From 18 to 22 September 2023, the  representatives of the National Centre for Personal Data Protection participated in the “High level event on data protection” organised by OECD-SIGMA and the Regional Fund for the Eastern Partnership (GIZ) in close cooperation with the European Data Protection Supervisor and various EU institutions (DGJUST, DGNEAR and the European Parliament) in Brussels, Belgium.

The aim of the event was to enable networking and exchange of experience between personal data protection institutions in the Eastern Partnership region and the Western Balkans region, as well as to strengthen relations with EU institutions responsible for data protection.

During the working sessions, actual issues in data protection were addressed, such as:

• The necessity of personal data protection. Challenges and opportunities for the Western Balkans and Eastern Partnership region;
• Work of the Policy and Consultation Unit including a focus on recent EU legislative developments / Digital rulebook;
• Work of the Supervision and Enforcement Unit, investigation methodology, Data Protection Impact Assessment;
• Work of the Technology and Privacy Unit, key initiatives such as Tech Sonar, Website Evidence collector, EU Voice / EU Video, nextCloud, etc;
• Raising awareness and informing the general public on data protection challenges and issues, raising awareness and creating links between digital transformation and data protection;
• Challenges and needs for personal data protection in the digital era.

Representatives from 11 countries of the Eastern Partnership and Western Balkans regions such as Albania, Armenia, Azerbaijan, Bosnia and Herzegovina, Georgia, Kosovo, Montenegro, North Macedonia, Moldova, Serbia and Ukraine participated in the event.

Based on the multiple recent cases in the media, as well as from the urgent need to protect the confidentiality of the personal data of natural persons, the National Center for Personal Data Protection (NCPDP) advises the following recommendations and warnings for data subjects:

The NCPDP urges data subjects to exercise the utmost caution when disclosing, transmitting, disseminating personal data concerning them.

It should be remembered that identity documents (such as identity cards, passports), civil status certificates, pensioners’ cards, bank cards, etc. contain lots of personal data which require effective protection by the holder.

Thus, giving/transmitting copies of these documents, as well as writing personal data in various lists/documents by the data subject for purposes other than those expressly provided for by law, may result in their unlawful use for purposes contrary to those originally intended, and against the data subject. Likewise, the personal data subject could lose control over his/her personal data.

If you are asked to provide your identity documents and/or to provide copies of these documents, as well as to provide personal data such as: your name, surname, IDNP, home address, bank card details, income, pension amount, etc. under different pretexts by third parties, you have to make sure about the legality of the collection of personal data and the subsequent use of these data.

However, according to the provisions of Law 133/2011 on personal data protection, the personal data that are the subject of processing must be: processed fairly and lawfully; collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed.

At the same time, the NCPDP points out that, in the case of the voluntary provision/transmission of personal data, recorded on various documents or by inclusion in some lists/documents, the collection of such personal data is based on/determines the existence of the consent of the personal data subject (Art. 5 para. (1) of Law 133/2011), even if the subsequent use of such data is proven to be carried out for other purposes/to the detriment of the data subject concerned.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of every citizen to ensure the protection of personal data, and the security and confidentiality of such data must be a priority.

On September 13th 2023, the National Centre for Personal Data Protection organised a training course on personal data protection for internal auditors in public authorities, at the request of the Ministry of Finance (MF). The MF jointly with central public authorities carries out horizontal internal audit missions, the topic of common interest identified for 2023 being “Assessment of personal data processing in public authorities“.

The aim of the training course was to increase the visibility and publicise the role of internal audit in adding value and improving the work of the entity, including risk management, control and governance processes, through the lens of personal data protection legislation.

During the event, important topics were discussed, such as: definition of general notions related to the field of personal data protection, rights of personal data subjects, processing of special categories of personal data, personal data protection requirements in the exercise of official duties, ensuring security and confidentiality of personal data processed, Data Protection Officer (DPO) issues; Data Protection Impact Assessment issues, etc.

The training course was interactive, trainers providing methodological and advisory support to the participants in carrying out the horizontal audit mission. At the same time, multiple practical examples were presented in order to increase the perception of internal auditors on the principles of personal data protection.

The event was attended by about 50 internal auditors from 30 public authorities.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of 70,000 euro imposed by the Romanian National Supervisory Authority for the Processing of Personal Data (ANSPDCP) on UiPath SRL for violation of the provisions of Articles 25 and 32 of the General Data Protection Regulation (GDPR).

The investigation was started as a result of the transmission by the controller of personal data breach notification under the GDPR.

Thus, UiPath SRL notified a violation of the confidentiality of personal data, consisting in the publication of the personal data of a significant number of users of the Academy Platform on a website accessible at a URL address.

