On 16 April 2024, the representatives of the National Centre for Personal Data Protection organized a training course for the representatives of the Single National Emergency Calls Service 112 (112 Service) in the field of personal data protection.

The aim of the course was to increase the awareness of the employees of the 112 Service on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Principles and legal grounds for processing personal data;

• The legal modalities of processing of personal data in the activity carried out by the 112 Service;

• Requirements for the protection of personal data in the exercise of the tasks of the service;

• Ensuring the security and confidentiality of personal data processed;

• Issues relating to the appointment of the Data Protection Officer (DPO);

• Data Protection Impact Assessment (DPIA) issues and the steps to carry out a DPIA, etc.

The training course proved to be an interactive one, and the topics related to access to information of public interest in the light of the legislation on the protection of personal data, the fairness of their disclosure in relation to the proportionality criterion of limiting access to information of public interest, as well as the time limit for the retention/storage and use of personal data at the end of processing operations, were of great interest to the course representatives.

During the event, moderated by representatives of the NCPDP, about 20 representatives of the 112 Service were trained.

On 10 April 2024, the National Centre for Personal Data Protection (NCPDP) organised a training course on personal data protection for employees of the General Inspectorate of Border Police (IGPF).

The aim of the training course was to increase the awareness of the employees of the General Inspectorate of the Border Police on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in this field in their work.

During the event important topics were discussed, such as: definition of general notions related to the field of personal data protection; principles and legal grounds for personal data  processing; rights of personal data subjects; processing of special categories of personal data; requirements for the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of personal data processed; issues related to the appointment of the Data Protection Officer (DPO); issues related to the Data Protection Impact Assessment (DPIA); legal issues related to the processing of personal data through video surveillance systems, etc.

At the same time, we would like to mention that this was the last training course organized according to the IGPF training plan for the year 2024, approved and signed by the NCPDP and IGPF heads on February 21. Thus, training courses were organized for the following subdivisions:

• 06 March – IGPF Northern Regional Directorate (2 training courses);

• 13 March – IGPF Southern Regional Directorate (2 training courses);

• 20 March – IGPF Eastern Regional Directorate (2 training courses);

• 27 March – IGPF West Regional Directorate (2 training courses);

• April 3 – Border Police Sector “Chisinau International Airport” of the IGPF;

• 10 April – General Inspectorate of Border Police.

In this context, about 370 representatives from IGPF subdivisions were trained.

During the event, the NCPDP and IGPF heads mentioned the importance of promoting and ensuring the protection of the rights of individuals with regard to the processing of personal data, the need for joint efforts to implement these values, as well as the importance of the correct application of legal provisions in the field in the work carried out, expressing maximum openness for future fruitful collaborations.

On March 22, 2024, representatives of the National Center for Personal Data Protection (CNPDCP) organized a training course for the employees of the Agency for Intervention and Payments for Agriculture (AIPA), entitled: “General aspects of personal data protection”.

The aim of the course was to increase AIPA employees’ awareness of the principles of personal data protection, as well as to ensure the correct implementation of the legal provisions in the field, in their work.

During the event important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection;

– The rights of personal data subjects;

– Processing of special categories of personal data;

– Principles and legal grounds for processing personal data;

– The legal modalities of personal data processing in the activity carried out by AIPA;

– Requirements for the protection of personal data in the performance of duties;

– Ensuring the security and confidentiality of personal data processed;

– Issues relating to the appointment of the Data Protection Officer (DPO);

– Data Protection Impact Assessment (DPIA) issues, etc.

The training course proved to be an interactive one, and aspects related to access to information of public interest though the lens of personal data protection legislation, the correct procedure for accessing personal data through the State Information Systems, as well as keeping correct records of the audit of these accesses, were of great interest to the course participants.

About 40 AIPA representatives were trained during the event, moderated by experts in the field of personal data protection from the NCPDP.

On 26 March 2024, the National Centre for Personal Data Protection (NCPDP) organised a training course on personal data protection for representatives of the Ministry of Economic Development and Digitisation (MEDD), at their request.

