The Deputy Director of NCPDP Angela Colomiicenco participated on 17 November at the international conference “Accession of the Republic of Moldova to the Single Euro Payments Area (SEPA) – achievements and perspectives”. The event was organized by the National Bank of Moldova.

SEPA is a project developed in the European payments area and aims at creating an integrated market for euro payment services by removing commercial, legal and technical barriers to national payments participating in the SEPA area.

Considering the development of this project, it should be noted that payment operations will be carried out by legal entities as well as by specific individuals, which involve the processing of personal data, operations to be carried out in compliance with legal requirements and European standards in the field of personal data protection.

In her speech, Ms Colomiicenco said that the SEPA project should not be seen only as a “one-move operation”, but rather as a continuously developing project that facilitates European integration and will contribute to the implementation of European standards in the field of personal data protection in national legislation.

Also, cooperation in the field of personal data protection and ensuring a high level of personal data protection in line with European Union (EU) standards are key objectives of the Republic of Moldova, set out in the main documents governing relationship between the European Union and the Republic of Moldova, in particular in the RM-EU Association Agreement, and the approval of the draft laws on the protection of personal data and the NCPDP, which are being finalised within the inter-institutional working group set up by the Ministry of Justice and which have been included in the Moldovan Parliament’s Plan on priorities for the period October – December 2022 in the legislative field,  and will contribute to the recognition of the adequate level of personal data protection in the RM and will generate a wide range of benefits, such as enhancing the credibility of the state and national partners, strengthening the economic strategy, developing the business environment, attracting investment, etc.

In this regard, the NCPDP is open to cooperation with relevant institutions concerning including the Republic of Moldova in the SEPA area in order to facilitate and streamline euro payment operations in our country.

The National Center for Personal Data Protection organized on Friday, November 4, a training course on personal data protection for representatives of LPAs in the Cantemir district.

The theme of the training course was “Requirements, principles and new trends in the field of personal data protection” which aimed to familiarize and strengthen the capacities of LPAs representatives in this field.

The most important topics discussed were: general notions on personal data protection; legal grounds for personal data processing; filming and online transmission of local council meetings, as well as issues related to the correct depersonalization of personal data in the State Local Documents Registry.

Around 40 representatives attended the course. The trainers from the NCPDP provided answers to all the questions given by the participants. In turn, those present in the hall thanked the trainers for the useful and interesting course.

Today, October 27, the National Centre for Personal Data Protection (NCPDP) trained representatives of local public authorities in the district of Șoldanesti. The subject of the training course was:  “Requirements, principles and new trends in the field of personal data protection”.

The aim of the course was to strengthen the capacities of LPAs representatives by familiarizing, raising awareness and informing them with the field of personal data protection.

The main topics addressed in the course were: general notions on personal data protection; legal grounds for personal data processing; filming and online transmission of local council meetings, as well as issues related to the correct depersonalization of personal data in the State Local Documents Registry.

About 25 mayors and local councillors of the district participated in the training course. The training course was a dynamic and productive one, as the participants asked questions to the trainers on the practical application of Law 133/2011 on personal data protection.

On 19-20 October in Brussels, Belgium, the Deputy Director of the National Centre for Personal Data Protection, Angela Colomiicenco, participated in the meeting of the RM – EU Subcommittee on Freedom, Security and Justice.

The main topics discussed in the meeting were: developments in personal data protection, justice sector reform, preventing and combating organised crime, corruption and other illegal activities, money laundering and terrorist financing.

In the meeting was also presented the main developments in the above-mentioned areas since the last meeting held online on 12-13 October 2021.

At the meeting participated the representatives of several Moldovan authorities, such as: the National Anti-Corruption Centre; the General Prosecutor’s Office; the National Integrity Authority; the Ministry of Internal Affairs; the National Institute of Justice; the Service for Preventing and Combating Money Laundering.

National Centre for Personal Data Protection (NCPDP), for information purposes, communicates about the meeting of the National Centre for Personal Data Protection Director, Ms Victoria Muntean, with the Ambassador Extraordinary and Plenipotentiary of the Republic of Moldova to the Kingdom of Belgium, Mr Viorel Cibotaru.

The purpose of the meeting was to address the most pressing issues in the field of personal data protection, as well as to identify mechanisms for collaboration and development of bilateral relations between the NCPDP and the Belgian institutions, in order to align the national legislation with European standards and the acquis communautaire. The Ambassador demonstrated openness and willingness to facilitate the implementation of further strategies to develop the field of personal data protection in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC  (GDPR) and taking over best practices from EU Member States.

The event took place on October 11, at the headquarters of the Embassy of the Republic of Moldova to the Kingdom of Belgium.

