On May 17, the National Center for Personal Data Protection (NCPDP) organized the training course “Personal data protection and children’s safety in the online environment” for the public institution “Mircea Eliade” Theoretical High School from Chisinau, the target audience being 5th grade students. The event took place within the Personal Development class.

The aim of the information and awareness campaign is to provide high visibility on personal data protection and children’s safety in the online environment at local and national level by promoting empowerment and best practice intervention and support.

The topics covered in the training included: general notions on personal data; posting and correct use of pictures on social networks; creative, useful and safe use of the internet; risks of using the internet; aspects that can have negative consequences; attitudes and practices for sending pictures/videos online; communication on social networks, etc.

At the same time, the NCPDP’s trainers carried out interactive activities, there were discussions based on the information material presented, videos were shown and, at the end, students completed a crossword based on the material presented.

The event was organised at the initiative of the NCPDP, 39 students being trained.

It should be noted that the information and awareness-raising campaign for the school community was launched on 15 April 2022, and the NCPDP aims to continue this training format both in schools in the municipality of Chisinau and in the districts of the Republic of Moldova.

On 10-12 May 2023, the representatives of the National Centre for Personal Data Protection (NCPDP) participated in the 31st Spring Conference of the European Data Protection Authorities in Budapest, Hungary.

This year the event was hosted by the Hungarian Data Protection Authority. It is to mention that Hungary hosts this event for the third time.

During the working sessions, topical data protection issues were presented, such as:

– New technologies – assessing the social impact of the use of new technologies in different areas;

– Interaction between data protection and competition law;

– Court decisions: resolutions and amendments to the Rules of Procedure;

– Best practices/case studies in enforcement cooperation between EEA and non-EEA countries.

For the first time at a Spring Conference of the European Data Protection Authorities, an Open Day was organised. This practice gave the opportunity to several institutions, NGOs or other organisations that expressed interest in the topics covered during the event to participate online.

The event was attended by the representatives of Central and Eastern European Data Protection Authorities, the Council of Europe, the European Data Protection Board, the European Data Protection Supervisor, where they had the opportunity to exchange experience and best practices in the field of personal data protection, including the role of the Data Protection Officer within a public or private entity.

On 13 May 2023, the National Centre for Personal Data Protection (NCPDP) joined the initiative of the EU Delegation to the Republic of Moldova and participated in the inauguration event of the European Village, organised annually on the occasion of Europe Day.

This year’s edition was held under the slogan “European Moldova”, the event took place in the Great National Assembly Square in Chisinau.

Europe Day 2023 is about peace, solidarity and unity. Participants had the opportunity to interact with the representatives of public institutions, diplomatic missions of EU Member States accredited in Chisinau, to get acquainted with projects carried out with the support of the European Union, to participate in various educational, creative and interactive activities, to taste European cuisine and to participate in information sessions on current topics.

The representatives of the NCPDP, set up a stand with educational-informative materials and promotional fliers, and the general public was informed about the field of personal data protection. Amongst  the topics of interest both for adults and children, the following can be mentioned: the concept of personal data, the rights of data subjects, data security and confidentiality measures, principles of personal data protection, etc. Citizens were also informed about possible situations of non-compliant processing of personal data and were given practical guidelines and recommendations to be undertaken in such cases.

The European Village is traditionally organised by the EU Delegation in the Republic of Moldova, in partnership with public authorities and diplomatic missions accredited in our country, in order to annually celebrate peace and unity in Europe – Europe Day.

On 12 May 2023, the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection, entitled Ensuring the process of protection and processing of personal data, following the request received from the National Health Insurance Company (NHIC).

The training course aimed to increase the awareness of NHIC employees on the principles of personal data protection, as well as on ensuring the correct application of legal provisions in the field, in the activity they carry out.

• The following important topics were discussed during the event:
• Definition of concepts related to personal data protection;
• The legal way of processing personal data in the activity carried out by the NHIC;
• The requirements for the protection of personal data when exercising work tasks;
• Issues relating to the disclosure of information containing personal data and the analysis carried out by the data controller (NHIC) regarding access to such data;
• Data Protection Officer (DPO) issues;
• Data Protection Impact Assessment issues;
• Ensuring the security and confidentiality of personal data processed in automated filing systems managed by the NHIC;
• Rights of personal data subjects, etc.

