The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 57th Plenary Session of the European Data Protection Board (EDPB), which was held on 18 November 2021, at Brussels, Belgium.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on the interplay between Art. 3 and Chapter V GDPR. By clarifying the interplay between the territorial scope of the GDPR (Art. 3) and the provisions on international transfers in Chapter V, the Guidelines aim to assist controllers and processors in the EU in identifying whether a processing operation constitutes an international transfer, and to provide a common understanding of the concept of international transfers. The Guidelines will be subject to public consultation until the end of January.

·        Statement on the European Commission’s Digital Services Package and Data Strategy. In its statement, the EDPB reiterates its call for a ban on any use of Artificial Intelligence for an automated recognition of human features in publicly accessible spaces and urges the co-legislator to consider a phase-out leading to a prohibition of targeted advertising on the basis of pervasive tracking while the profiling of children should overall be prohibited.

·        Finally, the EDPB nominated two representatives from the Belgian and Hessen (DE) SA to take part in the 6th Joint Review of the EU-US Terrorist Finance Tracking Program (TFTP) Agreement.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP) trained, on October 7, the representatives of the local public authorities (LPA) from Căușeni district. The training course aimed to strengthen the capacities of LPA representatives and to familiarize, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; depersonalization of data within Local Documents Registry; approval of security policy and personal data filling systems instructions, etc.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Căușeni district.

The event, moderated by three experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management in the 53rd meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online on 28 – 30 September, 2021.

During the Meeting, several topics were discussed, among which:

·        Convention 108+ State of play, ratifications and accessions;

·        Evaluation and follow up mechanism under Convention 108+;

·        Digital identity;

·        Personal data processing by and for political campaigns;

·        Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·        Contractual clauses in the context of transborder data flows;

·        Cooperation with other Council of Europe bodies and entities;

·        Major developments and activities in the field of data protection, etc.

At the same time, NCPDP as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the meeting of the Bureau of the Consultative Committee of the Convention 108, as well as the weight of adopted documents.

On September 6, 2021, the National Center for Personal Data Protection (NCPDP) performed a training course for the employees of the National Administration of Penitentiaries to ensure the compliant implementation of the provisions of the legislation on personal data protection. The training was held online at the request of the National Administration of Penitentiaries and was attended by 30 employees.

The topics addressed in the training were: general notions on personal data protection, the principles of personal data protection, data subjects’ rights, assurance the security and confidentiality of personal data within the personal data filling systems.

At the end, the participants in the training asked questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of the representatives of the institution at the 51st Plenary Session of the European Data Protection Board (EDPB), which was held online on 7 July, 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Codes of Conduct (CoCs) as a tool for transfers. The main purpose of the guidelines is to clarify the application of articles 40 (3) and 46 (2) (e) of the GDPR.

·        A final version of the Guidelines on Virtual Voice Assistants (VVA). The Guidelines aim to provide recommendations to relevant stakeholders on how to address some of the most relevant compliance challenges for VVAs.

·        Guidelines on the concepts of Controller and Processor. These Guidelines aim to provide clarifications concerning fundamental concepts such as (joint) controller and processor.

·        Following the establishment of TikTok in the EU and the identification of its main establishment in Ireland for the ongoing cases related to the TikTok app, the EDPB decided to disband its TikTok Taskforce. This Taskforce was created to coordinate potential actions from the EEA supervisory authorities (SAs) and to acquire a more comprehensive overview of TikTok’s processing and practices across the EU. At the time the Taskforce was created, there was no main establishment for TikTok in the EU and the Taskforce aimed to facilitate the exchange of information between SAs. Now, the One-Stop-Shop procedure applies and the Irish SA (DPC) was designated as the lead authority in charge of the files.

·        EDPB discussed possible topics for its first coordinated enforcement action, following the EDPB’s decision to set up a Coordinated Enforcement Framework on 20 October 2020. The EDPB decided that the first action will concern the use of cloud-based services by public sector bodies and further work will now be carried out to specify the details and the scope in the upcoming months.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

Annually, on July 10, the National Center for Personal Data Protection (NCPDP) celebrates the establishment of the institution as an autonomous and independent public authority that aims to respect the fundamental rights and freedoms of individuals with regard to personal data processing, in particular the right to inviolability of intimate, family and private life.

