The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of 1 million euros applied by the French Supervisory Authority (CNIL) to TotalEnergies Électricité et Gaz France for the illegally processing of personal data.

CNIL has received several complaints concerning the difficulties encountered by individuals in having their requests for access to their data and opposition to receiving calls for the purposes of direct marketing taken into account by the French energy producer and supplier, TotalEnergies Électricité et Gaz France.

Following the investigations, CNIL found several violations, such as:

·         Failure to comply with the obligation to inform individuals solicited (article 14 of the GDPR).

·         Failure to respect the right of access to data (article 15 GDPR) and the right to object of data subjects (article 21 GDPR).

·         Failure to comply with the obligations relating to the modalities for exercising rights (Article 12 of the GDPR).

In this context, CNIL imposed to TotalEnergies Électricité et Gaz France an administrative fine in the amount of 1 million euros and made public the decision. The amount of this fine was decided in the light of the breaches identified as well as all the measures taken by the company during the procedure to bring itself into compliance.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

On 10 July, the National Centre for Personal Data Protection (NCPDP) celebrates 14 years of activity.

Throughout this period, the field of data protection has registered a considerable evolution in ensuring the security of personal data and respect for the right to privacy.

As an autonomous public authority, independent and impartial from other public authorities, natural persons and legal entities, the NCPDP aims to protect the fundamental freedoms and rights of natural persons, especially the right for private life regarding the processing and transborder transfer of personal data.

In order to achieve the basic objective, the NCPDP ensures the organization of training courses in the field of personal data protection, ensures the control and supervision activity, issues decisions, instructions and recommendations, concludes minutes on contravention, as well as finds violations of legal provisions in the field of personal data protection.

It also organises actions to prevent breaches of the legislation in this field, including by guiding data controllers in the context of the correct application of the legislation and by informing, raising awareness and educating society on the importance of personal data protection.

At the same time, more and more petitions from personal data subjects are adressed to the NCPDP and the dynamics of the last few years demonstrate this fact. The most frequent topics reflected in the complaints are:

– Realisation of personal data subjects’ rights (access, information, intervention, opposition);

– Processing of personal data through video/audio surveillance systems;

– Processing of personal data in the absence of consent of the personal data subject and in the absence of any other legal basis.

In this regard, the NCPDP will continue to provide support to both data subjects and controllers in order to comply with the regulatory framework in the field and will make every effort to achieve further progress in strengthening the field of personal data protection.

Data exchange / interoperability of information systems, the rights and obligations of stakeholders, how to realize the rights of data subjects, the role and responsibilities of the e-Governance Agency in this regard, were the topics discussed at a training course held today, June 30, 2022, for the representatives of the National Center for Personal Data Protection (NCPDP), by the trainers within the e-Governance Agency (AGE).

The training took place at the initiative of the NCPDP, as more and more data subjects’ complaints submitted to the NCPDP concern access to personal data in state registers/information systems via the MConnect interoperability platform. Thus, the employees had the opportunity to familiarize themselves with the most important issues related to the above-mentioned subjects.

As trainers of the training were AGE representatives: Mrs Olga Tumuruc, AGE Director; Mr Sergiu Bedros, Head of Project Implementation Department; Mr Igor Arama, Head of Data Exchange and Interoperability Service; Mr Vadim Ventilă, Jurisconsult of the Project Implementation Department.

On June 28, the Conference on Personal Data Protection, organized by the National Association of ICT Companies (ATIC), took place within the framework of the ABA Rule of Law Initiative Project “Personal Data Protection – Rights and Obligations in the Republic of Moldova”, in collaboration with the National Centre for Personal Data Protection (NCPDP).

At the opening session, NCPDP Director Victoria MUNTEAN, thanked the National Association of ICT Companies (ATIC) for initiating and organizing this conference. At the same time, she welcomed the participation in the event of the IT business environment, civil society, academic field and representatives of public institutions, describing this as a testimony of the strengthening the cooperation relations in the field of personal data protection.

Furthermore, Ms. Victoria MUNTEAN specified that ” The current aspirations for the digitization of society, as well as the implementation of information technologies in the economic sectors greatly simplify the implementation of daily actions, but involve the need to ensure a high level of security of personal data and amplify the importance of provisions in the field of personal data protection”.

Also, during the above-mentioned conference, a Collaboration Agreement was signed between NCPDP and ATIC, which aims to implement national legislation and to apply the European standards in the field of personal data protection, as well as the joint organization of various events, conferences, workshops in order to promote the field of personal data protection.

