From 26 to 28 September, the representatives of the Centre are conducting a study visit “Data Protection Impact Assessment and the role of the Data Protection Officer”. The event is hosted by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

The aim of the study visit is to take over the best legal and operational practices by the National Centre for Personal Data Protection on Data Protection Impact Assessment (DPIA) mechanisms, processing operations requiring a DPIA, as well as the role of the Data Protection Officer (DPO) within companies/state institutions that are personal data controllers.

During the 3 days there will be an in-depth analysis of processing operations requiring a DPIA; the role of the DPO; data breach risks, transfer of personal data to third countries, as well as the practical part which will be hosted by Telecom Italia S.P.A.

The study visit is organised with the support of the EU project TAIEX – Technical Assistance and Information Exchange Instrument, managed and funded by the Directorate-General for Neighbourhood and Enlargement Negotiations (DG NEAR) of the European Commission.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 70 000 euros applied by the Italian Data Protection Authority (SA) to Unicredit for the infringement of Article 5.1(a), Article 12 and 15 of GDPR.

Following investigations, the Italian SA found that Unicredit SpA rejected a data subject’s request for access to personal data on the grounds that a pre-established form had not been completed. The form itself was found to be incomplete and misleading as to the actual scope of the right at issue. The company considered it was free to discard access requests that were submitted without using the given form and replied to the data subject only after the latter lodged his complaint.  In that respect, the Italian SA clarified that an access request could not be dealt with by delivering the information notice as per Articles 13 and 14 GDPR; the right of access to one’s personal data and the right to be informed, though mutually related, are different rights which are set forth in separate provisions of the GDPR and are intended to afford safeguards and protection in ways that are not fully superimposable. The Italian SA recalled the EDPB Guidelines 1/2022 on data subject rights (right of access) in this connection and imposed a fine in the amount of 70 000 euros.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 250 000 euros applied by the French Data Protection Authority (CNIL) to INFOGREFFE for the infringement of Article 5.1.e and Article 32 of the GDPR

Following a complaint, CNIL, carried out an online investigation of the infogreffe.fr website, which allows users to consult legal information on companies and order documents certified by the commercial court registries. The investigations focused in particular on the data retention periods defined and the security measures implemented by the economic interest group INFOGREFFE, which provides the legal information publishing service on companies via the website.

Following the investigation was found:

·        Failure to comply with the obligation to keep data for a period of time proportionate to the purpose of the processing (Article 5.1.e of the GDPR);

·        Failure to comply with the obligation to ensure the security of personal data (Article 32 of the GDPR);

On the basis of these findings, CNIL issued a fine of 250 000 euros on INFOGREFFE, and decided to make it public. This decision was taken in cooperation with the other European authorities concerned, as user accounts were created from all EU Member States.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 69th Plenary Session of the European Data Protection Board (EDPB), which was held on 12-13 September at Brussels, Belgium.

 During the Plenary, the EDPB adopted several documents, among which:

• A Statement on the European Commission’s proposal for an EU Police Cooperation Code. This proposal aims to enhance law enforcement cooperation across Member States, in particular the information exchange between the competent authorities. The code is comprised of three main measures: proposal for a Prüm II Regulation, proposal for a Police Information Exchange Directive and the proposal for a Council Recommendation on operational police cooperation.
• EDPB decided upon the topic for its second coordinated enforcement action, which will concern the designation and position of the data protection officer. In a coordinated action, the EDPB prioritises a certain topic for data protection authorities (DPAs) to work on at the national level. The results of these national actions are then bundled and analysed, generating deeper insight into the topic and allowing for targeted follow-up on both the national and the EU level. This new coordinated action follows the EDPB’s decision to set up a Coordinated Enforcement Framework (CEF) in October 2020. The CEF is a key action of the EDPB under its 2021-2023 Strategy, together with the creation of a Support Pool of Experts. The two initiatives aim to streamline enforcement and cooperation among DPAs.
• The EDPB met with representatives from civil society organisations to discuss the challenges posed to enforcement cooperation by different procedural approaches in national law. This is a next step towards the EDPB’s objective to develop an overview of such challenges, as set out in its Vienna Statement on enforcement cooperation.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

Today, September 22, the representatives of LPAs from Leova district were trained in the field of personal data protection. The training course entitled: “Requirements, principles and new trends in the field of personal data protection”, aimed to strengthen the capacities of LPAs representatives by familiarizing, raising awareness and informing them with the field of data protection.

The most important topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; processing of special categories of personal data; depersonalization of personal data in the State Local Documents Registry.

The event was hosted by Leova District Council and was attended by 37 representatives. The participants asked questions to the trainers regarding the practical application of the legislation in the field of personal data protection.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 175 00 euros applied by the French Data Protection Authority (DPA) to UBEEQO International for the illegally processing of personal data.

This case is part of the priority control theme in 2020 relating to the new uses of geolocation data in the context of mobility. In this context, the French DPA controlled the company UBEEQO International, whose activity is the rental of vehicles for a short period. The investigations focused in particular on the data collected, the defined retention periods, the information provided to individuals and the security measures implemented.

