The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 20 million applied by Italian Data Protection Authority (SA) to Clearview AI for illegal personal data processing.

The Italian SA launched an own volition proceeding following press reports on several issues in connection with facial recognition products which were offered by the Clearview AI Inc. Moreover, the Italian SA received, during 2021, four complaints and two alerts by two organizations that are active in the field of protecting privacy and the fundamental rights of individuals against Clearview.

The inquiries and assessment by the Italian SA found several infringements by Clearview AI: the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis, since the legitimate interest of the US-based company does not qualify as such; the company infringed several fundamental principles of the GDPR, such as transparency, purpose limitation, and storage limitation; it failed to provide the information set out by Article 13-14, to provide information on an action taken on a request under Article 15 within the due timeframe, and to designate a representative in the EU.

In this context, Italian SA imposed a ban on any further collection, by way of web scraping techniques, of images and the relevant metadata concerning persons in the Italian territory and on further processing of the standard and biometric data that are handled by the Company via its facial recognition system. Furthermore, ordered erasure of the data, including biometric data, processed by its facial recognition system and designation of a representative in the territory of the European Union.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 62nd Plenary Session of the European Data Protection Board (EDPB), which was held on-line, on 14 March 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Art. 60 GDPR. The drafting of such guidance is part of the EDPB Strategy and Work Programme 2021-2022 to support effective enforcement and efficient cooperation between national supervisory authorities (SAs).

·        Guidelines on dark patterns in social media platform interfaces. The guidelines offer practical recommendations to designers and users of social media platforms on how to assess and avoid so-called “dark patterns” in social media interfaces that infringe on GDPR requirements.

·        A toolbox on essential data protection safeguards for enforcement cooperation between EEA and third country SAs. This contributes to one of the key actions of the EDPB Strategy and Work Programme 2021-2022 and aims to facilitate the engagement between EDPB members and the SAs of third countries. The toolbox covers key topics, such as enforceable rights of data subjects, compliance with data protection principles and judicial redress.

·        A joint EDPB-EDPS opinion on the proposals to extend the Digital COVID Certificate by up to 12 months. The subject will continue to be discussed at the next Plenary Session.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP) trained, on March 11, the representatives of the local public authorities (LPA) from Dondușeni district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Dondușeni district.

The event, moderated by experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP) trained, on February 25, the representatives of the local public authorities (LPA) from Drochia district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Drochia district.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of of EUR 26.5 million applied by Italian Data Protection Authority (SA) to Enel Enegia for illegal personal data processing.

The decision was issued following complex inquiries the SA had started on account of hundreds of complaints by users who had received unsolicited calls made on behalf of Enel Energia, some of them based on pre-recorded messages.

The inquiries by the SA showed an invasive reliance on unsolicited promotional calls without the required consent addressed to users, additionally, the feedback to users’ requests to access their personal data or to object to processing for marketing purposes was delayed or missing altogether.

In the light of the infringements found, the Italian SA imposed a fine of EUR 26.5 million to Enel Energia and ordered to bring all personal data processing into compliance with legal provisions, in order to demonstrate that promotional services or contracts are only activated following promotional calls addressed to numbers that are listed in the Register of Communications Operators. Furthermore, Enel Energia will also have to implement further technical and organisational measures to handle data subjects’ requests to exercise their rights including, in particular, the right to object to processing for promotional purposes – so as to provide feedback on those requests by no later than thirty days.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 3 000 000 applied by Spanish Data Protection Agency (AEPD) to CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. for lack of specific and informed consent regarding profiling for commercial purposes.

An investigation was initiated following several indications that there might be an incorrect practice in relation to the automated profiling and decision-making of the controller in the context of its commercial activity (the controller is a financial establishment and payment institution).

CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U is an entity acting as a financial establishment and payment institution whose business consists of marketing credit or debit cards, credit accounts with or without a card.

In the framework of its commercial activity, Caixabank makes profiles for the following purposes:

·        Analyse the risk of default upon application for a product;

·        Analyse the risk of default during the application for a product;

·        Selection of target audience.

Consent is requested in the various channels of prescribers and agents for study and profiling purposes. Thus, consent is requested in the following terms: “I authorise the CaixaBank Group to use my data for study and profiling purposes”. In the present case, the interested party is provided only with generic information on the different profiling treatments and with this information the interested party is not able to know exactly what the treatment is you are consenting to. Nor is there any provision for the person concerned to express his or her choice on all purposes for which the data are processed.  

In this regard, AEPD fine of EUR 3 000 000 to CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. for lack of specific and informed consent regarding profiling for commercial purposes and ordered the controller to bring processing operations into compliance with the provisions of the GDPR within six months of this decision.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on February 11, the representatives of the local public authorities (LPA) from Edineț district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Edineț district.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the total fine in the amount of EUR 9 250 000 applied by Hellenic Data Protection Authority (DPA) to telecommunications companies COSMOTE and OTE S.A. due to personal data breach and illegal data processing.

Following a personal data breach notification (subscriber call data leakage between 01/09/2020 and 05/09/2020) by COSMOTE S.A., the Hellenic DPA investigated the circumstances under which the breach took place and, in this regard, examined the lawfulness of record-keeping in relation to leaked data, as well as the security measures applied. The investigation of the case revealed that COSMOTE had infringed the principles of legality and transparency due to the provision of unclear and insufficient information to subscribers. The company was also found responsible for poor data protection impact assessment, poor anonymisation, inadequate security measures taken, and failure to allocate the roles of the two companies (COSMOTE / OTE) in relation to the processing in question. In addition, ΟΤΕ S.A. was found to have infringed Article 32 of the GDPR due to inadequate security measures taken in relation to the infrastructure used in the context of the breach.

The Hellenic DPA, on the one hand, fined COSMOTE a total of EUR 6 000 000, and imposed the sanction of stopping the processing and destroying the data, and, on the other, fined OTE S.A. a total of EUR 3 250 000.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on February 4, the representatives of the local public authorities (LPA) from Telenețti district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 80 mayors and local councilors of Telenești district. There was a significant increase in the number of participants at the event, which shows an increased interest on the part of LPAs to comply with the legal provisions in the field of personal data processing.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

Today, January 28, the National Center for Personal Data Protection (NCPDP) in collaboration with TAIEX project experts organizes the National Conference “Challenges of international data transfers from the perspective of the Convention 108+ and GDPR”, held online.

The aim of the Conference is to present information, examples of good practices and innovative solutions on raising awareness and informing the public sector about the challenges of cross-border data transfer.

The event was opened by the Director of the NCPDP, Ms. Victoria Muntean: “ In the context of globalization, the increasing of the need for information exchange through the various means made available by current technology, as well as the rapid technological developments widely used by both EU and other countries, the cross-border transfer of personal data needs to be regulated by new instruments, designed to facilitate the international circulation of data, with the guarantee of respect for the fundamental rights of data subjects and in conformity with data protection legislation, in particular with EU standards, the General Data Protection Regulation and Convention 108+”.

The workshop is conducted by personal data protection experts from Italy, Germany, Austria and the representatives of European Commission. Amongst the topics addressed by the experts are: cross-border transfers of personal data from the perspective of Convention 108+ and global trends, overview of the grounds for the cross-border transfers of personal data under the GDPR and the type of safeguards needed, challenges of cross-border data transfers from the perspective of the EU supervisory authorities, cross-border data transfers in the area of law enforcement cooperation, General information on the concept of adequacy and Substantive and procedural aspects of adequacy decisions.

The event is attended by about 70 representatives of the public sector.

The workshop is organized and funded by the Technical Assistance and Information Exchange Instrument of the European Commission (TAIEX).