On behalf of the NCPDP, the conference was also attended by Mr. Alexei STRAHOV, Head of Prevention, Surveillance and Evidence Department within the General Department of Surveillance and Conformity of the NCPDP, who addressed the topic “Data Protection Officer in institutions”, where pointed out the newest and most important aspects imposed by the provisions of Law 133/2011 on personal data protection.

State officials and dignitaries, experts and representatives of international forums participated as speakers at the event. The most important topics discussed were focused on:

·        Digitization 2022 in the Republic of Moldova: novel context of rights and obligations for subjects involved in digital services;

·        Changing personal data protection framework: international trends and national context;

·        Impact Assessment;

·        Obligations of Data Protection Officer.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 66th Plenary Session of the European Data Protection Board (EDPB), which was held on 14-15 June at Brussels, Belgium.

 During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on certification as a tool for transfers. The main purpose of these guidelines is to provide further clarification on the practical use of this transfer tool. The guidelines are composed of four parts, each focusing on specific aspects regarding certification as a tool for transfers, such as the purpose, scope and the different actors involved; implementing guidance on accreditation requirements for certification bodies; specific certification criteria for the purpose of demonstrating the existence of appropriate safeguards for transfers; and the binding and enforceable commitments to be implemented. The guidelines will be subject to public consultation until the end of September.

·        A dispute resolution decision on the basis of Art. 65 GDPR. The binding decision seeks to address the lack of consensus on certain aspects of a draft decision issued by the French SA as lead supervisory authority (LSA) regarding Accor SA, a company specialised in the hospitality sector whose main establishment is located in France, and the subsequent objections expressed by one of the concerned supervisory authorities. The decision addresses the merits of the part of the objection found to be “relevant and reasoned” in line with the requirements of Art. 4(24) GDPR. The LSA shall adopt its final decision, addressed to the controller, on the basis of the EDPB decision, without undue delay and at the latest one month after the EDPB has notified its decision.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about fine in the amount of 3,7 million euros applied by the Dutch Supervisory Authority (DPA) to Tax Administration for illegally processing personal data over a period of years in its ‘fraud identification facility’ (FSV). This was a blacklist which the Tax Administration used to register indications of fraud, often with major repercussions for people who had been wrongly included on the list.

Over the course of its investigation into the FSV the DPA uncovered numerous violations of the General Data Protection Regulation. For example, the Tax Administration had no statutory basis for processing the personal data on the list. In many cases the personal data was not even correct, and as a result people were wrongly registered as possible tax frauds. Furthermore, the list was not properly protected, and the Tax Administration’s internal privacy supervisor was not involved at an early stage in the creation of the list.

The fine applied to Tax Administration is the highest ever imposed by the DPA. This is due to the seriousness of the violations, the large number of people impacted and the fact that the violations persisted for such a long period of time.

The 3.7 million euros fine comprises multiple fines for 6 violations:

·        The Tax Administration had no statutory basis for processing personal data in the FSV: €1 million.

·        The purpose of the FSV was not specifically described in advance: €750,000.

·        The FSV contained incorrect and obsolete information: €750,000.

·        This particular data was stored for far too long: €250,000.

·        The FSV was not adequately protected: €500,000.

·        The Tax Administration waited over a year to ask its internal privacy supervisor for advice about assessing the risks of using the FSV: €450,000.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

On 25 May 2022, in the premises of the Academy of Public Administration, the Cooperation Agreement between the National Centre for Personal Data Protection and the Academy of Public Administration was signed. The Agreement was signed by the Director of the NCPDP, Victoria MUNTEAN and the Rector of the Academy, Oleg BALAN.

The aim of the Agreement is to strengthen the functional capacities of the institutions and human resources able to contribute to the development of staff’s professional skills and to the strengthening of institutional integrity.

During the signing ceremony, Ms Victoria MUNTEAN, congratulated the Academy’s management and staff for the activities and successes achieved over the years. At the same time, Ms. MUNTEAN, welcomed the intention to sign the Cooperation Agreement, as it represents an opportunity to strengthen inter-institutional collaboration, by involving NCPDP staff as trainers in the Academy, in order to familiarize the public sector employees with the field of personal data protection, the principles and rules of data processing compliance.