During the investigation, the ANSPDCP found that UiPath SRL did not implement adequate technical and organisational measures to ensure that, by default, personal data cannot be accessed, without the intervention of a person, or an unlimited number of people, including the ability to ensure the ongoing confidentiality and resilience of processing systems and services, as well as a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing.

This fact led to the unauthorised disclosure and access to personal data (user name and surname, the unique identifier of each user, e-mail address, the name of the company where the user is employed, the country and details of the level of knowledge obtained in within the UiPath ACADEMY courses) of about 600,000 users of the Academy Platform belonging to the controller UiPath, for a period of about 10 days.

ANSPDCP considered that this violation of the processing of personal data is likely to bring physical, material or moral harm to the data subjects, such as the loss of control over their personal data or the loss of data confidentiality personal.

Following the investigation, ANSPDCP informed the other supervisory authorities involved, following Article 60 of Regulation (EU) 2016/679, regarding the conclusions resulting from the investigations carried out in this case with cross-border impact and, as well as, the proposed measures.

ANSPDCP considered that UiPath SRL carried out cross-border processing, and that the provisions of Article 60 of Regulation (EU) 679/2016, as well as those of Article 16 (3), (5), (6) and (7) of Law no. 102/2005, republished, which provides for the application of sanctions/corrective measures by decision of the president of ANSPDCP, were applicable.

In this situation, the controller UiPath SRL was sanctioned with a fine of 346,598 lei, the equivalent of 70,000 EURO.

At the same time, pursuant to Article 58 (2) d) of Regulation (EU) 2016/679, the Supervisory Authority ordered the corrective measure against the controller to implement a procedure at regular time intervals, regarding the regular testing, assessing and evaluating the effectiveness of the adopted measures, taking into account the risk presented by the processing, in order to ensure an appropriate level of security and to avoid similar security incidents in the future.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On the 5-th of September 2023, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for employees of the Sangerei Police Inspectorate (PI) of the General Inspectorate of Police.

The purpose of the training course was to increase the perception of Sangerei PI employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event, important topics were discussed, such as: the definition of concepts related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the legal way of personal data processing in the activity carried out by police bodies; the requirements for the protection of personal data in the performance of their duties; the obligations of the police body as data controller in relation to the data subject; ensuring the security and confidentiality of personal data processed, etc.

The training course turned to be an interactive one, and aspects related to the correct procedure for accessing personal data through state information systems, the records kept by PI Sangerei, the procedure for granting access to these data to third parties, as well as the legal aspects of transmitting information containing personal data to the parties on file, were of great interest to the course participants.

About 30 representatives of the Sangerei Police Inspectorate were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

On 29 August 2023, the National Centre for Personal Data Protection (NCPDP) organized a training course on personal data protection for employees of the National Public Security Inspectorate Northern Directorate (NPSI).

The aim of the training course was to increase the perception of the employees of NPSI Northern Directorate on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event, important topics were discussed, such as: definition of concepts related to the field of personal data protection; rights of personal data subjects; processing of special categories of personal data; requirements for the protection of personal data in the fulfilling of official duties; legal aspects of personal data processing through video surveillance systems; ensuring the security and confidentiality of personal data processed, etc.

At the same time, aspects related to the correct procedure for accessing personal data through state information systems, the records kept by the NPSI Northern Directorate, the procedure for granting access to these data to third parties, as well as the obligations of the police body as data controller in relation to the data subject and the legal way of personal data processing in the work carried out by police bodies were of great interest to the course participants.

About 60 representatives of the National Public Security Inspectorate Northern Directorate were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

On August 3rd, 2023, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Police Inspectorate (PI) Botanica sector of the Chisinau Police Department.

The aim of the training course was to increase the awareness of Botanica PI employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in their work.

During the event important topics were discussed, such as: definition of concepts related to the field of personal data protection; rights of personal data subjects; processing of special categories of personal data; the legal way of processing personal data in the activity carried out by police bodies; requirements for the protection of personal data in exercising  their duties; obligations of the police body as data controller in relation to the data subject; ensuring security and confidentiality of personal data processed; issues related to the Data Protection Officer; issues related to the Data Protection Impact Assessment, etc.

The training course turned to be an interactive one, participants asking multiple questions to which they received answers/explanations in the field of personal data protection. At the same time, the aspects related to the correct procedure of accessing personal data through state information systems, the records kept by the PI Botanica sector, the procedure of granting access to these data to third parties, as well as the legal aspects of processing personal data via video surveillance systems, were of great interest to the participants.

About 80 representatives of Botanica Police Inspectorate were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

On 11 July 2023, the representatives of the National Centre for Personal Data Protection organized a training course for employees of the Ialoveni Police Inspectorate of the GPI.

