On 1 February 2023, the National Centre for Personal Data Protection (NCPDP) in collaboration with the General Police Inspectorate (IGP) started the training cycle in the context of signing the Training Plan agreed by the Parties on 25 January this year.

In this context, about 60 employees from the Anenii Noi Police Inspectorate were trained.

The training course aimed to increase the police body’s awareness of personal data protection principles and to ensure the correct implementation/application of data protection legal provisions in their work.

Several important topics were covered in the training course, including:

–    The legal way of personal data processing in the work carried out by the IGP;

–    Obligations of the police body as data controller in relation to the data subject;

–   The requirements for personal data protection in the exercise of official duties;

–    Legal aspects of personal data processing through video surveillance systems;

–   Correct procedure for accessing personal data through State Information Systems and keeping correct audit records of such accesses;

–    Personal data security and confidentiality measures, etc.

In addition to what was presented by the representative of the NCPDP, the representative of the IGP pointed out certain aspects of police activity provided for in the internal regulations of IGP.

The training course proved to be quite interactive, as the participants asked the trainers many questions, to which they received answers.

On 31 January 2023, the National Centre for Personal Data Protection (NCPDP) trained representatives of libraries in the mun. Chișinău and other districts of the Republic in the field of personal data protection.

The request for organizing the training course came from the Technical-Scientific Republican Library of the National Institute of Economic Research in mun. Chișinău, in the context of the “Data Protection Day” on 28 January.

The theme of the training course was “Personal data protection measures in the libraries”. The aim of the course was to increase the perception of library employees with the field of personal data protection.

The training covered the following topics:

– General notions in the field of personal data protection;

– Legal grounds for personal data processing;

– Processing of special categories of personal data;

– Personal data security and confidentiality measures.

The training course was organised in a hybrid format and was attended by about 80 participants.

At the end of the course, the trainers provided answers to all questions given by the participants.

On 28 January 2023, the National Center for Personal Data Protection (the Center) held the meeting of the Consultative Council to the National Center for Personal Data Protection.

The meeting was opened and chaired by Ms Victoria MUNTEAN, Director of the Center, and President of the Consultative Council.

Within the event, the results of the Center’s work and the main achievements in terms of personal data protection in 2022 and the objectives for the next period were briefly presented.

At the same time, the protection of personal data in the context of the exercise of the right to freedom of expression and the right of access to information by media representatives was discussed, followed by mention of the pressing problems faced by the institution and proposals for optimizing and improving the work of the Center.

The Council meeting was an interactive one, the members coming up with proposals and suggestions to improve the situation.

In this context, the members of the Council highlighted that all areas of activity, such as justice, medical, banking, social protection, economic, etc. interfere with the field of personal data protection and, in this respect, the need to amend the legislation in this field, in line with the new EU standards, is very important.

At the end, the members of the Consultative Council appreciated the efforts of the Center in terms of the results achieved during the period of activity and outlined the need to continue working together at institutional level in order to develop effective mechanisms for the protection of personal data in the Republic of Moldova.

Every year on 28 January, the European community celebrates “Data Protection Day”. This year it is celebrated the 42nd anniversary of Convention No 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, adopted in Strasbourg on 28 January 1981, and the 17th anniversary of this Day.

The purpose of Convention No 108 is to secure in the territory of each State Party for every individual, whatever his nationality or residence, respect for his rights and fundamental freedoms, and in particular his right to privacy, with regard to automatic processing of personal data re

The Republic of Moldova signed Convention No 108 on 4 May 1998 and ratified it by Parliament Decision No 483-XIV of 2 July 1999.

On 26 April 2006, the Committee of Ministers of the Council of Europe decided to launch a Data Protection Day, to be celebrated every year on 28 January.

In this regard, Council of Europe member states and not only, organize every year various activities and public events to mark the day. The Republic of Moldova celebrates this event together with all European countries.

Although the field of personal data protection is a relatively new one for the Moldovan society, nevertheless, we have managed in the last decade to make a lot of progress in ensuring respect for the right to privacy, as well as to align the  national legislation with European standards in the field of personal data protection.

Our role as the National Personal Data Protection Authority becomes more and more important and the annual celebration of this day is an opportunity to bring to the attention of the public the importance of respecting the principles of personal data protection, the right to privacy with regard to the protection of personal data.

Every year on 28 January, the European community celebrates “Data Protection Day”. In this regard, the National Centre for Personal Data Protection (NCPDP) has organised an information street activity on 27 January 2023.

A group of NCPDP’s employees went nearby the Arc of Triumph in mun. Chisinau, where they distributed information materials to passers-by, informing them about “Data Protection Day”, the concept of personal data, the rights of data subjects, security and confidentiality measures when processing data. At the same time, they were informed about the possible situations in which personal data are not processed in accordance with the provisions of national legislation in this field, providing them with practical guidance and recommendations that should be undertaken in such situations.

We remind you that the street activity was organized in order to raise society’s awareness in the field of personal data protection, in accordance with the Action Plan approved by the NCPDP in the context of Data Protection Day celebration.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of 8 million euros applied by the French Data Protection Authority (CNIL) to APPLE DISTRIBUTION INTERNATIONAL for the illegally processing of personal data.

The CNIL carried out several investigations in 2021 and 2022, following a complaint concerning the ad personalization in the App Store, in order to verify compliance with the applicable regulations. The CNIL services found that under the old version 14.6 of the operating system of the iPhone, when a user visited the App Store, identifiers used for several purposes, including personalization of ads on the App Store, were by default automatically read on the terminal without obtaining consent of the subject concerned.