The training course was attended by 39 representatives of the NHIC, both physically present and online.

Every year on 9 May is celebrated Europe Day. It is a celebration of peace and unity in Europe. The date marks the historic day on which the Schuman declaration was made, this year marking 73 years since it was signed. To mark Europe Day, the EU institutions open their doors to the general public in Brussels and Strasbourg in early of May. Local EU offices in Europe and around the world organise a variety of activities and events for people of all ages.

The National Centre for Personal Data Protection (NCPDP), together with other institutions from the Republic of Moldova and the EU, participates every year in the celebration of Europe Day. Throughout the years of its activity, the NCPDP has followed the European vector, has closely cooperated with EU institutions, as well as benefited from their support.

Only during 2023, the NCPDP, in collaboration with the Technical Assistance and Information Exchange Instrument (TAIEX), organised the TAIEX Expert Mission “Processing of Personal Data for Statistical Purposes” on 29-30 March for representatives of public institutions from the National Bureau of Statistics; the General Inspectorate of Border Police; the Public Services Agency; the e-Government Agency; the Ministry of the Interior; the Ministry of Health; the State Chancellery; the State Tax Inspectorate and the Customs Service. At the same time, the national conference “Data Protection Impact Assessment and the Role of the Data Protection Officer” will be organised on 10 July, and in the second half of this year – the Study Visit “Reconciling the Right of Access to Information and Personal Data Protection”. The above mentioned events, organised with the support of the TAIEX team, serve as an opportunity to exchange experience and best practices with EU experts on raising awareness and informing the public sector on the area of personal data protection.

At the same time, international cooperation continues to be the promoter of the NCPDP’s institutional development objectives. Successes in this respect have been achieved thanks to the exchange of experience, knowledge, best practices with data protection authorities, the support provided by EU experts, the uptake and application in practice of international personal data protection standards. Cooperation, both at European and international level, is a strategic issue which requires involvement in all initiatives under development. In this context, the plenary meetings of the European Data Protection Board and the meetings of the Bureau of the Convention 108 Committee are regularly attended.

The NCPDP believes that solidarity is the pillar on which the functioning of the European Union is based, and Europe Day marks the values on which it was founded. Europe Day is about the future of every European citizen, while the EU represents a democratic model of values and principles that have been and remain fundamental to their prosperity.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 125 000 euros applied by the French Supervisory Authority (CNIL) to CITYSCOOT for the disproportionately infringement on the privacy of its customers by geolocating them almost permanently.

CNIL carried out investigations on the company CITYSCOOT, which rents scooters for a short period. The investigations focused in particular on the data collected as well as on the information and consent obtained from users before processing technical information on their mobile phone or computer.

Following the investigations, CNIL found several violations, such as:

·        Failure to comply with the obligation to ensure data minimisation (Article 5.1.c of the GDPR);

·        Failure to comply with the obligation to provide a contractual framework for the processing operations carried out by a processor (Article 28.3 of the GDPR);

·        Failure to inform the user and obtain his or her consent before writing and reading information on his or her personal device (Article 82 of the French Data Protection Act).

On the basis of these findings, CNIL imposed a fine in the amout of 125 000 euros to CITYSCOOT, which was made public. This decision was taken in cooperation with the Spanish and Italian data protection authorities, as CITYSCOOT also offers these services in these countries. The amount of the penalty takes into account the company’s turnover, the number of users (about 250 000 in 2022) and the seriousness of the breaches identified, but also the measures taken by the company to remedy them during the procedure.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

On 29-30 March, the National Centre for Personal Data Protection (NCPDP) in collaboration with TAIEX project experts is organising the TAIEX Expert Mission “Personal data processing for statistical purposes” in online format.

The objective of the Expert Mission is to present the European legal and operational best practices on the mechanisms of processing and storage of personal data for statistical purposes by the National Bureau of Statistics (NBS), data exchange between the institutions and the NBS, as well as the regulations related to the security of these data.

