People´s personal data are being processed every second – at work, in their relations with public authorities, in the health field, when they buy goods or services, travel or surf the internet.

This year, January 28 marks the 41st anniversary of Convention 108, which was opened for signature on 28 January 1981, and the 16th European Data Protection Day. It is a very special day, not only for the Council of Europe, but for the entire global Data Protection community, and above all, for each and every individual protected by this essential right.

The Republic of Moldova marks this event together with all European states.  Although the field of personal data protection is a relatively new one for the society of the Republic of Moldova, in the last decade we have managed to make great steps in ensuring respect for the right to privacy, as well as regarding our efforts to comply with European standards in the field of personal data protection.

Our role as the National Data Protection Authority is becoming increasingly important and the annual celebration of this day is an opportunity to bring to the attention of the general public the importance of respecting the principles of personal data processing, the right to privacy and the right to personal data protection, enshrined as fundamental rights.

The team of the National Centre for Personal Data Protection wishes you an

EXCELLENT DATA PROTECTION DAY!

The National Center for Personal Data Protection (NCPDP) trained, on January 27, the representatives of the local public authorities (LPA) from Ialoveni district, the event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 55 mayors and local councilors of Ialoveni district.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

Every year, on January 28, European Data Protection Day is celebrated by all Council of Europe member states, with the support of the European Commission to promote the right to privacy and the right to personal data protection.

On the occasion of this day, the National Data Protection Authorities are organizing specific activities to raise awareness and promote privacy and data protection best practices. These activities include street actions aimed to raise awareness and inform the general public about the field of personal data protection.

In this context, today, January 26, a few employees of National Center for Personal Data Protection (NCPDP) distributed to passers-by, near the Cathedral Square, information materials, raising awareness among citizens about the concept of personal data, the rights of personal data subjects, security and confidentiality measures when processing data. At the same time, they were informed about the possible situations in which personal data are not processed in accordance with the provisions of national legislation in this field, providing them with practical guidance and recommendations that should be undertaken in such situations.

This year, NCPDP aims to organize more information and awareness-raising activities for the general public in order to educate, motivate and encourage Moldovan citizens to pay more attention to the protection of their personal data.

On 10 December 2021, Law No. 175 of 11 November 2021 on the amendment of certain legal acts was published in the Official Gazette of the Republic of Moldova, which contains amendments in the field of personal data protection.

By the mentioned normative act, some provisions of the Law no. 133/2011 on personal data protection were amended, including:

–         New wording of the notion “consent of the data subject”, being excluded the obligation to express consent in written or electronic form.

–         Exclusion of the obligation for personal data controllers to notify the National Centre for Personal Data Protection (NCPDP). Thus, the notification procedure has been replaced by an obligation for the controller to carry out a Data Protection Impact Assessment, if personal data processing is likely to result in an increased risk to the rights and freedoms of individuals.

–          Introduction of the obligation for the controller and for the processor to designate the Data Protection Officer.

–         Repeal of art. 28 of Law 133/2011 on personal data protection, following that the Record Register of personal data controllers will be deleted, within two months from the publication of Law no. 175/2021 in the Official Gazette.

–         Rewording of Article 32 of Law 133/2011 on personal data protection, with amendments relating to the cross-border transfer of personal data and approval of the list of states ensuring an adequate level of personal data protection.

Similarly, amendments have been made to the provisions of the Contravention Code of the Republic of Moldova, in terms of contraventions attributable to the processing of personal data in violation of the legislation on personal data protection.

It should be noted that Law no. 175/2021 will enter into force within 30 days of its publication in the Official Gazette.

The NCPDP received a complaint from a data subject, requesting the verification of the legality processing of his personal data, manifested by the transmission, by a district health center, of information on his health, in the address to a lawyer, who would subsequently present them at the court hearing, considering that through these actions his private and family life had been harmed.

According to Law no. 133/2011 on personal data protection, data on patient health, results of investigations, diagnosis, prognosis, treatment, entered in the medical documentation of a patient, constitute special categories of personal data, these having an increased level of protection.

In this context, when examining the case, NCPDP took into account the provisions of Law no. 133/2011 on personal data protection, order in which, in the light of art. 6 and 7 of the Law on personal data protection, the processing of personal data on health status would be allowed only if personal data subject has given his consent or one of the following situations has occurred:

–       processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment law, providing safeguards set by law, as well as taking into account that possible disclosure of the personal data processed for this purpose to a third party may take place only if there is an appropriate legal obligation of the controller, therefore;

–       processing is necessary to protect the life, physical integrity or health of the personal data subject or of another person where the data subject is physically or legally incapable of giving his consent;

–       processing relates to data which are voluntary and manifestly made public by the personal data subject;

–       processing is necessary to establish, exercise or defend of legal claims of the personal data subject;

–       processing is necessary for the purposes to ensure national security, of reducing the risk of unleashing or in case of triggering public health emergencies where the processing is unlikely adversely to affect the rights of personal data subject and the other appropriate safeguards provided for in this law.

Alternative, art. 29 para. (1) of Law no. 133/2011 on personal data protection, establishes the obligation of controllers and third parties who have access to personal data to ensure the confidentiality of those data, except where:

a)     processing relates to data which are voluntary and manifestly made public by the personal data subject;

b)    personal data are rendered anonymous.

In accordance with the provisions mentioned above, art. 14 of the Health Care Law, states that doctors, other health care workers, pharmacists are obliged to keep secret the information regarding the disease, the intimate and family life of the patient, except the cases of danger of spread of communicable diseases, at the motivated request of the criminal investigation bodies or of the courts.