The aim of the course was to increase the perception of the employees of the Ialoveni Police Inspectorate on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event, important topics have been discussed, such as: definition of general notions related to the field of personal data protection; rights of personal data subjects; processing of special categories of personal data; principles and legal grounds for the processing of personal data; legal manner of processing personal data in the activity carried out by the representatives of the Ialoveni Police Inspectorate of the GPI; obligations of the Ialoveni Police Inspectorate of the GPI as data controller in relation to the data subject; ensuring the security and confidentiality of personal data processed, etc.

The training course was moderated by the representatives of the Prevention, Surveillance and Evidence Directorate and proved to be very useful and interactive. The NCPDP’s trainers provided the participants with practical answers to their many questions. At the same time, the aspects related to the correct procedure for accessing and disclosing information containing personal data, the analysis carried out by the Ialoveni Police Inspectorate of the GPI regarding access to such data, as well as the requirements for the protection of personal data in the exercise of their duties, were of great interest to the participants.

More than 40 representatives of the Ialoveni Police Inspectorate of the GPI were trained during the event.

The training course is part of the training plan for GPI subdivisions for 2023, approved and signed by the heads of NCPDP and GPI on January 25.

Today, the 10th of July, the National Centre for Personal Data Protection (NCPDP) in collaboration with TAIEX Project experts is organising the workshop “Data Protection Impact Assessment and the Role of the Data Protection Officer”.

The aim of the workshop is the takeover of legal and operational best practices by the representatives of public institutions on Data Protection Impact Assessment (DPIA) mechanisms, processing operations requiring a DPIA, and the role of the Data Protection Officer (DPO) within public sector personal data controllers.

The event was opened by NCPDP’s Director Victoria Muntean: “Current aspirations to digitise society, as well as the rapid technological developments widely used by both EU countries and the rest of the world, underline the pressing need for strong protection of personal data – a right guaranteed by both European Union and Council of Europe instruments. The collection, storage and use of personal data at an unprecedented level expose the data subjects whose data are processed to certain risks. These risks range from identity theft or inadvertent disclosure of personal data to the use of personal data for unknown purposes. A Data Protection Impact Assessment, in this case, is more than necessary, as it describes a process designed to identify the risks arising from the personal data processing, to minimise these risks and to detect them as early as possible.”

The conference is moderated by data protection experts from Italy and Malta. Amongst the topics addressed by the experts are: assessment of the necessity and proportionality of processing operations subject to the requirement to carry out a data protection impact assessment; scenarios for personal data protection impact assessment; practical mechanisms for carrying out prior consultations if the data protection impact assessment indicates that the processing would generate an increased risk and that this risk cannot be mitigated by reasonable means in terms of available technologies and implementation costs by DPA employees; the means given to the DPO to carry out his/her tasks; examples of best practices to assist state institutions/organisations in appointing and supporting the DPO in order to avoid possible conflicts of interest; etc.

Around 60 representatives of the public sector are participating in the event.

The workshop is organised and funded by the European Commission’s Technical Assistance and Information Exchange Instrument (TAIEX).

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 150 000 euros applied by the French Supervisory Authority (CNIL) to KG COM for the failure to comply with its obligations stipulated in GDPR and French Data Protection Act.

KG COM operates several websites to offer its customers clairvoyance readings by chat or phone. Following the publication of a press article in 2020 revealing the existence of a personal data breach involving the company, the CNIL carried out three investigations into KG COM.

Following the investigations, CNIL found several violations, such as:

• Failure to minimise the personal data collected and used (Article 5.1.c GDPR)
• Failure to have a legal basis for the use of banking data (Article 6 GDPR)
• Failure to obtain prior consent to the collection of special categories of data (Article 9 GDPR)
• Failure to ensure data security (Article 32 GDPR)
• Failure to notify the CNIL of data breaches (Article 33 GDPR)
• a breach of the obligations related to the use of cookies (Article 82 of the French Data Protection Act)

Consequently, the CNIL imposed two fines on KG COM:

• a fine of 120 000 euros for infringements of the GDPR. This fine was taken in cooperation with the European CNIL counterparts (Belgium, Luxembourg, Italy, Spain, Portugal, Bulgaria, Berlin et Ireland) within the framework of the one-stop shop procedure, as KG COM has customers and prospects from several Member States of the European Union;
• a fine of 30 000 euros for non-compliance relating to use of cookies (Art. 82 of the French Data Protection Act).

In order to determine the amount of the fine, the CNIL took into account the particularly high number of infringements of the data protection rules, the sensitivity of the personal data processed (health data, information relating to sexual orientation) and the number of data subjects.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.