The event takes place over two days:

·        On the first day there will be discussions between EU experts, representatives of the NCPDP and representatives of the NBS in order to identify issues related to personal data processing for statistical purposes, ensuring guarantees on the security of personal data and their non-excessiveness for the production of official statistics, while respecting the rights of data subjects.

·        On the second day, a training course will be held for representatives of public institutions from the National Bureau of Statistics; General Inspectorate of Border Police; Public Services Agency; E-Governance Agency; Ministry of Internal Affairs; Ministry of Health; State Chancellery; State Tax Service; Customs Service

The Expert Mission will be moderated by data protection experts from România and Greece. Among the topics to be addressed by the experts are: general conditions for the processing of personal data for statistical purposes; further processing of personal data for statistical purposes; access of the NBS to information systems where personal data are processed; regulations laying down safeguards for the protection of personal data processed for statistical purposes; longer storage of personal data for statistical purposes; conditions for depersonalisation/pseudonymisation of personal data; international legal standards in both statistical activities and personal data protection; ensuring security and confidentiality when processing personal data for statistical purposes; etc.

The event is attended by 24 representatives of public sector.

The Expert Mission is organised and funded by the Technical Assistance and Information Exchange instrument of the European Commission (TAIEX).

On 6 March 2023, the National Centre for Personal Data Protection (NCPDP) jointly with the General Police Inspectorate (GPI), organized a training course on personal data protection for employees of the National Investigation Inspectorate (NII).

The aim of the training course was to increase NII employees’ awareness on the principles of personal data protection, as well as to ensure the correct application of the relevant legal provisions in their work.

In the framework of the event, the following important topics were discussed:

– Definition of personal data concepts;

– The legal way of personal data processing in the activity carried out by NII;

– The requirements for the personal data protection in carrying out their duties and responsibilities;

– Legal aspects of personal data processing through video surveillance systems;

–  Aspects regarding disclosure of criminal cases data handled in their basic activity;

– Correct procedure for accessing personal data via State Information Systems and correct evidence of audit records on such accesses;

– Rights of personal data subjects, etc.

About 60 NII representatives attended the training course.

 Many questions were given to the trainers and all of them were answered/explained to the participants regarding aspects of personal data protection.

The training course is part of the schedule of trainings in the GPI subdivisions for the year 2023, approved and signed by the heads of the NCPDP and GPI on 25 January this year.

The National Centre for Personal Data Protection (NCPDP) organised on 9 February a debate with students and master students from the Moldova State University (USM) in the field of personal data protection.

The theme of the debate was: “Current challenges in the field of personal data protection” which covered the following topics:

   NCPDP – Data Protection Authority;

  What is personal data;

  Principles of personal data protection;

  Rights of personal data subjects and how to apply them;

  Elementary application measures for personal data security and privacy;

   National and international practice concerning the cases examined in the field of personal data protection.

The aim of the debate was to make students and master students understand the challenges they are facing in the current period related to the field of personal data protection.

The debate was attended by about 35 students from the second, third and fourth year of studies, as well as master students of the Law Faculty of USM. All those present in the hall showed interest in the topics discussed and asked questions to the representative of the NCPDP.

This activity is part of the action plan approved by the NCPDP in the context of Data Protection Day, which is marked annually on 28 January in the European community and beyond.

On February 9, 2023, in Strasbourg, H.E Ambassador Daniela Cujbă, Permanent Representative of the Republic of Moldova to the Council of Europe, signed the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No.223), which was adopted by the Committee of Ministers of the Council of Europe on 18 May 2018 and opened for signature on 10 October 2018.

The amending Protocol modernises and improves the Convention (ETS No 108), taking into account the new challenges in ensuring the protection of individuals with regard to the processing of personal data that have emerged since the adoption of Convention 108 in 1981.

The Protocol provides a robust and flexible multilateral legal framework to facilitate cross-border data flows while providing effective safeguards when personal data are used. The Treaty addresses the challenges to privacy arising from the use of new information and communication technologies and strengthens the mechanism of the Convention to ensure its effective implementation.

The Republic of Moldova is the 45th state to sign the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. So far, the Protocol has been ratified by 21 states.