Following the investigations, French DPA found several violations, such as:

·        Failure to comply with the obligation to ensure data minimisation (Article 5.1.c of the GDPR).

·        Failure to define and respect a proportionate data retention period (Article 5.1.e of the GDPR).

·        Failure to inform individuals (Article 12 of the GDPR).

 On the basis of these findings, the restricted committee – the CNIL’s body in charge of issuing sanctions – in cooperation with the other European authorities concerned (in Belgium, Denmark, Spain, Italy and Germany) imposed a fine of 175 000 euros to UBEEQO International, which was made public.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 20 million euros applied by the Hellenic Data Protection Authority (DPA) to Clearview AI for violating the principles of lawfulness and transparency of personal data processing.

Hellenic DPA examined a complaint against Clearview AI, lodged by the civil non-profit organization “Homo Digitalis” on behalf of a complainant, who claimed that s/he has objections to the realisation of the right of access s/he exercised before the aforementioned company. In conjunction with the issues deplored, it was also requested that the practices of the defendant company be examined on the whole from the point of view of ensuring personal data protection.

Following the investigations, it was found that the company, which markets facial recognition services, violated the principles of lawfulness and transparency stipulated at Art. 5 paragraphs 1(a) and (2), 6, 9 GDPR and its obligations under Articles 12, 14, 15 and 27 of the GDPR.

In this context, Hellenic DPA imposed a fine of 20 million euros to Clearview AI for violating the principles of lawfulness and transparency on personal data processing. In addition, the DPA ordered the company to conform its activity so as to realise the right of access to personal data of data subjects, while imposing (on the same company) a prohibition on the collection and processing of personal data of subjects located in the Greek territory, using methods included in the facial recognition service. Finally, with this Decision, the Hellenic DPA ordered Clearview AI Inc. to delete the personal data of those subjects located in Greece, which the defendant collects and processes using the aforementioned methods.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) and Personal Data Protection Office of Poland signed a Collaboration Agreement in the field of personal data protection. The Agreement was signed by the Director of NCPDP, Ms Victoria Muntean and President of the Personal Data Protection Office, Mr Jan Nowak.

The Agreement provides for the development of cooperation relations between the two institutions in terms of achieving constant progress in the field of personal data protection and the promotion of good practices that will create favorable conditions for ensuring effective protection of personal data of Poland’s and Moldova’s citizens, which is significant in the context of the recent granting of the status of EU candidate country of the Republic of Moldova.

The NCPDP states that the agreement is aimed at various activities that will encourage the exchange of information on the application of European laws, regulations, standards and recommendations in the field of personal data protection, as well as the organization of activities focused on promoting the protection of privacy and personal data protection, cooperation in order to organize projects of common interest for both institutions at regional and national level, etc.

We remind you that the NCPDP has concluded another 17 national collaboration agreements with institutions from different fields of activity, as well as 9 international collaboration agreements with the Personal Data Protection Authorities from countries such as Romania, Ukraine, Georgia, Italy, Hungary, Latvia, Malta.

At the initiative of the General Department of Education, Youth and Sport of the Chisinau Municipal Council (GDEYS), the representatives of the National Centre for Personal Data Protection (NCPDP) participated as trainers in the training course entitled: “Requirements, principles and new trends in the field of personal data protection”, that was held on 20 July 2022.

The most important topics covered in the course were: general concepts and principals of personal data protection; data protection impact assessment; the data protection officer; ensuring the security and confidentiality of personal data in information and filing systems.

The aim of the course was to inform the participants about the latest and most important aspects of the Law No 133/2011 on personal data protection.

The training course was attended by 64 participants, GDEYS employees and representatives of GDEYS institutions.

From 8 to 15 July this year, the National Centre for Personal Data Protection (NCPDP) has organized several activities dedicated to the Centre’s Day, marked annually on 10 July. In this regard, on Friday, July 8, on the official website of the NCPDP, a press release was placed – 14 years of activity of the NCPDP.

Also, on July 11, a street action was organized, 14 years since the founding of the NCPDP. In this regard, a group of employees of the Center went to the Central Park in Chisinau, where they distributed to passers-by leaflets and information sheets that are related to the field of personal data protection.

Similarly, on the official website of the NCPDP, the Newsletter no. 11 has been published. It covers the period from 1 April to 30 June 2022. The Newsletter includes information on: information and training activities; control activities; findings of the NCPDP; breaches of the rules on processing and storage of personal data; supervisory activities; International and European news and other data protection authorities. The Newsletter can be found at the following link: .

On Friday, July 15, according to the training plan, the training course “Requirements, principles and new trends in the field of personal data protection” was organized for representatives of LPAs from Nisporeni district.

Within the training course, the representatives of the NCPDP focused on topics related to: definition of personal data; processing of special categories of personal data; legal grounds for processing personal data; filming and online transmission of local council meetings.

At the same time, the representatives of the NCPDP addressed issues related to the personal data officer; depersonalization of data in the State Register of Local Acts; as well as data protection impact assessment as required by national legislation.

About 30 mayors and local councillors attended the course.

As a result, the aim of the actions organised by the NCPDP was to familiarise authorities and civil society with the field of personal data protection.