From 26 to 28 September, the representatives of the Centre are conducting a study visit “Data Protection Impact Assessment and the role of the Data Protection Officer”. The event is hosted by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

The aim of the study visit is to take over the best legal and operational practices by the National Centre for Personal Data Protection on Data Protection Impact Assessment (DPIA) mechanisms, processing operations requiring a DPIA, as well as the role of the Data Protection Officer (DPO) within companies/state institutions that are personal data controllers.

During the 3 days there will be an in-depth analysis of processing operations requiring a DPIA; the role of the DPO; data breach risks, transfer of personal data to third countries, as well as the practical part which will be hosted by Telecom Italia S.P.A.

The study visit is organised with the support of the EU project TAIEX – Technical Assistance and Information Exchange Instrument, managed and funded by the Directorate-General for Neighbourhood and Enlargement Negotiations (DG NEAR) of the European Commission.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 70 000 euros applied by the Italian Data Protection Authority (SA) to Unicredit for the infringement of Article 5.1(a), Article 12 and 15 of GDPR.

Following investigations, the Italian SA found that Unicredit SpA rejected a data subject’s request for access to personal data on the grounds that a pre-established form had not been completed. The form itself was found to be incomplete and misleading as to the actual scope of the right at issue. The company considered it was free to discard access requests that were submitted without using the given form and replied to the data subject only after the latter lodged his complaint.  In that respect, the Italian SA clarified that an access request could not be dealt with by delivering the information notice as per Articles 13 and 14 GDPR; the right of access to one’s personal data and the right to be informed, though mutually related, are different rights which are set forth in separate provisions of the GDPR and are intended to afford safeguards and protection in ways that are not fully superimposable. The Italian SA recalled the EDPB Guidelines 1/2022 on data subject rights (right of access) in this connection and imposed a fine in the amount of 70 000 euros.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 250 000 euros applied by the French Data Protection Authority (CNIL) to INFOGREFFE for the infringement of Article 5.1.e and Article 32 of the GDPR

Following a complaint, CNIL, carried out an online investigation of the infogreffe.fr website, which allows users to consult legal information on companies and order documents certified by the commercial court registries. The investigations focused in particular on the data retention periods defined and the security measures implemented by the economic interest group INFOGREFFE, which provides the legal information publishing service on companies via the website.

Following the investigation was found:

·        Failure to comply with the obligation to keep data for a period of time proportionate to the purpose of the processing (Article 5.1.e of the GDPR);

·        Failure to comply with the obligation to ensure the security of personal data (Article 32 of the GDPR);

On the basis of these findings, CNIL issued a fine of 250 000 euros on INFOGREFFE, and decided to make it public. This decision was taken in cooperation with the other European authorities concerned, as user accounts were created from all EU Member States.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 69th Plenary Session of the European Data Protection Board (EDPB), which was held on 12-13 September at Brussels, Belgium.

 During the Plenary, the EDPB adopted several documents, among which:

• A Statement on the European Commission’s proposal for an EU Police Cooperation Code. This proposal aims to enhance law enforcement cooperation across Member States, in particular the information exchange between the competent authorities. The code is comprised of three main measures: proposal for a Prüm II Regulation, proposal for a Police Information Exchange Directive and the proposal for a Council Recommendation on operational police cooperation.
• EDPB decided upon the topic for its second coordinated enforcement action, which will concern the designation and position of the data protection officer. In a coordinated action, the EDPB prioritises a certain topic for data protection authorities (DPAs) to work on at the national level. The results of these national actions are then bundled and analysed, generating deeper insight into the topic and allowing for targeted follow-up on both the national and the EU level. This new coordinated action follows the EDPB’s decision to set up a Coordinated Enforcement Framework (CEF) in October 2020. The CEF is a key action of the EDPB under its 2021-2023 Strategy, together with the creation of a Support Pool of Experts. The two initiatives aim to streamline enforcement and cooperation among DPAs.
• The EDPB met with representatives from civil society organisations to discuss the challenges posed to enforcement cooperation by different procedural approaches in national law. This is a next step towards the EDPB’s objective to develop an overview of such challenges, as set out in its Vienna Statement on enforcement cooperation.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

Today, September 22, the representatives of LPAs from Leova district were trained in the field of personal data protection. The training course entitled: “Requirements, principles and new trends in the field of personal data protection”, aimed to strengthen the capacities of LPAs representatives by familiarizing, raising awareness and informing them with the field of data protection.

The most important topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; processing of special categories of personal data; depersonalization of personal data in the State Local Documents Registry.

The event was hosted by Leova District Council and was attended by 37 representatives. The participants asked questions to the trainers regarding the practical application of the legislation in the field of personal data protection.