On 23 June 2023, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Police Department of ATU Gagauzia.

The aim of the training course was to increase the perception of the employees of the Police Directorate of ATU Gagauzia on the principles of personal data protection, as well as on ensuring the correct application of legal provisions in the field, in the activity they carry out.

During the event, important topics such as: definition of general notions related to the field of personal data protection; the legal way of personal data processing in the activity carried out by the employees of the Police Department of ATU Gagauzia; requirements for the protection of personal data in the performance of their duties; obligations of the police body as data controller in relation to the data subject; issues concerning the disclosure of information containing personal data, as well as the analysis carried out by the data controller in terms of access to such data; ensuring the security and confidentiality of personal data processed, etc.

The training course was moderated by the representatives of the Prevention, Surveillance and Evidence Diepartment and it turned to be a useful one, as the trainers from the NCPDP provided the participants with practical answers to the many questions they asked. At the same time, the aspects related to the correct procedure of accessing personal data through the state information systems, the records kept by the Police Department of ATU Gagauzia, as well as the correct auditing of these accesses, were of great interest to the participants.

More than 40 representatives of the Police Department of ATU Gagauzia were trained during the event.

The training course is part of the training plan in the GPI subdivisions for 2023, approved and signed by the heads of the NCPDP and GPI on 25 January this year.

On 21 June 2023, the representatives of the National Centre for Personal Data Protection organized a training course for employees of the Central Territorial Medical Association entitled: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them with the field of personal data protection.

The event addressed important topics such as: definition of personal health data; processing of special categories of personal data; legal grounds for processing personal health data; patients’ rights; obligation of secrecy of personal data; disclosure of personal health data; data minimisation and storage limitation, etc.

The training course was moderated by representatives of the Prevention, Surveillance and Evidence Directorate. It proved to be very useful, the participants asking the trainers many questions about the legal processing of personal data in their daily work. At the same time, the aspects related to the examination of requests for disclosure of personal data on health status to the patient’s legal representative were of great interest to the  participants of the course.

 The event, which took place both in person and online, was attended by about 120 representatives of the Central Territorial Medical Association.

The representatives of the National Centre for Personal Data Protection (NCPDP) attended the 44th plenary meeting of the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), which took place in Strasbourg, France, from 14 to 16 June.

Several topics were discussed during the meeting, including:

– Convention 108+, ratifications and current accessions;

– Data protection for the processing of personal data for anti-money     laundering/countering financing of terrorism purposes;

– Model contractual clauses for transborder data flows of personal data;

– Interpretation of Article 11 of the modernised Convention 108;

– Protection of personal data, including biometric data in the electoral process;

– Cooperation with other Council of Europe bodies and entities;

– Main developments and activities in the field of data protection, etc.

At the same time, the NCPDP delegation reported on the status of ratification of the Protocol amending CETS no. 223 to Convention 108. It should be noted that on 9 February 2023, on the basis of Presidential Decree No. 757/2002, the Republic of Moldova signed the Protocol amending Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, and the Action Plan of the Government of the Republic of Moldova for the current year includes the promotion of measures to ratify the Protocol.

The NCPDP, as the national supervisory authority for the personal data  processing, emphasizes the importance of the participation of  the Republic of Moldova in the plenary meetings of the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as the importance of the documents adopted in these meetings.

On 16 June 2023, the National Centre for Personal Data Protection organised a training course on personal data protection for employees of the National Agency of Road Transport (ANTA), at their request.

The aim of the training course was to increase ANTA employees’ awareness of the principles of personal data protection, as well as of ensuring the correct application of the legal provisions in this field, arising from their obligation to ensure the protection of the fundamental rights and freedoms of individuals with regard to the processing of personal data.

During the event important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection;

– Data Protection Officer issues;

– Data Protection Impact Assessment issues;

– Examination of requests for disclosure of personal data;

– Personal data protection requirements in the performance of duties;

– Correct procedure for accessing personal data through state information systems and keeping correct audit trails of such accesses;

– Ensuring the security and confidentiality of personal data processed, etc.

The training course was an interactive one, with participants asking the trainers many questions about the legal processing of personal data in the daily work of ANTA employees.

The event was attended by the representatives from the two key branches of the institution: the branch dealing with the one-stop-shop activity – issuing of permit documents and the branch dealing with road control activity

On 14 June 2023, the representatives of the National Centre for Personal Data Protection organized a training course for the employees of the Ministry of Internal Affairs, entitled: “Ensuring the protection of personal data in the activity of the Ministry of Internal Affairs”.

The aim of the course was to increase the perception of MIA’s employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection;

– The rights of personal data subjects;

– Processing of special categories of personal data;

– Principles and legal grounds for personal data processing;

– The legal modalities of personal data processing in the activity carried out by the MIA;

– Requirements for the protection of personal data in the performance of duties;

– MAI’s obligations as data controller in relation to the data subject;

– Aspects concerning the disclosure of information containing personal data, as well as the analysis carried out by the MIA regarding access to such data;

– The correct procedure for accessing personal data through the State Information Systems, as well as the correct audit trail of such accesses;

– Ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be an interactive one, with participants asking multiple questions, based on their work, to which they received documented answers with practical examples from the trainers.

During the event, moderated by representatives of the Directorate General for Surveillance and Compliance, about 50 representatives of the MIA were trained.

On June 9, 2023, the representatives of the National Center for Personal Data Protection organized a training course for the employees of the Family Doctors Center from Balti municipality, entitled: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them about the field of personal data protection.