Following the investigations, CNIL found a breach of Article 82 of the French Data Protection Act and imposed a fine of 8 million euros on APPLE DISTRIBUTION INTERNATIONAL. The amount of this fine was established based on the analysis of the following criteria: by the scope of the processing limited to the Apple Store, the number of people concerned in France, the profits the company made from advertising revenues indirectly generated from data collected by these identifiers as well as the fact that, in the meantime, the company has reached compliance/adjusted such processing of personal data.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about administrative fine in the amount of 230 000 euros applied by the Finnish Data Protection Authority (SA) to Viking Line for unlawful processing of employees’ health data.

The Finnish SA investigated Viking Line activities on the basis of a complaint. A former employee of Viking Line informed the Finnish SA that they had not received all their personal data being stored in the company’s systems despite their request. According to the employee, Viking Line had been keeping their health data in an HR system for 20 years. Furthermore, some diagnosis information stored was inaccurate.

Following the investigations, it was found that saving diagnosis information in connection with other employment-related data is against the law. In addition, health data should also have been erased immediately when its storage was no longer necessary. At the same time, Viking Line had not informed its employees appropriately of the processing of their personal data.

In this context, an administrative fine of 230 000 euros was imposed on Viking Line for several violations of data protection legislation. At the same time, the Finnish SA ordered the company to correct its practices and inform its employees of the processing of their personal data as required by the GDPR.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 5 million euros applied by the French Data Protection Authority (CNIL) to social network TIKTOK for the illegally processing of personal data.

Between May 2020 and June 2022, the CNIL carried out several online investigations on the “tiktok.com” website in an unlogged session, and not on the mobile application. Following the investigations, it was found that although the companies TIKTOK UK and TIKTOK IRELAND did offer a button allowing immediate acceptance of cookies, they did not put in place an equivalent solution to allow the Internet user to refuse their deposit as easily.

On the basis of the findings, the CNIL concluded that TIKTOK INFORMATION TECHNOLOGIES UK LIMITED (TIKTOK UK) and TIKTOK TECHNOLOGY LIMITED (TIKTOK IRELAND) had failed to comply with the obligations set out in Article 82 of the French Data Protection Act, this process infringed the freedom of consent of Internet users and users were not informed in a sufficiently precise manner of the purposes of the cookies, either on the first-level information banner or in the context of the choice interface accessible after clicking on a link in the banner.

In this context, the CNIL applied a fine of 5 million euros to the social network TIKTOK. The amount of this fine was decided on the basis of the breaches identified, the number of people concerned – including minors – and the numerous previous communications from the CNIL on the fact that it must be as simple to refuse cookies as to accept them.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about total fine in the amount of 390 million euros applied by the Irish Data Protection Authority (SA) to social networks Facebook and Instagram for the violation of the legal provisions stipulated by GDPR.

Following the EDPB’s binding dispute resolution decisions of 5 December 2022, the Irish SA, has adopted its decisions regarding Facebook and Instagram (Meta Platforms Ireland Limited, ‘Meta IE’). These decisions are the result of complaint-based inquiries into Facebook’s and Instagram’s activities in particular concerning the lawfulness and transparency of processing for behavioural advertising. Meta IE was fined with 210 million euros in the Facebook decision and 180 million euros in the Instagram decision by the Irish SA.

These binding decisions were adopted on the basis of Art. 65(1)(a) GDPR, after the Irish SA had triggered two dispute resolution procedures concerning the objections raised by concerned supervisory authorities from ten countries in each case. Among others, the supervisory authorities issued objections concerning the legal basis for processing (Art. 6 GDPR), data protection principles (Art. 5 GDPR), and the use of corrective measures including fines.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Centre for Personal Data Protection, for information purposes, communicates that on December, 22 this year, the President of the Republic of Moldova, Maia SANDU, signed the Decree approving the signing of the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223).

The Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data provides a multilateral, robust and flexible legal framework to facilitate cross-border data flows and effective safeguards on the use of personal data. This instrument was opened for signature by the Council of Europe (CoE) on October 10, 2018 and up to now, has been signed by 44 states, 5 of which are not members of the CoE (Argentina, Tunisia, Mauritius, Uruguay and the Russian Federation) and ratified by 20 states.

The Protocol is a multilateral treaty drawn up under the auspices of the CoE which, according to Article 36, is open for signature by States Parties to Convention 108.

The purpose of this Convention is to protect every individual, whatever his or her nationality or residence, with regard to the processing of their personal data, thereby contributing to respect for his or her human rights and fundamental freedoms, and in particular the right to privacy.

The Protocol itself provides for a number of innovations, such as:

–    Stricter proportionality requirements, data minimisation principles and lawfulness of processing;

–   Expansion of the types of sensitive data, which will now include genetic and biometric data, trade union membership and ethnic origin;

–   Obligation to notify data breaches;

–   Greater transparency of data processing;

–   New rights of individuals in a decision-making context, which are particularly relevant in relation to the development of artificial intelligence;

–   Increased accountability of data controllers;

–   Requirement to apply the principle of ‘privacy by design’

–   Application of data protection principles to all processing activities;

–   The regime for cross-border flows of personal data;

–   Strengthened powers and independence of data protection authorities and improved legal basis for international cooperation.

The Decree on the signing of the Protocol entered into force on 23 December this year and was published in the Official Gazette of the Republic of Moldova No. 428-430 Article 790.