The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the compliance order applied to a personal data controller – private sector employer, issued by the Slovenian Data Protection Authority (SA) under Article 5.1(c) and 6.1(f) of the GDPR.

Following the investigation, the Slovenian SA determined that the controller carried out GPS tracking of eight company vehicles. The vehicles were used by employees as delivery vehicles and passenger delivery vehicles. Tracking was carried out by a special transmitter in the vehicle and monitored by an application that continuously recorded the distance travelled. Individuals were identifiable. Furthermore, a special record was being created containing a large amount of location data of employees. The data was processed continuously, systematically and automatically so that the employer could determine in any moment, where an individual traveling with one of the vehicles was located. The data could be accessed also retrospectively.  The employer could easily determine the employee who was using the company vehicle and to whom the location data is attributable.

Slovenian SA confirmed that providing safety of property can be in a legitimate interest of the data controller, but the controller did not demonstrate that the way the measure was carried out was appropriate and necessary. The GPS tracking was carried out also while the vehicle and the property in it were under constant and direct supervision of an employee. Slovenian SA decided that in the specific case GPS tracking could only be used in a way that the driver could turn on the GPS on the location where the vehicle, the equipment and the documents could be at risk and turn it off after returning to the vehicle, when the protected goods were again under direct supervision of an employee. Regarding safety of individuals in case of traffic accidents Slovenian SA decided that constant GPS tracking was disproportionate. The place of the accident is usually known, the location of the accident could also be reported by the driver himself. The controller should use a less intrusive measure on individual’s information privacy. In this context, Slovenian SA decided that the controller did not demonstrate legitimate interests according to Article 6.1 (f) and that the GPS tracking was not in accordance with the principle of data minimisation (Article 5.1 (c) of the GDPR) and ordered the controller to stop processing the data of employees that were collected by continuous, systematic and automatic GPS tracking.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

“Requirements, principles and new trends in the field of personal data protection” was the subject of discussion during the training course organized today, November 25, for representatives of LPAs of Ștefan Vodă district.

The aim of the training course was to familiarize and inform LPAs representatives with the field of personal data protection.

During the course, the following topics were addressed: general notions on personal data protection; legal grounds for personal data processing; depersonalization of personal data in the State Local Documents Registry; processing of special categories of personal data; filming and online transmission of local council meetings.

During the course, the participants asked many questions on the practical application of the regulatory framework in this field.

On 18-19 November 2022, the representatives of the National Centre for Personal Data Protection (NCPDP) participated in the European Case Handling Workshop 2022, held in Tbilisi, Georgia.

The event focused on actual issues in the field of personal data protection and privacy, in particular such as:

– The steps taken by employees of the authorities in investigations;

– Social data protection, guidelines and exceptions in national legislation;

– International transfers of personal data;

– Personal data and artificial intelligence;

– Main challenges faced by data supervisory authorities, etc.

Attending the event, the representatives of the NCPDP addressed the topic – “The experience of the Republic of Moldova and the methodology of examining the complaints having children as data subjects”.

The invitation to participate in the Workshop came from the Personal Data Protection Service of Georgia, which has been carrying out the control of the lawfulness of personal data processing since 2013.

The event brought together around 50 participants from 26 European countries.

The representatives of the National Centre for Personal Data Protection participated in the 43rd Plenary session of the Committee of Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), held in Strasbourg, France on 16-18 November. 

During the plenary meeting, the report of the 42nd plenary meeting, that took place on 17-19 November 2021, the report of the 55th Bureau meeting (23-25 March 2022) and the Committee’s work Programme for 2022-2025 were presented.

Also, aspects on consequences of the Russian Federation’s aggression against Ukraine; Convention 108+ current situation; digital identity; Interstate exchange of data for anti-money laundering/combating financing of terrorism; interpretation of article 11 of Convention 108+, model contractual clauses in the context of transborder data flows; cooperation with the Council of Europe and other entities, etc. were discussed.

The National Centre for Personal Data Protection organized on November 18, 2022, a training course for representatives of LPAs from Ocnița district.

The training course entitled: “Requirements, principles and new trends in the field of personal data protection”, aimed to familiarize and inform the LPAs representatives with the latest and most important issues in the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; processing of special categories of personal data; depersonalization of personal data in the State Local Documents Registry, filming and online transmission of local council meetings.

The event was attended by about 17 representatives, mayors and district councillors.

At the end, the participants asked questions to the trainers regarding the practical application of the provisions of Law 133/2011 on personal data protection.

