Annually, on July 10, the National Center for Personal Data Protection (NCPDP) celebrates the establishment of the institution as an autonomous and independent public authority that aims to respect the fundamental rights and freedoms of individuals with regard to personal data processing, in particular the right to inviolability of intimate, family and private life.

On this occasion, one of the activities organized by the NCPDP representatives, was to raise awareness among the general public about the importance of personal data protection.

The action took place near the Arc de Triomphe and the citizens were informed about the notion of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. At the same time, the citizens were informed on possible situations in which personal data are not processed in accordance with the provisions of the national legislation in the field, by personal data controllers.

The purpose of this action was to educate, motivate and encourage the citizens of the Republic of Moldova to pay more attention to the protection of their personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of NCPDP management in the 41st Plenary Meeting of the Consultative Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online on 28-30 June, 2021.

Over 150 participants from States Parties to Convention 108 and observers to the Committee of all parts of the world met virtually to discuss and work on topical subjects concerning data protection, finalise important documents and contribute to the elaboration of politics.

During the Plenary Meeting, several topics were discussed, among which: work programme 2022-2025; Convention 108+ State of play, ratifications and accessions; evaluation and follow up mechanism under Convention 108+; law enforcement transborder access to data; digital identity; personal data processing by and for political campaigns; automatic Exchange of data; cooperation with other Council of Europe bodies and entities; major developments and activities in the field of data protection, etc.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Meetings organized by the Consultative Committee of the Convention 108, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of of 12 million SEK (1 193 813 €) applied by Swedish Authority for Privacy Protection (IMY) Medhelp and about the administrative sanction towards Voice Integrate of 650 000 SEK (64 665 €) for the recorded phone calls to the medical consultation service, 1177, which were available and unprotected on the Internet.

In 2019, Swedish media reported that recorded phone calls to the Swedish medical consultation service, 1177, had been available without password protection or other security measures on a web server. IMY, the Swedish DPA, initiated first an investigation of one of the organisations involved in the service. Subsequently, the investigation was extended to include overall six organisations: three companies and three regions in Sweden. 1177 Vårdguiden is a medical service that is offered and owned by all 21 regions (counties) in Sweden. It is a service that gathers information about health and medical care and is available online as well as over the phone. Every call to the phone number 1177 is first directed to the company Inera who administers and develops the joint systems. Calls to 1177 from the regions of Stockholm, Sodermanland and Varmland were at the time of the incident connected through Inera to the company Medhelp AB who answered the calls.

Recently, the Swedish Data Protection Authority finalized its investigation. The cause of the incident was that a network attached storage unit had been incorrectly configured and was thereby accessible on public internet. In addition, the unit did not use encrypted communication. Consequently, a vast amount of calls became available without password protection or other security protection. The only thing that was necessary in order to get access to the files with the phone calls was to know the IP address of the storage unit.

Further to the contraventions that were established, the IMY has issued an administrative sanction of 12 million SEK (1 193 813 €) towards Medhelp. In addition, Voice Integrate, in its role as personal data processor, had an obligation to take appropriate and adequate measures to protect the files with recordings that the company handled on behalf of Medhelp. Therefore, IMY has issued an administrative sanction towards Voice Integrate of 650 000 SEK (64 665 €).

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 50th Plenary Session of the European Data Protection Board (EDPB), which was held online on 18 June, 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        A final version of the Recommendations on supplementary measures following public consultation. The Recommendations were first adopted in November 2020 following the CJEU Schrems II ruling. They aim to assist controllers and processors acting as data exporters with their duty to identify and implement appropriate supplementary measures where they are needed to ensure an essentially equivalent level of protection to the data they transfer to third countries.

·        A letter addressed to EU Institutions on the privacy and data protection aspects of a possible digital euro. In the letter, the EDPB stresses that a very high standard of privacy and data protection is crucial to reinforce the trust of end users and should be considered a distinctive element in the offering of a digital euro, representing a key factor of success. The EDPB further indicates that it stands ready to provide advice to the ECB or other EU institutions.

·        Designated three representatives to the European Travel Information and Authorisation System’s (ETIAS) Fundamental Rights Guidance Board, which is tasked to evaluate the impact of the processing of applications and will play an important role in ensuring the system’s compliance with fundamental rights, in particular with regard to privacy and personal data protection.

·        A joint opinion on the European Commission’s Proposal for a Regulation laying down harmonised rules on artificial intelligence (AI).

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

Experience of the National Center for Personal Data Protection, a benchmark for the Data Protection Authority of the Republic of Belarus

On May 21, 2021, the Management of the National Center for Personal Data Protection (NCPDP) had a working meeting with the Management of the newly created institution at national level, responsible for the field of personal data protection from the Republic of Belarus.

The meeting took place online and was focused on the experience of the Republic of Moldova regarding the application of legislation in the field of personal data protection both at national and international level, the State Register of personal data controllers, the requirements for ensuring personal data security when processing them within the personal data filing systems as well as other aspects related to the proper functioning of an institution.

In this context, the NCPDP team wishes good luck to their colleagues of the Data Protection Authority of the Republic of Belarus and expresses its readiness to continue to provide them with the necessary support.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management in the 52nd meeting of the Bureau of the Consultative Committee of the Convention  for the protection of individuals with regard to automating processing of personal data, which was held online on 24 -26 March, 2021.