Also, the provisions of Law on the rights and responsibilities of the patient 263/2005 which contains special legal rules aimed at strengthening fundamental human rights in the health care system, ensuring respect for the dignity and integrity of the patient, and based on the nature of sensitive health data, establishes strict conditions for their disclosure. It will be emphasized that patient health data, by their nature, may present a risk for data subjects when are processed and therefore require increased protection. These data are subject to a prohibition principle and there must be a limited number of circumstances in which such processing is lawful. At the same time, the confidentiality of medical data is a professional secret, which is a form of the right to respect for privacy. Prohibition of the disclosure of medical information, classified as confidential, is necessary to ensure that medical institutions ensure the patient’s right to privacy.

In this regard, given the content of the medical certificate issued to the lawyer, NCPDP found that the disclosure of information on the nature of data subject’s diseases, which represents data on health, time of treatment, and date of the last visit to the health center, took place contrary to the legal provisions mentioned above and the principles of personal data processing provided in art. 4 para. (1) let. a) and b), as well as art. 6, 7 and art. 29 of Law no. 133/2016 on personal data protection, an action classified within the contravention norm provided by art. 741 para. (4) Contravention Code.

Following the examination of the case, NCPDP issued the decision regarding the violation of the principles of personal data processing and concluded the report on the contravention, being referred to the court and as a result the person in charge of the district health center was found guilty of committing the contravention provided by art. 741 para. (4) Contravention Code.

Recommendations:

Taking into account the provisions of art. 53 of the Law on Advocacy, in conjunction with art. 5 para. (5) of the Law on personal data protection, the request for information by a lawyer is a right and not an obligation of a lawyer. Respectively, it cannot be retained as the legal basis of the data controller – district health center, for the disclosure of personal data concerning the personal data subject, as long as the processing was not necessary for the express fulfillment of an obligation directly to the controller according to the law, the representative of the entity being obliged to ensure the confidentiality of personal data.

However, the NCPDP notes that, in a trial, in order to avoid a serious violation of the principles of personal data protection by their unauthorized disclosure, the resolution of requests for access to personal data on health status will be achieved taking into account the provisions of art. 118 Code of Civil Procedure, according to which the circumstances that are important for the fair settlement of the case are definitively determined by the court based on the claims and objections of the parties and other participants in the trial, as well as the following material and procedural law to be applied.

Respectively, the parties or other participants in the trial may address to the court (judge), pursuant to art. 119 Code of Civil Procedure, a request for evidence, and the judge, analyzing the reasons invoked in the request for evidence and assessing the proportionality of the volume of information for solving the civil case, will request the necessary evidence from organizations and individuals.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on November 5, the representatives of the local public authorities (LPA) from Râșcani district. The training course aimed to strengthen the capacities of LPA representatives and to familiarize, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; depersonalization of data within Local Documents Registry; approval of security policy and personal data filling systems instructions, etc.

The training was organized at the initiative of NCPDP, the event being attended by about 60 mayors, local councilors and secretaries of local councils of Râșcani district.

The event, moderated by three experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

On November 11, 2021, the National Center for Personal Data Protection at the request of Fălești district Council, organized a training course for the representatives of local public authorities from Fălești district, to ensure proper implementation of the provisions of personal data protection legislation. The training took place physically, at the request of Fălești district Council and was attended by about 55 persons.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; data subjects’ rights; approval of security and confidentiality of personal data within filling systems.

Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities in the State Local Documents Registry were discussed, according the point 13 sub-point 7) of the Regulation on the manner of keeping the State Local Documents Registry.

At the end, the participants in the training asked questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

On 18 November 2021, the National Center for Personal Data Protection (NCPDP) and the Office of the Information and Data Protection Commissioner of Malta signed a Collaboration Agreement in the field of personal data protection. The Agreement was signed by the Director of NCPDP, Eduard Răducan, and the Commissioner of the Office of the Information and Data Protection of Malta, Ian Deguara, during the Plenary Session of the European Data Protection Board, Brussels, Belgium.

The Agreement provides for the development of cooperation relations between the two institutions in terms of achieving constant progress in the field of personal data protection and the promotion of good practices that will create favorable conditions for ensuring effective protection of personal data of Malta’s and Moldova’s citizens.

The NCPDP states that the agreement is aimed at various activities that will encourage the exchange of information on the application of European laws, regulations, standards and recommendations in the field of personal data protection, the exchange of short-term experts for mutual professional development in specific sectors, cooperation in vocational training and qualification, consultations, conferences, workshops, study visits, organization of activities focused on promoting the protection of privacy and personal data protection, cooperation in order to organize projects of common interest for both institutions at regional and national level, etc.

We remind you that the NCPDP has concluded another 14 national collaboration agreements with institutions from different fields of activity, as well as 8 international collaboration agreements with the Personal Data Protection Authorities from Romania, Ukraine, Georgia, Italy, Hungary, Latvia, etc.

On November 19, was held the Public Action – “Protect personal data”, organized by NCPDP representatives. The target audience – the inhabitants of Ialoveni district, were informed about the importance of personal data protection.

The action took place near Ialoveni District Council and the citizens were informed about the notion of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. At the same time, the citizens were informed on possible situations in which personal data are not processed in accordance with the provisions of the national legislation in the field, by personal data controllers, and the representative of the Legal Department provided them with practical guidance and recommendations that should be undertaken in such situations.

The purpose of this action was to educate, motivate and encourage the citizens of the Republic of Moldova to pay more attention to the protection of their personal data.