On 19-20 October in Brussels, Belgium, the Deputy Director of the National Centre for Personal Data Protection, Angela Colomiicenco, participated in the meeting of the RM – EU Subcommittee on Freedom, Security and Justice.

The main topics discussed in the meeting were: developments in personal data protection, justice sector reform, preventing and combating organised crime, corruption and other illegal activities, money laundering and terrorist financing.

In the meeting was also presented the main developments in the above-mentioned areas since the last meeting held online on 12-13 October 2021.

At the meeting participated the representatives of several Moldovan authorities, such as: the National Anti-Corruption Centre; the General Prosecutor’s Office; the National Integrity Authority; the Ministry of Internal Affairs; the National Institute of Justice; the Service for Preventing and Combating Money Laundering.

National Centre for Personal Data Protection (NCPDP), for information purposes, communicates about the meeting of the National Centre for Personal Data Protection Director, Ms Victoria Muntean, with the Ambassador Extraordinary and Plenipotentiary of the Republic of Moldova to the Kingdom of Belgium, Mr Viorel Cibotaru.

The purpose of the meeting was to address the most pressing issues in the field of personal data protection, as well as to identify mechanisms for collaboration and development of bilateral relations between the NCPDP and the Belgian institutions, in order to align the national legislation with European standards and the acquis communautaire. The Ambassador demonstrated openness and willingness to facilitate the implementation of further strategies to develop the field of personal data protection in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC  (GDPR) and taking over best practices from EU Member States.

The event took place on October 11, at the headquarters of the Embassy of the Republic of Moldova to the Kingdom of Belgium.

From 26 to 28 September, the representatives of the Centre are conducting a study visit “Data Protection Impact Assessment and the role of the Data Protection Officer”. The event is hosted by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

The aim of the study visit is to take over the best legal and operational practices by the National Centre for Personal Data Protection on Data Protection Impact Assessment (DPIA) mechanisms, processing operations requiring a DPIA, as well as the role of the Data Protection Officer (DPO) within companies/state institutions that are personal data controllers.

During the 3 days there will be an in-depth analysis of processing operations requiring a DPIA; the role of the DPO; data breach risks, transfer of personal data to third countries, as well as the practical part which will be hosted by Telecom Italia S.P.A.

The study visit is organised with the support of the EU project TAIEX – Technical Assistance and Information Exchange Instrument, managed and funded by the Directorate-General for Neighbourhood and Enlargement Negotiations (DG NEAR) of the European Commission.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 70 000 euros applied by the Italian Data Protection Authority (SA) to Unicredit for the infringement of Article 5.1(a), Article 12 and 15 of GDPR.

Following investigations, the Italian SA found that Unicredit SpA rejected a data subject’s request for access to personal data on the grounds that a pre-established form had not been completed. The form itself was found to be incomplete and misleading as to the actual scope of the right at issue. The company considered it was free to discard access requests that were submitted without using the given form and replied to the data subject only after the latter lodged his complaint.  In that respect, the Italian SA clarified that an access request could not be dealt with by delivering the information notice as per Articles 13 and 14 GDPR; the right of access to one’s personal data and the right to be informed, though mutually related, are different rights which are set forth in separate provisions of the GDPR and are intended to afford safeguards and protection in ways that are not fully superimposable. The Italian SA recalled the EDPB Guidelines 1/2022 on data subject rights (right of access) in this connection and imposed a fine in the amount of 70 000 euros.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 250 000 euros applied by the French Data Protection Authority (CNIL) to INFOGREFFE for the infringement of Article 5.1.e and Article 32 of the GDPR

Following a complaint, CNIL, carried out an online investigation of the infogreffe.fr website, which allows users to consult legal information on companies and order documents certified by the commercial court registries. The investigations focused in particular on the data retention periods defined and the security measures implemented by the economic interest group INFOGREFFE, which provides the legal information publishing service on companies via the website.

Following the investigation was found:

·        Failure to comply with the obligation to keep data for a period of time proportionate to the purpose of the processing (Article 5.1.e of the GDPR);

·        Failure to comply with the obligation to ensure the security of personal data (Article 32 of the GDPR);

On the basis of these findings, CNIL issued a fine of 250 000 euros on INFOGREFFE, and decided to make it public. This decision was taken in cooperation with the other European authorities concerned, as user accounts were created from all EU Member States.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 69th Plenary Session of the European Data Protection Board (EDPB), which was held on 12-13 September at Brussels, Belgium.