During the Meeting, several topics were discussed, among which:

·        Convention 108+ State of play, ratifications and accessions;

·        Evaluation and follow up mechanism under Convention 108+;

·        Law enforcement transborder access to data;

·        Digital identity;

·        Personal data processing by and for political campaigns;

·        Automatic Exchange of data;

·        Cooperation with other Council of Europe bodies and entities;

·        Major developments and activities in the field of data protection, etc.

At the same time, during the Meeting, a topic of major importance related to COVID-19 vaccination certificates was addressed. The representatives of the Committee on Bioethics (DH-BIO), as well as the representatives of the Secretariat, made a considerable contribution in this regard. In this context, will be submitted to delegations the draft Statement on “Covid-19 Vaccination, digital attestations and data protection”

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection Director at the 46th Plenary session of the European Data Protection Board (EDPB), which was held online.

During the mentioned Session, a wide range of topics were discussed, among which:

•           EDPB adopted its Work Programme for 2021-2022, according to Article 29 of the EDPB Rules of Procedure.

 •          The EDPB adopted a Statement on the draft ePrivacy Regulation. “The ePrivacy Regulation must not – under no circumstances – lower the level of protection offered by the current ePrivacy Directive, and should complement the GDPR by providing additional strong guarantees for confidentiality and protection of all types of electronic communication” said Andrea Jelinek, EDPB Chair.

•           The EDPB adopted Guidelines 02/2021 on Virtual Voice Assistants (VVAs). These Guidelines aim to identify some of the most relevant compliance challenges for VVAs and to provide recommendations to relevant stakeholders on how to address them. The Guidelines will be submitted for public consultation for a period of six weeks.

•           The EDPB adopted a final version of the Guidelines 01/2021 on Connected Vehicles following public consultation. The Guidelines focus on the processing of personal data in relation to the non-professional use of connected vehicles by data subjects. The final version integrates updated wording, and further clarifications in order to address comments and feedback received during the public consultation.

•           The EDPB adopted EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance.

•           The EDPB adopted, following public consultation, the Guidelines 09/2020 on relevant and reasoned objection.

•           Furthermore, the EDPB discussed the draft UK adequacy decisions, which were received from the European Commission.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents, in order to align national data protection legislation to EU standards.

The National Center for Personal Data Protection trained for three days (February 17, 18, 19) the local authorities from the north, center and south of the Republic of Moldova. The training aimed at familiarizing the participants with video surveillance and live streaming of local councils’ meetings.

”Depersonalization of individual documents, access to information, provision of information to legal entities, protection of access to state registers, audit of accesses, data security and confidentiality, but also the need to register local public authorities as data controllers were the most important aspects, to which the attention of the local authorities, who participated in the training was drawn”, explained Denis Coțofan, interim deputy head of the Legal Department of NCPDP.

The participants in the training were interested in: how the meetings of the local councils are to be live streamed, who is responsible for their live streaming and how the information will be provided.

By publishing the meetings of local councils in Internet, access will be provided to certain information that is discussed during the meetings, not only to stakeholders from the locality, but also to an unlimited number of people.

According to the NCPDP, certain information, including personal data concerning a local elected official, could become information of public interest insofar it does not affect the capacity to exercise the public function, taking into account the existence of the right to respect for his private and family life.

The training took place online and was attended by 300 people.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the company Notebooksbilliger.de AG, which deals with video surveillance of potential thieves. The company was fined with EUR10.4 million by State Commissioner for Data Protection in Lower Saxony, Barbara Thiel. The economic entity monitor its employees for at least two years with no legal justification. The video cameras were installed in the workspaces, sales floors, warehouses and staff rooms.

According to the company the video cameras had been installed to prevent and investigate criminal offences and to track the flow of goods in warehouses. At the same time, many of the recordings were stored for more than 60 days, contrary to the law.

“This is a serious case of workplace surveillance. Companies have to understand that such intensive video surveillance is a major violation of their employees’ rights. Employees do not have to sacrifice their personal rights just because their employer puts them under general suspicion. According to the case law of the Federal Labour Court, this can put staff under pressure to act as inconspicuously as possible to avoid being criticised or sanctioned for their behaviour”, explained Barbara Thiel.

The customers of notebooksbilliger.de were also affected by the illegal video surveillance, because some cameras were directed at seating on the sales floor.

The fine of  EUR 10.4 million is the highest penalty that has ever been imposed by the State Commissioner for Data Protection in Lower Saxony under the General Data Protection Regulation (GDPR). The GDPR enables supervisory authorities to impose fines of up to 20 million euros – or up to 4% of a company’s total annual turnover worldwide.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

At the same time, NCPDP warns about the non-disclosure and prohibition of personal data processing by third parties. The data cover different areas of activity, and their non-compliant processing can have negative consequences.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 12,250,000 applied by Italian data protection supervisory authority (Garante per la protezione dei dati personali) to the mobile network operator, Vodafone, for having unlawfully processed the personal data of millions of users for telemarketing purposes.

This decision marks the final step in a complex proceeding that Italian data protection supervisory authority had initiated following hundreds of complaints and alerts submitted by users against unsolicited phone calls made by Vodafone and/or the company’s sales network in order to promote telephone and Internet services.

The investigations carried out by Italian data protection supervisory authority brought to light major criticalities of a ‘structural’ nature having to do with the violation not only of consent requirements, but also of key principles such as accountability and data protection by design as set forth in the EU GDPR.

Finally, the Italian data protection supervisory authority, not only fined the mobile network operator, Vodafone, with EUR 12,250,000, but also banned from further processing data for marketing or commercial purposes where such data are acquired from third parties that have not obtained the users’ free, specific, and informed consent to data disclosure.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.