The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 525 000 applied by Dutch Data Protection Authority (SA) to DPG Media Magazines for the infringement of article 12 (2) GDPR, namely for unnecessarily requesting copies of identity documents.

The Dutch SA received various complaints regarding how Sanoma Media Netherlands B.V. (before Sanoma was taken over by DPG Media in April 2020) handled requests from people to view their data or have their data deleted. Anyone who wanted to know what personal data of theirs Sanoma and DPG Media kept or who wanted their data deleted was required to first upload or send in a copy of their identity document. What’s more, when sending such a copy electronically, they were not informed by Sanoma and DPG Media that they could redact certain data. Even if parts are redacted, it will often be disproportionate to require a copy of an identity document in order to confirm that a person really is who they claim to be.

The company thus made it overly complicated for customers to access their data or have their data deleted. After taking over Sanoma, DPG Media changed its practices. DPG Media now confirms the identity of a person requesting access to their data or deletion of their data by sending a verification email. The violation is therefore no longer being committed.

Administrative fine in the amount of EUR 525 000 applied by Dutch Data Protection Authority was contested by DPG Media Magazines.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on April 8, the representatives of the local public authorities (LPA) from Bălți municipality. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 92 mayors, municipal councilors and representatives of the Balti municipal council administration. There was a significant increase in the number of participants at the event, which shows an increased interest on the part of LPAs to comply with the legal provisions in the field of personal data processing.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

În contextul pandemiei de COVID-19, comerțul electronic și economia digitală s-au dezvoltat continuu. Ca rezultat, au crescut riscurile de utilizare online a datelor referitoare la cardurile bancare. În scopul reducerii riscurilor fraudelor bancare, Centrul Național pentru Protecția Datelor cu Caracter Personal al Republicii Moldova, recomandă:

1.                  Nu furnizați niciodată informații personale sau financiare prin telefon sau prin e-mail. Atenție la escrocherii, în care printr-un mesaj sau e-mail sunt solicitate informații personale sau financiare ce vă vizează.

2.                  Evitați utilizarea programelor descărcate de pe site-uri web necunoscute. Ignorați programele care pretind a fi jocuri distractive, colectează informații în „scopuri de marketing” sau promit „accelerarea conexiunilor la internet”. Acestea sunt de fapt programe care pot include fișiere spion.

3.                  Nu stocați chitanțele cardurilor de credit, corespondența nedorită și alte documente cu informații personale sau financiare sensibile. Nu lăsați niciodată aceste tipuri de documente expuse într-un spațiu public.

4.                  Nu postați niciodată informații personale despre Dvs. (cum ar fi data nașterii, locul nașterii, numele membrilor familiei) pe site-uri web de rețele sociale. Aceste informații pot fi găsite cu ușurință de motoarele de căutare și utilizate pentru a ajuta la comiterea furtului informației de pe cardurile bancare.

5.                  Fiți cu ochii pe datele de pe cardul Dvs., verificați raportul de venit/cheltuieli în fiecare lună, astfel încât să puteți identifica orice activitate necunoscută, delincvențe sau inexactități.

6.                  Activați autentificarea prin doi pași pe dispozitivele și conturile Dvs., ar trebui să configurați mecanismul de autentificare pe două nivele pentru e-mail, conturi de rețele sociale și conturi bancare.

7.                  Ștergeți datele de pe dispozitivele electronice înainte de a le vinde sau dona. Când ștergeți fișiere de pe calculatoare și alte dispozitive electronice precum tablete, acele fișiere nu dispar cu adevărat, părți din ele rămân și pot fi reasamblate cu un program de recuperare a datelor până când sunt suprascrise cu date noi. Acest lucru poate fi realizat prin suprascrierea unui software care șterge hardware-ul sau transferă date de pe calculatorul vechi pe unul nou.

8.                      Creați parole diferite pentru conturile Dvs., o parolă sigură este lungă, complexă și unică. Creați parole diferite pentru diferite conturi. Evitați utilizarea informațiilor legate de identitatea Dvs., cum ar fi cifrele din numărul Dvs. de telefon, ziua de naștere, inițialele sau părți din numele Dvs.

