It should be noted that the information and awareness-raising campaign for the school community was launched on 15 April 2022, and the NCPDP aims to continue this training format both in schools in the municipality of Chisinau and in the districts of the Republic of Moldova.

On 10-12 May 2023, the representatives of the National Centre for Personal Data Protection (NCPDP) participated in the 31st Spring Conference of the European Data Protection Authorities in Budapest, Hungary.

This year the event was hosted by the Hungarian Data Protection Authority. It is to mention that Hungary hosts this event for the third time.

During the working sessions, topical data protection issues were presented, such as:

– New technologies – assessing the social impact of the use of new technologies in different areas;

– Interaction between data protection and competition law;

– Court decisions: resolutions and amendments to the Rules of Procedure;

– Best practices/case studies in enforcement cooperation between EEA and non-EEA countries.

For the first time at a Spring Conference of the European Data Protection Authorities, an Open Day was organised. This practice gave the opportunity to several institutions, NGOs or other organisations that expressed interest in the topics covered during the event to participate online.

The event was attended by the representatives of Central and Eastern European Data Protection Authorities, the Council of Europe, the European Data Protection Board, the European Data Protection Supervisor, where they had the opportunity to exchange experience and best practices in the field of personal data protection, including the role of the Data Protection Officer within a public or private entity.

On 13 May 2023, the National Centre for Personal Data Protection (NCPDP) joined the initiative of the EU Delegation to the Republic of Moldova and participated in the inauguration event of the European Village, organised annually on the occasion of Europe Day.

This year’s edition was held under the slogan “European Moldova”, the event took place in the Great National Assembly Square in Chisinau.

Europe Day 2023 is about peace, solidarity and unity. Participants had the opportunity to interact with the representatives of public institutions, diplomatic missions of EU Member States accredited in Chisinau, to get acquainted with projects carried out with the support of the European Union, to participate in various educational, creative and interactive activities, to taste European cuisine and to participate in information sessions on current topics.

The representatives of the NCPDP, set up a stand with educational-informative materials and promotional fliers, and the general public was informed about the field of personal data protection. Amongst  the topics of interest both for adults and children, the following can be mentioned: the concept of personal data, the rights of data subjects, data security and confidentiality measures, principles of personal data protection, etc. Citizens were also informed about possible situations of non-compliant processing of personal data and were given practical guidelines and recommendations to be undertaken in such cases.

The European Village is traditionally organised by the EU Delegation in the Republic of Moldova, in partnership with public authorities and diplomatic missions accredited in our country, in order to annually celebrate peace and unity in Europe – Europe Day.

On 12 May 2023, the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection, entitled Ensuring the process of protection and processing of personal data, following the request received from the National Health Insurance Company (NHIC).

The training course aimed to increase the awareness of NHIC employees on the principles of personal data protection, as well as on ensuring the correct application of legal provisions in the field, in the activity they carry out.

• The following important topics were discussed during the event:
• Definition of concepts related to personal data protection;
• The legal way of processing personal data in the activity carried out by the NHIC;
• The requirements for the protection of personal data when exercising work tasks;
• Issues relating to the disclosure of information containing personal data and the analysis carried out by the data controller (NHIC) regarding access to such data;
• Data Protection Officer (DPO) issues;
• Data Protection Impact Assessment issues;
• Ensuring the security and confidentiality of personal data processed in automated filing systems managed by the NHIC;
• Rights of personal data subjects, etc.

The training course was attended by 39 representatives of the NHIC, both physically present and online.

Every year on 9 May is celebrated Europe Day. It is a celebration of peace and unity in Europe. The date marks the historic day on which the Schuman declaration was made, this year marking 73 years since it was signed. To mark Europe Day, the EU institutions open their doors to the general public in Brussels and Strasbourg in early of May. Local EU offices in Europe and around the world organise a variety of activities and events for people of all ages.

The National Centre for Personal Data Protection (NCPDP), together with other institutions from the Republic of Moldova and the EU, participates every year in the celebration of Europe Day. Throughout the years of its activity, the NCPDP has followed the European vector, has closely cooperated with EU institutions, as well as benefited from their support.

Only during 2023, the NCPDP, in collaboration with the Technical Assistance and Information Exchange Instrument (TAIEX), organised the TAIEX Expert Mission “Processing of Personal Data for Statistical Purposes” on 29-30 March for representatives of public institutions from the National Bureau of Statistics; the General Inspectorate of Border Police; the Public Services Agency; the e-Government Agency; the Ministry of the Interior; the Ministry of Health; the State Chancellery; the State Tax Inspectorate and the Customs Service. At the same time, the national conference “Data Protection Impact Assessment and the Role of the Data Protection Officer” will be organised on 10 July, and in the second half of this year – the Study Visit “Reconciling the Right of Access to Information and Personal Data Protection”. The above mentioned events, organised with the support of the TAIEX team, serve as an opportunity to exchange experience and best practices with EU experts on raising awareness and informing the public sector on the area of personal data protection.

At the same time, international cooperation continues to be the promoter of the NCPDP’s institutional development objectives. Successes in this respect have been achieved thanks to the exchange of experience, knowledge, best practices with data protection authorities, the support provided by EU experts, the uptake and application in practice of international personal data protection standards. Cooperation, both at European and international level, is a strategic issue which requires involvement in all initiatives under development. In this context, the plenary meetings of the European Data Protection Board and the meetings of the Bureau of the Convention 108 Committee are regularly attended.

The NCPDP believes that solidarity is the pillar on which the functioning of the European Union is based, and Europe Day marks the values on which it was founded. Europe Day is about the future of every European citizen, while the EU represents a democratic model of values and principles that have been and remain fundamental to their prosperity.