The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fines imposed by Spanish Data Protection Authority (SA) on several mobile phone companies for a loss of confidentiality related to mobile phone SIM cards duplicate.

The Spanish SA initiated investigations following various claims as a result of the issuance of duplicate SIM cards to third parties other than subscribers. Consequently, the holders of the telephone line are not only left without service, but the third parties access their bank accounts. As a result of the investigations, the Spanish SA identified vulnerabilities in the implemented operating procedures: duplication of SIM cards without the consent of their legitimate holders; accesses of confidential information for criminal purposes (known as “SIM Swapping”); personal data processed to issue a duplicate SIM card (Subscriber Identity Module), which unequivocally identifies the subscriber on the network processed contrary to data protection regulations; the measures implemented by mobile phone companies were insufficient, so they generated a loss of confidentiality and the transfer of personal data to a third party; the lack of accountability by not having implemented an effective GDPR compliance and management model to avoid the risk of identity theft, in relation to the absence of adequate security measures and aimed at ensuring the procedure of identification and delivery of the SIM card and the delayed temporary reaction to the events described, in addition to the inadequacy of the measures taken.

In this context, Spanish Data Protection Authority applied a fine in the amount of EUR 900 000 to TELEFÓNICA MÓVILES ESPAÑA, a fine in the amount of EUR 70 000 to ORANGE ESPAÑA VIRTUAL, a total fine in the amount of EUR 3 940 000 to VODAFONE ESPAÑA and a fine in the amount of EUR 200 000 to XFERA MÓVILES, S.A for a loss of confidentiality related to mobile phone SIM cards duplicate.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 525 000 applied by Dutch Data Protection Authority (SA) to DPG Media Magazines for the infringement of article 12 (2) GDPR, namely for unnecessarily requesting copies of identity documents.

The Dutch SA received various complaints regarding how Sanoma Media Netherlands B.V. (before Sanoma was taken over by DPG Media in April 2020) handled requests from people to view their data or have their data deleted. Anyone who wanted to know what personal data of theirs Sanoma and DPG Media kept or who wanted their data deleted was required to first upload or send in a copy of their identity document. What’s more, when sending such a copy electronically, they were not informed by Sanoma and DPG Media that they could redact certain data. Even if parts are redacted, it will often be disproportionate to require a copy of an identity document in order to confirm that a person really is who they claim to be.

The company thus made it overly complicated for customers to access their data or have their data deleted. After taking over Sanoma, DPG Media changed its practices. DPG Media now confirms the identity of a person requesting access to their data or deletion of their data by sending a verification email. The violation is therefore no longer being committed.

Administrative fine in the amount of EUR 525 000 applied by Dutch Data Protection Authority was contested by DPG Media Magazines.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on April 8, the representatives of the local public authorities (LPA) from Bălți municipality. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 92 mayors, municipal councilors and representatives of the Balti municipal council administration. There was a significant increase in the number of participants at the event, which shows an increased interest on the part of LPAs to comply with the legal provisions in the field of personal data processing.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

În contextul pandemiei de COVID-19, comerțul electronic și economia digitală s-au dezvoltat continuu. Ca rezultat, au crescut riscurile de utilizare online a datelor referitoare la cardurile bancare. În scopul reducerii riscurilor fraudelor bancare, Centrul Național pentru Protecția Datelor cu Caracter Personal al Republicii Moldova, recomandă:

1.                  Nu furnizați niciodată informații personale sau financiare prin telefon sau prin e-mail. Atenție la escrocherii, în care printr-un mesaj sau e-mail sunt solicitate informații personale sau financiare ce vă vizează.

2.                  Evitați utilizarea programelor descărcate de pe site-uri web necunoscute. Ignorați programele care pretind a fi jocuri distractive, colectează informații în „scopuri de marketing” sau promit „accelerarea conexiunilor la internet”. Acestea sunt de fapt programe care pot include fișiere spion.

3.                  Nu stocați chitanțele cardurilor de credit, corespondența nedorită și alte documente cu informații personale sau financiare sensibile. Nu lăsați niciodată aceste tipuri de documente expuse într-un spațiu public.

4.                  Nu postați niciodată informații personale despre Dvs. (cum ar fi data nașterii, locul nașterii, numele membrilor familiei) pe site-uri web de rețele sociale. Aceste informații pot fi găsite cu ușurință de motoarele de căutare și utilizate pentru a ajuta la comiterea furtului informației de pe cardurile bancare.

5.                  Fiți cu ochii pe datele de pe cardul Dvs., verificați raportul de venit/cheltuieli în fiecare lună, astfel încât să puteți identifica orice activitate necunoscută, delincvențe sau inexactități.

6.                  Activați autentificarea prin doi pași pe dispozitivele și conturile Dvs., ar trebui să configurați mecanismul de autentificare pe două nivele pentru e-mail, conturi de rețele sociale și conturi bancare.