 During the Plenary, the EDPB adopted several documents, among which:

• A Statement on the European Commission’s proposal for an EU Police Cooperation Code. This proposal aims to enhance law enforcement cooperation across Member States, in particular the information exchange between the competent authorities. The code is comprised of three main measures: proposal for a Prüm II Regulation, proposal for a Police Information Exchange Directive and the proposal for a Council Recommendation on operational police cooperation.
• EDPB decided upon the topic for its second coordinated enforcement action, which will concern the designation and position of the data protection officer. In a coordinated action, the EDPB prioritises a certain topic for data protection authorities (DPAs) to work on at the national level. The results of these national actions are then bundled and analysed, generating deeper insight into the topic and allowing for targeted follow-up on both the national and the EU level. This new coordinated action follows the EDPB’s decision to set up a Coordinated Enforcement Framework (CEF) in October 2020. The CEF is a key action of the EDPB under its 2021-2023 Strategy, together with the creation of a Support Pool of Experts. The two initiatives aim to streamline enforcement and cooperation among DPAs.
• The EDPB met with representatives from civil society organisations to discuss the challenges posed to enforcement cooperation by different procedural approaches in national law. This is a next step towards the EDPB’s objective to develop an overview of such challenges, as set out in its Vienna Statement on enforcement cooperation.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

Today, September 22, the representatives of LPAs from Leova district were trained in the field of personal data protection. The training course entitled: “Requirements, principles and new trends in the field of personal data protection”, aimed to strengthen the capacities of LPAs representatives by familiarizing, raising awareness and informing them with the field of data protection.

The most important topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; processing of special categories of personal data; depersonalization of personal data in the State Local Documents Registry.

The event was hosted by Leova District Council and was attended by 37 representatives. The participants asked questions to the trainers regarding the practical application of the legislation in the field of personal data protection.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 175 00 euros applied by the French Data Protection Authority (DPA) to UBEEQO International for the illegally processing of personal data.

This case is part of the priority control theme in 2020 relating to the new uses of geolocation data in the context of mobility. In this context, the French DPA controlled the company UBEEQO International, whose activity is the rental of vehicles for a short period. The investigations focused in particular on the data collected, the defined retention periods, the information provided to individuals and the security measures implemented.

Following the investigations, French DPA found several violations, such as:

·        Failure to comply with the obligation to ensure data minimisation (Article 5.1.c of the GDPR).

·        Failure to define and respect a proportionate data retention period (Article 5.1.e of the GDPR).

·        Failure to inform individuals (Article 12 of the GDPR).

 On the basis of these findings, the restricted committee – the CNIL’s body in charge of issuing sanctions – in cooperation with the other European authorities concerned (in Belgium, Denmark, Spain, Italy and Germany) imposed a fine of 175 000 euros to UBEEQO International, which was made public.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of 20 million euros applied by the Hellenic Data Protection Authority (DPA) to Clearview AI for violating the principles of lawfulness and transparency of personal data processing.

Hellenic DPA examined a complaint against Clearview AI, lodged by the civil non-profit organization “Homo Digitalis” on behalf of a complainant, who claimed that s/he has objections to the realisation of the right of access s/he exercised before the aforementioned company. In conjunction with the issues deplored, it was also requested that the practices of the defendant company be examined on the whole from the point of view of ensuring personal data protection.

Following the investigations, it was found that the company, which markets facial recognition services, violated the principles of lawfulness and transparency stipulated at Art. 5 paragraphs 1(a) and (2), 6, 9 GDPR and its obligations under Articles 12, 14, 15 and 27 of the GDPR.

In this context, Hellenic DPA imposed a fine of 20 million euros to Clearview AI for violating the principles of lawfulness and transparency on personal data processing. In addition, the DPA ordered the company to conform its activity so as to realise the right of access to personal data of data subjects, while imposing (on the same company) a prohibition on the collection and processing of personal data of subjects located in the Greek territory, using methods included in the facial recognition service. Finally, with this Decision, the Hellenic DPA ordered Clearview AI Inc. to delete the personal data of those subjects located in Greece, which the defendant collects and processes using the aforementioned methods.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) and Personal Data Protection Office of Poland signed a Collaboration Agreement in the field of personal data protection. The Agreement was signed by the Director of NCPDP, Ms Victoria Muntean and President of the Personal Data Protection Office, Mr Jan Nowak.

The Agreement provides for the development of cooperation relations between the two institutions in terms of achieving constant progress in the field of personal data protection and the promotion of good practices that will create favorable conditions for ensuring effective protection of personal data of Poland’s and Moldova’s citizens, which is significant in the context of the recent granting of the status of EU candidate country of the Republic of Moldova.

The NCPDP states that the agreement is aimed at various activities that will encourage the exchange of information on the application of European laws, regulations, standards and recommendations in the field of personal data protection, as well as the organization of activities focused on promoting the protection of privacy and personal data protection, cooperation in order to organize projects of common interest for both institutions at regional and national level, etc.

We remind you that the NCPDP has concluded another 17 national collaboration agreements with institutions from different fields of activity, as well as 9 international collaboration agreements with the Personal Data Protection Authorities from countries such as Romania, Ukraine, Georgia, Italy, Hungary, Latvia, Malta.