The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 40 million euros applied by the French Supervisory Authority (CNIL) to CRITEO for the infringement of the legal provisions stipulated in GDPR.

CRITEO specialises in “behavioral retargeting”, which consists of tracking the navigation of Internet users in order to display personalised advertisements. To this end, the company collects the browsing data of Internet users thanks to the CRITEO tracker (cookie) which is placed on their terminals when they visit certain CRITEO partner websites. Then, it participates in real time bidding and displays personalised advertising if it has won the bid.

Following complaints lodged by the organizations Privacy International and None of Your Business, the CNIL carried out several investigations into CRITEO.

The French SA found five breaches of the GDPR:

·        Failure to demonstrate that the person has given consent (Article 7.1 GDPR)

·        Failure to comply with the obligation of information and transparency (Articles 12 and 13 GDPR)

·        Failure to respect the right of access (Article 15.1 GDPR)

·        Failure to comply with the right to withdraw consent and erasure of data (Articles 7.3 and 17.1 GDPR)

·        Failure to provide for an agreement between joint controllers (Article 26 GDPR)

In this context, the CNIL imposed a fine of 40 million euros on CRITEO. Pursuant to the one-stop shop set up by the GDPR, this decision was submitted to all the other 26 European supervisory authorities, since they were all concerned by this cross-border case and they all approved it.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

On June 28, 2023, the representatives of the National Center for Personal Data Protection (NCPDP) organized a training course for employees of the University Primary Health Care Clinic with the title: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them about the field of personal data protection.

·        The event covered important topics such as:

·        Definition of personal health data;

·        Processing of general categories of personal data;

·        Processing of special categories of personal data;

·        Legal grounds for processing of personal data concerning health;

·        Principles of personal data processing;

·        Patients’ rights;

·        Obligation of confidentiality of personal data;

·        Confidentiality and professional secrecy;

·        Disclosure of personal health data;

·        Obligation to ensure confidentiality and security of personal data

·        Data minimization and storage limitation, etc.

The representatives of the Prevention, Surveillance and Evidence Directorate moderated the training course and it turned to be an interactive and useful one. The participants asked the trainers many questions about the legal way of personal data processing in their daily work.

At the same time, the specific cases of non-compliant processing of personal health data examined by the NCPDP, as well as the correctness of disclosure of personal health data to third parties, were of great interest.

About 40 representatives of the University Primary Health Care Clinic were trained in the training course.

On 23 June 2023, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the Police Department of ATU Gagauzia.

The aim of the training course was to increase the perception of the employees of the Police Directorate of ATU Gagauzia on the principles of personal data protection, as well as on ensuring the correct application of legal provisions in the field, in the activity they carry out.

During the event, important topics such as: definition of general notions related to the field of personal data protection; the legal way of personal data processing in the activity carried out by the employees of the Police Department of ATU Gagauzia; requirements for the protection of personal data in the performance of their duties; obligations of the police body as data controller in relation to the data subject; issues concerning the disclosure of information containing personal data, as well as the analysis carried out by the data controller in terms of access to such data; ensuring the security and confidentiality of personal data processed, etc.

The training course was moderated by the representatives of the Prevention, Surveillance and Evidence Diepartment and it turned to be a useful one, as the trainers from the NCPDP provided the participants with practical answers to the many questions they asked. At the same time, the aspects related to the correct procedure of accessing personal data through the state information systems, the records kept by the Police Department of ATU Gagauzia, as well as the correct auditing of these accesses, were of great interest to the participants.

More than 40 representatives of the Police Department of ATU Gagauzia were trained during the event.

The training course is part of the training plan in the GPI subdivisions for 2023, approved and signed by the heads of the NCPDP and GPI on 25 January this year.

On 21 June 2023, the representatives of the National Centre for Personal Data Protection organized a training course for employees of the Central Territorial Medical Association entitled: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them with the field of personal data protection.

The event addressed important topics such as: definition of personal health data; processing of special categories of personal data; legal grounds for processing personal health data; patients’ rights; obligation of secrecy of personal data; disclosure of personal health data; data minimisation and storage limitation, etc.

The training course was moderated by representatives of the Prevention, Surveillance and Evidence Directorate. It proved to be very useful, the participants asking the trainers many questions about the legal processing of personal data in their daily work. At the same time, the aspects related to the examination of requests for disclosure of personal data on health status to the patient’s legal representative were of great interest to the  participants of the course.

 The event, which took place both in person and online, was attended by about 120 representatives of the Central Territorial Medical Association.

The representatives of the National Centre for Personal Data Protection (NCPDP) attended the 44th plenary meeting of the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), which took place in Strasbourg, France, from 14 to 16 June.

Several topics were discussed during the meeting, including:

– Convention 108+, ratifications and current accessions;

– Data protection for the processing of personal data for anti-money     laundering/countering financing of terrorism purposes;

– Model contractual clauses for transborder data flows of personal data;

– Interpretation of Article 11 of the modernised Convention 108;

– Protection of personal data, including biometric data in the electoral process;

– Cooperation with other Council of Europe bodies and entities;

– Main developments and activities in the field of data protection, etc.

At the same time, the NCPDP delegation reported on the status of ratification of the Protocol amending CETS no. 223 to Convention 108. It should be noted that on 9 February 2023, on the basis of Presidential Decree No. 757/2002, the Republic of Moldova signed the Protocol amending Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, and the Action Plan of the Government of the Republic of Moldova for the current year includes the promotion of measures to ratify the Protocol.