The training course aimed to familiarize MEDD officials with the aspects of personal data protection in the public service, the regulation of processing procedures, as well as the personal data confidentiality and security regime in accordance with the legislation in force.

During the event important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• Principles and legal grounds for personal data processing;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Requirements for the protection of personal data in the exercise of official duties;

• Ensuring the security and confidentiality of personal data processed;

• Issues relating to the appointment of the Data Protection Officer (DPO);

• Data Protection Impact Assessment (DPIA) issues and the steps involved in conducting a DPIA, etc.

The training course proved to be an interactive one, participants asking multiple questions, based on their work, and receiving documented answers with practical examples from the trainers.

About 20 representatives of the Ministry of Economic Development and Digitisation were trained during the event, moderated by experts in the field of personal data protection from the NCPDP.

On 27 March 2024, the National Centre for Personal Data Protection (NCPDP) organised two training courses in the field of personal data protection for employees of the Western Regional Directorate of the General Inspectorate of Border Police (IGPF).

The aim of the training courses was to raise the awareness of the employees of the Western Regional Directorate of the IGPF on the principles of personal data protection, as well as on ensuring the correct application of the relevant legal provisions in their work.

During the events important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• Principles and legal grounds for  personal data processing;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Requirements for the protection of personal data in the exercise of official duties;

• Ensuring the security and confidentiality of personal data processed;

• Issues relating to the appointment of the Data Protection Officer (DPO);

• Data Protection Impact Assessment (DPIA) issues, etc.

The training courses proved to be interactive and useful, and the issues of the correct procedure for accessing personal data through state information systems, the legal aspects of  personal data processing through video surveillance systems, as well as what the consequences of non-compliant/illegal processing of personal data may be, were of great interest to the course participants.

Around 60 representatives of the Western Regional Directorate of the IGPF were trained during the events.

The training courses are part of the IGPF training plan for the year 2024, approved and signed by the heads of the NCPDP and IGPF on 21 February this year.

On 3 April 2024, the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the representatives of the Border Police Sector “Chisinau International Airport” of the General Inspectorate of Border Police (IGPF).

The aim of the training course was to increase the perception of the employees of the Border Police Section “Chisinau International Airport” of the IGPF on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the training course important topics were discussed, such as:

• Definition of general notions related to the field of personal data protection;

• Principles and legal grounds for processing personal data;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Requirements for the protection of personal data in the exercise of official duties;

• Ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be interactive and useful, with participants asking multiple questions, based on their work, and receiving documented answers with practical examples from the trainers. At the same time, the aspects of the correct procedure for accessing personal data through state information systems, the examination of requests for disclosure of personal data, as well as the legal aspects of personal data processing through video surveillance systems were of great interest to the course participants.

About 40 representatives of the Border Police Section “Chisinau International Airport” of the IGPF were trained during the event.

The training course is part of the IGPF training plan for 2024, approved and signed by the heads of the NCPDP and IGPF on February 21, 2024.

On April 4, 2024 the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the representatives of the territorial offices of State Chancellery, at their request.

The training course aimed at familiarizing the officials of the territorial offices of the State Chancellery with the aspects of personal data protection in the public service, the regulation of processing procedures, as well as the regime of confidentiality and security of personal data in accordance with the legislation in force.

During the event, important topics were discussed, such as: definition of general concepts related to the field of personal data protection; principles and legal grounds for personal data processing; rights of personal data subjects; processing of special categories of personal data; requirements for the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of personal data processed; issues related to the appointment of the Data Protection Officer (DPO), as well as his/her obligations and tasks, etc.

The training course proved to be interactive and the topics related to access to information of public interest in the light of personal data protection legislation, issues related to online registration and transmission of local council meetings, as well as the obligation to anonymise/de-identify excessive personal data when publishing legal acts, were of great interest to the course participants.

The event was moderated by experts in the field of personal data protection from the NCPDP and trained about 55 representatives of the territorial offices of the State Chancellery.