7.                  Ștergeți datele de pe dispozitivele electronice înainte de a le vinde sau dona. Când ștergeți fișiere de pe calculatoare și alte dispozitive electronice precum tablete, acele fișiere nu dispar cu adevărat, părți din ele rămân și pot fi reasamblate cu un program de recuperare a datelor până când sunt suprascrise cu date noi. Acest lucru poate fi realizat prin suprascrierea unui software care șterge hardware-ul sau transferă date de pe calculatorul vechi pe unul nou.

8.                      Creați parole diferite pentru conturile Dvs., o parolă sigură este lungă, complexă și unică. Creați parole diferite pentru diferite conturi. Evitați utilizarea informațiilor legate de identitatea Dvs., cum ar fi cifrele din numărul Dvs. de telefon, ziua de naștere, inițialele sau părți din numele Dvs.

9.                      Instalați software antivirus, el poate împiedica hackerii să acceseze informații de pe calculatorul și dispozitivele mobile ce vă aparțin, Dvs. ați putea fi o victimă a programelor nedorite care includ viruși, atrageți atenția dacă calculatorul Dvs. manifestă următoarele semne:

·         Încetinește, se blochează sau afișează mesaje de eroare;

·         Nu se închide sau nu se repornește;

·         Oferă ferestre pop-up sau alte reclame nedorite;

·         Vă trimite către pagini web pe care nu le-ați căutat;

·         Afișează bare de instrumente noi, neașteptate;

·         Schimbă browserul web implicit;

·         Consumă rapid bateria.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 17 million applied by Irish Data Protection Authority (SA) to Meta Platforms (formerly Facebook) for the infringement of articles 5(2) and 24(1) GDPR.

The Irish SA launched an inquiry of its own-volition, arising from receipt of a series of twelve data breach notifications in the period between 7 June – 4 December 2018.  The purpose of the inquiry was to examine the extent to which Meta Platforms achieved compliance with the requirements of articles 5(2) and 24(1) GDPR.

Following investigations, the Irish SA found that Meta Platforms failed to have in place appropriate technical and organisational measures such as would enable it to readily demonstrate the security measures that it implemented in practice to protect EU users’ data, thus imposing an administrative fine of EUR 17 million.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on March 25, the representatives of the local public authorities (LPA) from Soroca district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 41 mayors and local councilors of Soroca district.

The event, moderated by experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 20 million applied by Italian Data Protection Authority (SA) to Clearview AI for illegal personal data processing.

The Italian SA launched an own volition proceeding following press reports on several issues in connection with facial recognition products which were offered by the Clearview AI Inc. Moreover, the Italian SA received, during 2021, four complaints and two alerts by two organizations that are active in the field of protecting privacy and the fundamental rights of individuals against Clearview.

The inquiries and assessment by the Italian SA found several infringements by Clearview AI: the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis, since the legitimate interest of the US-based company does not qualify as such; the company infringed several fundamental principles of the GDPR, such as transparency, purpose limitation, and storage limitation; it failed to provide the information set out by Article 13-14, to provide information on an action taken on a request under Article 15 within the due timeframe, and to designate a representative in the EU.

In this context, Italian SA imposed a ban on any further collection, by way of web scraping techniques, of images and the relevant metadata concerning persons in the Italian territory and on further processing of the standard and biometric data that are handled by the Company via its facial recognition system. Furthermore, ordered erasure of the data, including biometric data, processed by its facial recognition system and designation of a representative in the territory of the European Union.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 62nd Plenary Session of the European Data Protection Board (EDPB), which was held on-line, on 14 March 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Art. 60 GDPR. The drafting of such guidance is part of the EDPB Strategy and Work Programme 2021-2022 to support effective enforcement and efficient cooperation between national supervisory authorities (SAs).

·        Guidelines on dark patterns in social media platform interfaces. The guidelines offer practical recommendations to designers and users of social media platforms on how to assess and avoid so-called “dark patterns” in social media interfaces that infringe on GDPR requirements.

·        A toolbox on essential data protection safeguards for enforcement cooperation between EEA and third country SAs. This contributes to one of the key actions of the EDPB Strategy and Work Programme 2021-2022 and aims to facilitate the engagement between EDPB members and the SAs of third countries. The toolbox covers key topics, such as enforceable rights of data subjects, compliance with data protection principles and judicial redress.

·        A joint EDPB-EDPS opinion on the proposals to extend the Digital COVID Certificate by up to 12 months. The subject will continue to be discussed at the next Plenary Session.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP) trained, on March 11, the representatives of the local public authorities (LPA) from Dondușeni district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Dondușeni district.

The event, moderated by experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP) trained, on February 25, the representatives of the local public authorities (LPA) from Drochia district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Drochia district.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.