The NCPDP received a complaint from a data subject, requesting the verification of the legality processing of his personal data, manifested by the transmission, by a district health center, of information on his health, in the address to a lawyer, who would subsequently present them at the court hearing, considering that through these actions his private and family life had been harmed.

According to Law no. 133/2011 on personal data protection, data on patient health, results of investigations, diagnosis, prognosis, treatment, entered in the medical documentation of a patient, constitute special categories of personal data, these having an increased level of protection.

In this context, when examining the case, NCPDP took into account the provisions of Law no. 133/2011 on personal data protection, order in which, in the light of art. 6 and 7 of the Law on personal data protection, the processing of personal data on health status would be allowed only if personal data subject has given his consent or one of the following situations has occurred:

–       processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment law, providing safeguards set by law, as well as taking into account that possible disclosure of the personal data processed for this purpose to a third party may take place only if there is an appropriate legal obligation of the controller, therefore;

–       processing is necessary to protect the life, physical integrity or health of the personal data subject or of another person where the data subject is physically or legally incapable of giving his consent;

–       processing relates to data which are voluntary and manifestly made public by the personal data subject;

–       processing is necessary to establish, exercise or defend of legal claims of the personal data subject;

–       processing is necessary for the purposes to ensure national security, of reducing the risk of unleashing or in case of triggering public health emergencies where the processing is unlikely adversely to affect the rights of personal data subject and the other appropriate safeguards provided for in this law.

Alternative, art. 29 para. (1) of Law no. 133/2011 on personal data protection, establishes the obligation of controllers and third parties who have access to personal data to ensure the confidentiality of those data, except where:

a)     processing relates to data which are voluntary and manifestly made public by the personal data subject;

b)    personal data are rendered anonymous.

In accordance with the provisions mentioned above, art. 14 of the Health Care Law, states that doctors, other health care workers, pharmacists are obliged to keep secret the information regarding the disease, the intimate and family life of the patient, except the cases of danger of spread of communicable diseases, at the motivated request of the criminal investigation bodies or of the courts.

Also, the provisions of Law on the rights and responsibilities of the patient 263/2005 which contains special legal rules aimed at strengthening fundamental human rights in the health care system, ensuring respect for the dignity and integrity of the patient, and based on the nature of sensitive health data, establishes strict conditions for their disclosure. It will be emphasized that patient health data, by their nature, may present a risk for data subjects when are processed and therefore require increased protection. These data are subject to a prohibition principle and there must be a limited number of circumstances in which such processing is lawful. At the same time, the confidentiality of medical data is a professional secret, which is a form of the right to respect for privacy. Prohibition of the disclosure of medical information, classified as confidential, is necessary to ensure that medical institutions ensure the patient’s right to privacy.

In this regard, given the content of the medical certificate issued to the lawyer, NCPDP found that the disclosure of information on the nature of data subject’s diseases, which represents data on health, time of treatment, and date of the last visit to the health center, took place contrary to the legal provisions mentioned above and the principles of personal data processing provided in art. 4 para. (1) let. a) and b), as well as art. 6, 7 and art. 29 of Law no. 133/2016 on personal data protection, an action classified within the contravention norm provided by art. 741 para. (4) Contravention Code.

Following the examination of the case, NCPDP issued the decision regarding the violation of the principles of personal data processing and concluded the report on the contravention, being referred to the court and as a result the person in charge of the district health center was found guilty of committing the contravention provided by art. 741 para. (4) Contravention Code.

Recommendations:

Taking into account the provisions of art. 53 of the Law on Advocacy, in conjunction with art. 5 para. (5) of the Law on personal data protection, the request for information by a lawyer is a right and not an obligation of a lawyer. Respectively, it cannot be retained as the legal basis of the data controller – district health center, for the disclosure of personal data concerning the personal data subject, as long as the processing was not necessary for the express fulfillment of an obligation directly to the controller according to the law, the representative of the entity being obliged to ensure the confidentiality of personal data.

However, the NCPDP notes that, in a trial, in order to avoid a serious violation of the principles of personal data protection by their unauthorized disclosure, the resolution of requests for access to personal data on health status will be achieved taking into account the provisions of art. 118 Code of Civil Procedure, according to which the circumstances that are important for the fair settlement of the case are definitively determined by the court based on the claims and objections of the parties and other participants in the trial, as well as the following material and procedural law to be applied.

Respectively, the parties or other participants in the trial may address to the court (judge), pursuant to art. 119 Code of Civil Procedure, a request for evidence, and the judge, analyzing the reasons invoked in the request for evidence and assessing the proportionality of the volume of information for solving the civil case, will request the necessary evidence from organizations and individuals.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on November 5, the representatives of the local public authorities (LPA) from Râșcani district. The training course aimed to strengthen the capacities of LPA representatives and to familiarize, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; depersonalization of data within Local Documents Registry; approval of security policy and personal data filling systems instructions, etc.

The training was organized at the initiative of NCPDP, the event being attended by about 60 mayors, local councilors and secretaries of local councils of Râșcani district.

The event, moderated by three experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

On November 11, 2021, the National Center for Personal Data Protection at the request of Fălești district Council, organized a training course for the representatives of local public authorities from Fălești district, to ensure proper implementation of the provisions of personal data protection legislation. The training took place physically, at the request of Fălești district Council and was attended by about 55 persons.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; data subjects’ rights; approval of security and confidentiality of personal data within filling systems.

Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities in the State Local Documents Registry were discussed, according the point 13 sub-point 7) of the Regulation on the manner of keeping the State Local Documents Registry.