The National Centre for Personal Data Protection (NCPDP), for information purposes, communicates the fact that, following its investigation, the European Data Protection Supervisor (EDPS) has found that the European Commission (EC) has infringed several provisions of Regulation (EU) 2018/1725, the EU Data Protection Act for EU institutions, bodies, offices and agencies, including those on transfers of personal data outside the EU/European Economic Area (EEA), imposing corrective measures. At the same time, the EC failed to provide adequate safeguards to ensure that personal data transferred outside the EU/EEA benefit from an adequate level of protection equivalent to that guaranteed in the EU/EEA. In addition, in its contract with Microsoft, the EC did not sufficiently specify what types of personal data are to be collected and for what purposes when using Microsoft 365. The EC’s breaches as data controller also relate to data processing, including transfers of personal data, carried out on its behalf.

The EDPS has therefore decided to order the EC, since 9 December 2024, to suspend all data flows resulting from the use of Microsoft 365 to Microsoft and its affiliates and subcontractors located in non-EU/EEA countries that are not subject to a adequacy decision and to bring its processing operations resulting from its use of Microsoft 365 into compliance with Regulation (EU) 2018/1725. The EC must demonstrate compliance with both provisions by 9 December 2024.

The EDPS considers that the corrective measures it imposes are appropriate, necessary and proportionate, taking into account the seriousness and duration of the breaches found. Many of the breaches found relate to all processing operations carried out by or on behalf of the EC when using Microsoft 365 and impact on a large number of individuals. The EDPS also takes into account the need not to compromise the EC’s ability to perform its public interest tasks or to exercise its duties as an official authority vested in it, as well as the need to give it adequate time to implement the envisaged suspension of relevant data flows and to bring data processing into compliance with Regulation (EU) 2018/1725.

The NCCDP, as the national supervisory authority for personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On 15 March 2024, the National Centre for Personal Data Protection (NCPDP) organized a training course on personal data protection for the representatives of Riscani District Prosecutor’s Office, at their request.

The training course aimed at familiarizing the officials of Riscani District Prosecutor’s Office with the aspects of personal data protection in the public service, the regulation of processing procedures, as well as the confidentiality and security regime of personal data in accordance with the legislation in force.

During the event important topics were discussed, such as: 

Definition of general notions related to the field of personal data protection; 

Principles and legal grounds for processing personal data;

The rights of personal data subjects; 

Processing of special categories of personal data; 

Requirements for the protection of personal data in the exercise of official duties; 

Legal aspects of the processing of personal data by means of video surveillance systems; 

Ensuring the security and confidentiality of personal data processed;

Issues relating to the appointment of the Data Protection Officer (DPO); 

Data Protection Impact Assessment (DPIA) issues, etc.

The training course proved to be interactive and the topics related to the examination of requests for disclosure of personal data, as well as aspects related to the professional qualities that a DPO should possess and the position of DPO within the entity they represent, were of great interest to the course participants.

During the event, moderated by experts in the field of personal data protection from NCPDP, about 20 representatives of the Râșcani District Prosecutor’s Office were trained.

The National Centre for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine in the amount of EUR 24,000 imposed by the Polish Data Protection Authority (SA) on an insurance company for violation of Article 35 (Data Protection Impact Assessment) and 83 (General conditions for imposing administrative fines) of the GDPR.

The Polish SA has been informed that an unauthorised recipient has received a document confirming the granting of compensation in an email attachment. The e-mail from the insurance company contained personal data such as: name, surname, postal address, model and registration number of the car, policy number and the amount of compensation granted. The unauthorised recipient informed the insurance company that he had received an e-mail with an attachment containing another person’s personal data, but received no reply.

Following the investigations, the Polish SA decided to impose an administrative fine under Article 83(2)(a) of the GDPR, taking into account aggravating circumstances such as: the long duration of the breach, the intentional nature of the finding of a breach of data protection regulations in other ongoing proceedings against the company, the unsatisfactory level of cooperation with the Supervisory Authority.

At the same time, the Polish SA pointed out that the company is subject to specific obligations imposed by Article 35(1) of the Law of 11 September 2015 on insurance and reinsurance activities, according to which the insurance company and its employees, as well as persons and entities through which it carries out insurance operations, are obliged to keep the individual insurance contract secret. 

The NCPDP, as the national supervisory authority for personal data processing, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for personal data protection and to ensure that personal data processing operations comply with the legislation in force.