9.                      Instalați software antivirus, el poate împiedica hackerii să acceseze informații de pe calculatorul și dispozitivele mobile ce vă aparțin, Dvs. ați putea fi o victimă a programelor nedorite care includ viruși, atrageți atenția dacă calculatorul Dvs. manifestă următoarele semne:

·         Încetinește, se blochează sau afișează mesaje de eroare;

·         Nu se închide sau nu se repornește;

·         Oferă ferestre pop-up sau alte reclame nedorite;

·         Vă trimite către pagini web pe care nu le-ați căutat;

·         Afișează bare de instrumente noi, neașteptate;

·         Schimbă browserul web implicit;

·         Consumă rapid bateria.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 17 million applied by Irish Data Protection Authority (SA) to Meta Platforms (formerly Facebook) for the infringement of articles 5(2) and 24(1) GDPR.

The Irish SA launched an inquiry of its own-volition, arising from receipt of a series of twelve data breach notifications in the period between 7 June – 4 December 2018.  The purpose of the inquiry was to examine the extent to which Meta Platforms achieved compliance with the requirements of articles 5(2) and 24(1) GDPR.

Following investigations, the Irish SA found that Meta Platforms failed to have in place appropriate technical and organisational measures such as would enable it to readily demonstrate the security measures that it implemented in practice to protect EU users’ data, thus imposing an administrative fine of EUR 17 million.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on March 25, the representatives of the local public authorities (LPA) from Soroca district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 41 mayors and local councilors of Soroca district.

The event, moderated by experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 20 million applied by Italian Data Protection Authority (SA) to Clearview AI for illegal personal data processing.

The Italian SA launched an own volition proceeding following press reports on several issues in connection with facial recognition products which were offered by the Clearview AI Inc. Moreover, the Italian SA received, during 2021, four complaints and two alerts by two organizations that are active in the field of protecting privacy and the fundamental rights of individuals against Clearview.

The inquiries and assessment by the Italian SA found several infringements by Clearview AI: the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis, since the legitimate interest of the US-based company does not qualify as such; the company infringed several fundamental principles of the GDPR, such as transparency, purpose limitation, and storage limitation; it failed to provide the information set out by Article 13-14, to provide information on an action taken on a request under Article 15 within the due timeframe, and to designate a representative in the EU.

In this context, Italian SA imposed a ban on any further collection, by way of web scraping techniques, of images and the relevant metadata concerning persons in the Italian territory and on further processing of the standard and biometric data that are handled by the Company via its facial recognition system. Furthermore, ordered erasure of the data, including biometric data, processed by its facial recognition system and designation of a representative in the territory of the European Union.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 62nd Plenary Session of the European Data Protection Board (EDPB), which was held on-line, on 14 March 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Art. 60 GDPR. The drafting of such guidance is part of the EDPB Strategy and Work Programme 2021-2022 to support effective enforcement and efficient cooperation between national supervisory authorities (SAs).

·        Guidelines on dark patterns in social media platform interfaces. The guidelines offer practical recommendations to designers and users of social media platforms on how to assess and avoid so-called “dark patterns” in social media interfaces that infringe on GDPR requirements.

·        A toolbox on essential data protection safeguards for enforcement cooperation between EEA and third country SAs. This contributes to one of the key actions of the EDPB Strategy and Work Programme 2021-2022 and aims to facilitate the engagement between EDPB members and the SAs of third countries. The toolbox covers key topics, such as enforceable rights of data subjects, compliance with data protection principles and judicial redress.

·        A joint EDPB-EDPS opinion on the proposals to extend the Digital COVID Certificate by up to 12 months. The subject will continue to be discussed at the next Plenary Session.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP) trained, on March 11, the representatives of the local public authorities (LPA) from Dondușeni district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Dondușeni district.

The event, moderated by experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP) trained, on February 25, the representatives of the local public authorities (LPA) from Drochia district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Drochia district.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of of EUR 26.5 million applied by Italian Data Protection Authority (SA) to Enel Enegia for illegal personal data processing.

The decision was issued following complex inquiries the SA had started on account of hundreds of complaints by users who had received unsolicited calls made on behalf of Enel Energia, some of them based on pre-recorded messages.

The inquiries by the SA showed an invasive reliance on unsolicited promotional calls without the required consent addressed to users, additionally, the feedback to users’ requests to access their personal data or to object to processing for marketing purposes was delayed or missing altogether.

In the light of the infringements found, the Italian SA imposed a fine of EUR 26.5 million to Enel Energia and ordered to bring all personal data processing into compliance with legal provisions, in order to demonstrate that promotional services or contracts are only activated following promotional calls addressed to numbers that are listed in the Register of Communications Operators. Furthermore, Enel Energia will also have to implement further technical and organisational measures to handle data subjects’ requests to exercise their rights including, in particular, the right to object to processing for promotional purposes – so as to provide feedback on those requests by no later than thirty days.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.