The NCPDP, as the national supervisory authority for the personal data  processing, emphasizes the importance of the participation of  the Republic of Moldova in the plenary meetings of the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as the importance of the documents adopted in these meetings.

On 16 June 2023, the National Centre for Personal Data Protection organised a training course on personal data protection for employees of the National Agency of Road Transport (ANTA), at their request.

The aim of the training course was to increase ANTA employees’ awareness of the principles of personal data protection, as well as of ensuring the correct application of the legal provisions in this field, arising from their obligation to ensure the protection of the fundamental rights and freedoms of individuals with regard to the processing of personal data.

During the event important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection;

– Data Protection Officer issues;

– Data Protection Impact Assessment issues;

– Examination of requests for disclosure of personal data;

– Personal data protection requirements in the performance of duties;

– Correct procedure for accessing personal data through state information systems and keeping correct audit trails of such accesses;

– Ensuring the security and confidentiality of personal data processed, etc.

The training course was an interactive one, with participants asking the trainers many questions about the legal processing of personal data in the daily work of ANTA employees.

The event was attended by the representatives from the two key branches of the institution: the branch dealing with the one-stop-shop activity – issuing of permit documents and the branch dealing with road control activity

On 14 June 2023, the representatives of the National Centre for Personal Data Protection organized a training course for the employees of the Ministry of Internal Affairs, entitled: “Ensuring the protection of personal data in the activity of the Ministry of Internal Affairs”.

The aim of the course was to increase the perception of MIA’s employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field, in the activity they carry out.

During the event important topics were discussed, such as:

– Definition of general notions related to the field of personal data protection;

– The rights of personal data subjects;

– Processing of special categories of personal data;

– Principles and legal grounds for personal data processing;

– The legal modalities of personal data processing in the activity carried out by the MIA;

– Requirements for the protection of personal data in the performance of duties;

– MAI’s obligations as data controller in relation to the data subject;

– Aspects concerning the disclosure of information containing personal data, as well as the analysis carried out by the MIA regarding access to such data;

– The correct procedure for accessing personal data through the State Information Systems, as well as the correct audit trail of such accesses;

– Ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be an interactive one, with participants asking multiple questions, based on their work, to which they received documented answers with practical examples from the trainers.

During the event, moderated by representatives of the Directorate General for Surveillance and Compliance, about 50 representatives of the MIA were trained.

On June 9, 2023, the representatives of the National Center for Personal Data Protection organized a training course for the employees of the Family Doctors Center from Balti municipality, entitled: “Legal provisions in the field of personal data protection”.

The aim of the course was to strengthen the capacities of medical staff by familiarising, raising awareness and informing them about the field of personal data protection.

The event covered important topics such as:

– Definition of personal health data;

– Processing of special categories of personal data;

– Legal grounds for processing personal data concerning health;

– Patients’ rights;

– The mandatory secrecy of personal data;

– Disclosure of personal health data;

– Data minimisation and storage limitation, etc.

The training course was moderated by representatives of the Prevention, Surveillance and Evidence Directorate and proved to be a useful and interactive one, with participants asking the trainers many questions about practical examples in the field of personal data protection.

The event was attended by about 50 representatives of the Family Doctors Center from Balti municipality.

The National Centre for Personal Data Protection (NCPDP), for information and enforcement purposes, informs about the fine of 300,000 euros imposed by the German Federal Data Protection Authority (DPA) on a bank for lack of transparency in an automated individual decision.

An automated decision is a decision made by an IT system based solely on algorithms and without human intervention. In this case, Regulation (EU) 2016/679 (GDPR) provides for special transparency obligations. Personal data must be processed in a way that is easy to understand for data subjects. Data subjects have the right to an explanation of the decision taken after a proper assessment.

In this case, however, the bank did not take this into account in its digital application for a credit card. Using an online form, the bank requested various data about the applicant’s income, occupation and personal details. Based on the requested information and additional data from external sources, the bank’s algorithm rejected the customer’s application without any specific justification. The algorithm is based on criteria and rules previously defined by the bank. As the customer had a good Credit Score and a high regular income, he doubted the automated rejection and complained to the DPA in Germany.

A bank is obliged to inform its customers of the main reasons for rejection when making an automated decision on a credit card application. This includes factual information on the database and the decision-making factors as well as the criteria for rejection.

As a result of the investigation, the German DPA found that the bank violated Articles 22(3), 5(1)(a) and 15(1)(h) of the GDPR. In imposing the fine, the bank’s high turnover, the intentional structure of the application and information request process were in particular taken into account.

The NCPDP, as the national supervisory authority for the personal data processing, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

On 26 May 2023, the representatives of the National Centre for Personal Data Protection (NCPDP) participated as trainers in the training course entitled: “Processing of personal data in the educational sector”, organized for the General Directorate of Education Cahul.

The aim of the training course was to increase the awareness of employees in the education sector on the principles of personal data protection and on ensuring the correct application of the relevant legal provisions in their work.

During the event important topics were discussed, such as:

– General notions of personal data protection;

– Principles of personal data protection;

– Data Protection Officer (DPO) issues;

– Data Protection Impact Assessment issues;

– Ensuring security and confidentiality of personal data by employees of educational institutions;

– The active role of the teacher in informing students about the consequences of disclosing personal data;

– Installation and management of video surveillance systems in educational institutions;

– Storage, retention and disclosure of personal data;

– Electronic transmission of information containing personal data, etc.

The training course was an interactive one, with participants asking multiple questions to which they received answers/explanations in the field of personal data protection.

The course took place online, 85 representatives of the General Directorate of Education Cahul being trained.