The Deputy Director of NCPDP Angela Colomiicenco participated on 17 November at the international conference “Accession of the Republic of Moldova to the Single Euro Payments Area (SEPA) – achievements and perspectives”. The event was organized by the National Bank of Moldova.

SEPA is a project developed in the European payments area and aims at creating an integrated market for euro payment services by removing commercial, legal and technical barriers to national payments participating in the SEPA area.

Considering the development of this project, it should be noted that payment operations will be carried out by legal entities as well as by specific individuals, which involve the processing of personal data, operations to be carried out in compliance with legal requirements and European standards in the field of personal data protection.

In her speech, Ms Colomiicenco said that the SEPA project should not be seen only as a “one-move operation”, but rather as a continuously developing project that facilitates European integration and will contribute to the implementation of European standards in the field of personal data protection in national legislation.

Also, cooperation in the field of personal data protection and ensuring a high level of personal data protection in line with European Union (EU) standards are key objectives of the Republic of Moldova, set out in the main documents governing relationship between the European Union and the Republic of Moldova, in particular in the RM-EU Association Agreement, and the approval of the draft laws on the protection of personal data and the NCPDP, which are being finalised within the inter-institutional working group set up by the Ministry of Justice and which have been included in the Moldovan Parliament’s Plan on priorities for the period October – December 2022 in the legislative field,  and will contribute to the recognition of the adequate level of personal data protection in the RM and will generate a wide range of benefits, such as enhancing the credibility of the state and national partners, strengthening the economic strategy, developing the business environment, attracting investment, etc.

In this regard, the NCPDP is open to cooperation with relevant institutions concerning including the Republic of Moldova in the SEPA area in order to facilitate and streamline euro payment operations in our country.

The National Center for Personal Data Protection organized on Friday, November 4, a training course on personal data protection for representatives of LPAs in the Cantemir district.

The theme of the training course was “Requirements, principles and new trends in the field of personal data protection” which aimed to familiarize and strengthen the capacities of LPAs representatives in this field.

The most important topics discussed were: general notions on personal data protection; legal grounds for personal data processing; filming and online transmission of local council meetings, as well as issues related to the correct depersonalization of personal data in the State Local Documents Registry.

Around 40 representatives attended the course. The trainers from the NCPDP provided answers to all the questions given by the participants. In turn, those present in the hall thanked the trainers for the useful and interesting course.

Today, October 27, the National Centre for Personal Data Protection (NCPDP) trained representatives of local public authorities in the district of Șoldanesti. The subject of the training course was:  “Requirements, principles and new trends in the field of personal data protection”.

The aim of the course was to strengthen the capacities of LPAs representatives by familiarizing, raising awareness and informing them with the field of personal data protection.

The main topics addressed in the course were: general notions on personal data protection; legal grounds for personal data processing; filming and online transmission of local council meetings, as well as issues related to the correct depersonalization of personal data in the State Local Documents Registry.

About 25 mayors and local councillors of the district participated in the training course. The training course was a dynamic and productive one, as the participants asked questions to the trainers on the practical application of Law 133/2011 on personal data protection.

On 19-20 October in Brussels, Belgium, the Deputy Director of the National Centre for Personal Data Protection, Angela Colomiicenco, participated in the meeting of the RM – EU Subcommittee on Freedom, Security and Justice.

The main topics discussed in the meeting were: developments in personal data protection, justice sector reform, preventing and combating organised crime, corruption and other illegal activities, money laundering and terrorist financing.

In the meeting was also presented the main developments in the above-mentioned areas since the last meeting held online on 12-13 October 2021.

At the meeting participated the representatives of several Moldovan authorities, such as: the National Anti-Corruption Centre; the General Prosecutor’s Office; the National Integrity Authority; the Ministry of Internal Affairs; the National Institute of Justice; the Service for Preventing and Combating Money Laundering.

National Centre for Personal Data Protection (NCPDP), for information purposes, communicates about the meeting of the National Centre for Personal Data Protection Director, Ms Victoria Muntean, with the Ambassador Extraordinary and Plenipotentiary of the Republic of Moldova to the Kingdom of Belgium, Mr Viorel Cibotaru.

The purpose of the meeting was to address the most pressing issues in the field of personal data protection, as well as to identify mechanisms for collaboration and development of bilateral relations between the NCPDP and the Belgian institutions, in order to align the national legislation with European standards and the acquis communautaire. The Ambassador demonstrated openness and willingness to facilitate the implementation of further strategies to develop the field of personal data protection in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC  (GDPR) and taking over best practices from EU Member States.

The event took place on October 11, at the headquarters of the Embassy of the Republic of Moldova to the Kingdom of Belgium.