At the end, the participants in the training asked questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

On 18 November 2021, the National Center for Personal Data Protection (NCPDP) and the Office of the Information and Data Protection Commissioner of Malta signed a Collaboration Agreement in the field of personal data protection. The Agreement was signed by the Director of NCPDP, Eduard Răducan, and the Commissioner of the Office of the Information and Data Protection of Malta, Ian Deguara, during the Plenary Session of the European Data Protection Board, Brussels, Belgium.

The Agreement provides for the development of cooperation relations between the two institutions in terms of achieving constant progress in the field of personal data protection and the promotion of good practices that will create favorable conditions for ensuring effective protection of personal data of Malta’s and Moldova’s citizens.

The NCPDP states that the agreement is aimed at various activities that will encourage the exchange of information on the application of European laws, regulations, standards and recommendations in the field of personal data protection, the exchange of short-term experts for mutual professional development in specific sectors, cooperation in vocational training and qualification, consultations, conferences, workshops, study visits, organization of activities focused on promoting the protection of privacy and personal data protection, cooperation in order to organize projects of common interest for both institutions at regional and national level, etc.

We remind you that the NCPDP has concluded another 14 national collaboration agreements with institutions from different fields of activity, as well as 8 international collaboration agreements with the Personal Data Protection Authorities from Romania, Ukraine, Georgia, Italy, Hungary, Latvia, etc.

On November 19, was held the Public Action – “Protect personal data”, organized by NCPDP representatives. The target audience – the inhabitants of Ialoveni district, were informed about the importance of personal data protection.

The action took place near Ialoveni District Council and the citizens were informed about the notion of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. At the same time, the citizens were informed on possible situations in which personal data are not processed in accordance with the provisions of the national legislation in the field, by personal data controllers, and the representative of the Legal Department provided them with practical guidance and recommendations that should be undertaken in such situations.

The purpose of this action was to educate, motivate and encourage the citizens of the Republic of Moldova to pay more attention to the protection of their personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 57th Plenary Session of the European Data Protection Board (EDPB), which was held on 18 November 2021, at Brussels, Belgium.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on the interplay between Art. 3 and Chapter V GDPR. By clarifying the interplay between the territorial scope of the GDPR (Art. 3) and the provisions on international transfers in Chapter V, the Guidelines aim to assist controllers and processors in the EU in identifying whether a processing operation constitutes an international transfer, and to provide a common understanding of the concept of international transfers. The Guidelines will be subject to public consultation until the end of January.

·        Statement on the European Commission’s Digital Services Package and Data Strategy. In its statement, the EDPB reiterates its call for a ban on any use of Artificial Intelligence for an automated recognition of human features in publicly accessible spaces and urges the co-legislator to consider a phase-out leading to a prohibition of targeted advertising on the basis of pervasive tracking while the profiling of children should overall be prohibited.

·        Finally, the EDPB nominated two representatives from the Belgian and Hessen (DE) SA to take part in the 6th Joint Review of the EU-US Terrorist Finance Tracking Program (TFTP) Agreement.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP) trained, on October 7, the representatives of the local public authorities (LPA) from Căușeni district. The training course aimed to strengthen the capacities of LPA representatives and to familiarize, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; depersonalization of data within Local Documents Registry; approval of security policy and personal data filling systems instructions, etc.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Căușeni district.

The event, moderated by three experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management in the 53rd meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online on 28 – 30 September, 2021.

During the Meeting, several topics were discussed, among which:

·        Convention 108+ State of play, ratifications and accessions;

·        Evaluation and follow up mechanism under Convention 108+;

·        Digital identity;

·        Personal data processing by and for political campaigns;

·        Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·        Contractual clauses in the context of transborder data flows;

·        Cooperation with other Council of Europe bodies and entities;

·        Major developments and activities in the field of data protection, etc.

At the same time, NCPDP as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the meeting of the Bureau of the Consultative Committee of the Convention 108, as well as the weight of adopted documents.

On September 6, 2021, the National Center for Personal Data Protection (NCPDP) performed a training course for the employees of the National Administration of Penitentiaries to ensure the compliant implementation of the provisions of the legislation on personal data protection. The training was held online at the request of the National Administration of Penitentiaries and was attended by 30 employees.

The topics addressed in the training were: general notions on personal data protection, the principles of personal data protection, data subjects’ rights, assurance the security and confidentiality of personal data within the personal data filling systems.

At the end, the participants in the training asked questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of the representatives of the institution at the 51st Plenary Session of the European Data Protection Board (EDPB), which was held online on 7 July, 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Codes of Conduct (CoCs) as a tool for transfers. The main purpose of the guidelines is to clarify the application of articles 40 (3) and 46 (2) (e) of the GDPR.

·        A final version of the Guidelines on Virtual Voice Assistants (VVA). The Guidelines aim to provide recommendations to relevant stakeholders on how to address some of the most relevant compliance challenges for VVAs.

·        Guidelines on the concepts of Controller and Processor. These Guidelines aim to provide clarifications concerning fundamental concepts such as (joint) controller and processor.

·        Following the establishment of TikTok in the EU and the identification of its main establishment in Ireland for the ongoing cases related to the TikTok app, the EDPB decided to disband its TikTok Taskforce. This Taskforce was created to coordinate potential actions from the EEA supervisory authorities (SAs) and to acquire a more comprehensive overview of TikTok’s processing and practices across the EU. At the time the Taskforce was created, there was no main establishment for TikTok in the EU and the Taskforce aimed to facilitate the exchange of information between SAs. Now, the One-Stop-Shop procedure applies and the Irish SA (DPC) was designated as the lead authority in charge of the files.

·        EDPB discussed possible topics for its first coordinated enforcement action, following the EDPB’s decision to set up a Coordinated Enforcement Framework on 20 October 2020. The EDPB decided that the first action will concern the use of cloud-based services by public sector bodies and further work will now be carried out to specify the details and the scope in the upcoming months.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.