For his part, Mr. Oleg BALAN, appreciated the openness of NCPDP to sign the Agreement and mentioned the importance of this event. Furthermore, Mr. BALAN spoke about the historical path of the Academy and the successes achieved in recent years, mentioning the institutional restructuring and modernization of the study process. The Rector also highlighted the good cooperation with multiple national and international institutions in order to improve the training process of civil servants in the country, thus, noting the importance of signing the Cooperation Agreement.

Collaboration between the Parties will focus on areas of human capital competence; integrity, training and professional development policies in partner institutions; joint projects, including research and institutional capacity building; internships for master students and events of common interest.

On May 18-20, 2022 the representatives of the National Centre for Personal Data Protection attended the 30th Spring Conference of European Data Protection Authorities which took place in Cavtat, Croatia.

This year’s Spring Conference was hosted by the Croatian Personal Data Protection Agency (AZOP) fostering practical collaboration and exchange of best practice between members, with 40 countries attending the event.

The agenda of the event included topical issues in the field of personal data protection, such as Convention 108+, mutual assistance and global convergence, data protection in ECHR case law: latest developments.

The event also featured panel discussions on the latest developments and challenges in cross-border data transfers, foresight, innovation and technology monitoring, hosted by European Data Protection Supervisor as well as raising awareness activities and implementation of the EU funded projects in EU and non-EU countries, etc.

Member authorities adopted a Resolution on the need for a prompt ratification of the “Convention 108+”, the modernised version of Convention 108. The Resolution calls upon the governments of the member states of the Council of Europe, the governments of third countries to the Council of Europe, the European Union and International Organisations to speed up the signature and ratification of Convention 108+.

The event was attended by the representatives of the Central and Eastern European Data Protection Authorities, the Council of Europe, the European Data Protection Board, the European Data Protection Supervisor, where they had an extraordinary and unique opportunity to discuss best practices and strategies, including their own foresight function, data transfers and cross-border enforcement.

In the Official Gazette of the Republic of Moldova No 151-157 of 20 May 2022, Order No 33 of 22 April 2022 was published on the approval of the Standard Contract for the cross-border transfer of personal data to states that do not ensure an adequate level of person personal data protection.

The Standard Contract, has been drawn up for the purpose of implementing Art. 32 para. (5) let. i) of Law 133/2011 on personal data protection and its clauses establish adequate safeguards, including enforceable rights of data subjects and effective remedies in relation to cross-border transfers of data from controllers to controllers from controllers to processors and/or from processors to controllers, provided they are not modified, except to select the appropriate module or to add or update information in the annexes.

Thus, data controllers may adjust their activities in the cross-border transfer of personal data in the light of the Standard Contract for the cross-border transfer of personal data to states that do not ensure an adequate level of personal data protection, approved by the Order of NCPDP Director No 33 of 22 April 2022.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of 1,5 million euros applied by the French Lead Supervisory Authority (CNIL) to Dedalus Biologie for the infringement of articles 28, 29 and 32 of GDPR.

On February 23, 2021, a massive data breach regarding nearly 500,000 people was revealed in the press, involving the company Dedalus Biologie. The name, first name, social security number, name of the prescribing doctor, date of the examination, but also and above all medical information (HIV, genetic diseases, drug therapy or genetic data) of these people were thus released on the Internet.

The French Lead Supervisory Authority carried out several onsite and online investigations, in particular concerning the company Dedalus Biologie, which sells software solutions for medical analysis laboratories. Based on the elements collected during the investigations, CNIL identified three breaches. First, in the context of the migration of a software package to another tool, requested by two laboratories using the services of Dedalus Biologie, the latter extracted a larger volume of data than required. The company therefore processed data beyond the instructions given by the data controller and had failed to comply with Article 29 GDPR. Second, the company had not ensured security of personal data within the meaning of Article 32 GDPR. Numerous technical and organisational breaches in terms of security were found in the context of the migration of the software to another: lack of a specific procedure for data migration operations; lack of encryption of personal data stored on the problematic server; no automatic deletion of data after migration to the other software; no authentication required from the Internet to access the public area of the server; lack of a procedure for monitoring and reporting security alerts on the server. Furthermore, were also established that the general conditions of sale proposed by the company Dedalus Biologie and the contracts of maintenance transmitted to the CNIL did not contain the mentions provided for in Article 28 (3) GDPR.

In this context, CNIL imposed to the controller an administrative fine of 1.5 million euros for the non-compliance with Articles 28, 29, and 32 of GDPR and make the decision public.

 The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.