The event covered important topics such as:

– Definition of personal health data;

– Processing of special categories of personal data;

– Legal grounds for processing personal data concerning health;

– Patients’ rights;

– The mandatory secrecy of personal data;

– Disclosure of personal health data;

– Data minimisation and storage limitation, etc.

The training course was moderated by representatives of the Prevention, Surveillance and Evidence Directorate and proved to be a useful and interactive one, with participants asking the trainers many questions about practical examples in the field of personal data protection.

The event was attended by about 50 representatives of the Family Doctors Center from Balti municipality.

The National Centre for Personal Data Protection (NCPDP), for information and enforcement purposes, informs about the fine of 300,000 euros imposed by the German Federal Data Protection Authority (DPA) on a bank for lack of transparency in an automated individual decision.

An automated decision is a decision made by an IT system based solely on algorithms and without human intervention. In this case, Regulation (EU) 2016/679 (GDPR) provides for special transparency obligations. Personal data must be processed in a way that is easy to understand for data subjects. Data subjects have the right to an explanation of the decision taken after a proper assessment.

In this case, however, the bank did not take this into account in its digital application for a credit card. Using an online form, the bank requested various data about the applicant’s income, occupation and personal details. Based on the requested information and additional data from external sources, the bank’s algorithm rejected the customer’s application without any specific justification. The algorithm is based on criteria and rules previously defined by the bank. As the customer had a good Credit Score and a high regular income, he doubted the automated rejection and complained to the DPA in Germany.

A bank is obliged to inform its customers of the main reasons for rejection when making an automated decision on a credit card application. This includes factual information on the database and the decision-making factors as well as the criteria for rejection.

As a result of the investigation, the German DPA found that the bank violated Articles 22(3), 5(1)(a) and 15(1)(h) of the GDPR. In imposing the fine, the bank’s high turnover, the intentional structure of the application and information request process were in particular taken into account.

The NCPDP, as the national supervisory authority for the personal data processing, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On 26 May 2023, the representatives of the National Centre for Personal Data Protection (NCPDP) participated as trainers in the training course entitled: “Processing of personal data in the educational sector”, organized for the General Directorate of Education Cahul.

The aim of the training course was to increase the awareness of employees in the education sector on the principles of personal data protection and on ensuring the correct application of the relevant legal provisions in their work.

During the event important topics were discussed, such as:

– General notions of personal data protection;

– Principles of personal data protection;

– Data Protection Officer (DPO) issues;

– Data Protection Impact Assessment issues;

– Ensuring security and confidentiality of personal data by employees of educational institutions;

– The active role of the teacher in informing students about the consequences of disclosing personal data;

– Installation and management of video surveillance systems in educational institutions;

– Storage, retention and disclosure of personal data;

– Electronic transmission of information containing personal data, etc.

The training course was an interactive one, with participants asking multiple questions to which they received answers/explanations in the field of personal data protection.

The course took place online, 85 representatives of the General Directorate of Education Cahul being trained.

The National Centre for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the fine of €1.2 billion, imposed following the binding dispute resolution decision of the European Data Protection Board (EDPB), on Meta Platforms Ireland Limited (Meta IE) for serious breach of the legal provisions, stipulated in Regulation (EU) 2016/679 (GDPR). This fine, which is the largest GDPR fine to date, was imposed for personal data transfers made by Meta IE to the US under standard contractual clauses from 16 July 2020.

In its binding decision of 13 April 2023, the EDPB ordered the Irish Data Protection Authority (DPA) to amend its draft decision, imposing a fine on Meta IE (formerly Facebook Ireland Limited). Given the seriousness of the breach, the EDPB found that the starting point for calculating the fine should be between 20% and 100% of the applicable legal maximum. The Irish DPA is also required to order Meta IE to bring its processing operations into compliance with Chapter V of the GDPR by ceasing unlawful processing, including storage, in the US of European users’ personal data transferred in breach of the legal provisions of the GDPR within 6 months of notification of its final decision.

The Irish DPA’s final decision incorporates the legal assessment expressed by the EDPB in its binding decision under Article 65(1)(a) of the GDPR after the Irish DPA, as lead supervisory authority, initiated a dispute resolution procedure regarding objections raised by several supervisory authorities concerned.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the personal data protection and to ensure that personal data processing operations comply with the legislation in force.

The National Centre for Personal Data Protection, for information purposes, announces the appointment of Ms Anu Talus as Chair of the European Data Protection Board (EDPB), replacing the current Chair, Andrea Jelinek. She was elected by 19 votes out of 27 in two ballots on 25 May at the 80th Plenary Session.

Anu Talus is Director of the Finnish Data Protection Authority, a position she will combine with that of Chair of the EDPB.

In accordance with Article 73 of Regulation (EU) 2016/679, the Council elects a Chair and two Vice-Chairs from among its members by an absolute majority and by secret ballot. Their term of office is for a period of five years and may be renewed once. The EDPB Chair supervises all tasks of the Board and ensures that they are carried out in a timely manner.

At the same time, Ms Irene Loizidou Nikolaidou (Commissioner of the Cyprus Data Protection Authority), was elected as the new EDPB Vice-Chair, while Vice-Chair Aleid Wolfsen remains in office, his term of office ending on 15 May 2024.

The EDPB is an independent European body that contributes to the consistent application of data protection rules across the European Union and promotes cooperation between EU data protection authorities (DPAs). The EDPB was established under Article 68 of Regulation (EU) 2016/679 and is supported in its work by the EDPB Secretariat. The Secretariat carries out its tasks as instructed by the Chair. It provides analytical, administrative and logistical support to the Council; organises all meetings of the Administrative Board and manages the IT platforms used by the EDPB. In addition, the Secretariat has a major role in providing legal analysis.