On this occasion, one of the activities organized by the NCPDP representatives, was to raise awareness among the general public about the importance of personal data protection.

The action took place near the Arc de Triomphe and the citizens were informed about the notion of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. At the same time, the citizens were informed on possible situations in which personal data are not processed in accordance with the provisions of the national legislation in the field, by personal data controllers.

The purpose of this action was to educate, motivate and encourage the citizens of the Republic of Moldova to pay more attention to the protection of their personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of NCPDP management in the 41st Plenary Meeting of the Consultative Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online on 28-30 June, 2021.

Over 150 participants from States Parties to Convention 108 and observers to the Committee of all parts of the world met virtually to discuss and work on topical subjects concerning data protection, finalise important documents and contribute to the elaboration of politics.

During the Plenary Meeting, several topics were discussed, among which: work programme 2022-2025; Convention 108+ State of play, ratifications and accessions; evaluation and follow up mechanism under Convention 108+; law enforcement transborder access to data; digital identity; personal data processing by and for political campaigns; automatic Exchange of data; cooperation with other Council of Europe bodies and entities; major developments and activities in the field of data protection, etc.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Meetings organized by the Consultative Committee of the Convention 108, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of of 12 million SEK (1 193 813 €) applied by Swedish Authority for Privacy Protection (IMY) Medhelp and about the administrative sanction towards Voice Integrate of 650 000 SEK (64 665 €) for the recorded phone calls to the medical consultation service, 1177, which were available and unprotected on the Internet.

In 2019, Swedish media reported that recorded phone calls to the Swedish medical consultation service, 1177, had been available without password protection or other security measures on a web server. IMY, the Swedish DPA, initiated first an investigation of one of the organisations involved in the service. Subsequently, the investigation was extended to include overall six organisations: three companies and three regions in Sweden. 1177 Vårdguiden is a medical service that is offered and owned by all 21 regions (counties) in Sweden. It is a service that gathers information about health and medical care and is available online as well as over the phone. Every call to the phone number 1177 is first directed to the company Inera who administers and develops the joint systems. Calls to 1177 from the regions of Stockholm, Sodermanland and Varmland were at the time of the incident connected through Inera to the company Medhelp AB who answered the calls.

Recently, the Swedish Data Protection Authority finalized its investigation. The cause of the incident was that a network attached storage unit had been incorrectly configured and was thereby accessible on public internet. In addition, the unit did not use encrypted communication. Consequently, a vast amount of calls became available without password protection or other security protection. The only thing that was necessary in order to get access to the files with the phone calls was to know the IP address of the storage unit.

Further to the contraventions that were established, the IMY has issued an administrative sanction of 12 million SEK (1 193 813 €) towards Medhelp. In addition, Voice Integrate, in its role as personal data processor, had an obligation to take appropriate and adequate measures to protect the files with recordings that the company handled on behalf of Medhelp. Therefore, IMY has issued an administrative sanction towards Voice Integrate of 650 000 SEK (64 665 €).

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 50th Plenary Session of the European Data Protection Board (EDPB), which was held online on 18 June, 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        A final version of the Recommendations on supplementary measures following public consultation. The Recommendations were first adopted in November 2020 following the CJEU Schrems II ruling. They aim to assist controllers and processors acting as data exporters with their duty to identify and implement appropriate supplementary measures where they are needed to ensure an essentially equivalent level of protection to the data they transfer to third countries.

·        A letter addressed to EU Institutions on the privacy and data protection aspects of a possible digital euro. In the letter, the EDPB stresses that a very high standard of privacy and data protection is crucial to reinforce the trust of end users and should be considered a distinctive element in the offering of a digital euro, representing a key factor of success. The EDPB further indicates that it stands ready to provide advice to the ECB or other EU institutions.

·        Designated three representatives to the European Travel Information and Authorisation System’s (ETIAS) Fundamental Rights Guidance Board, which is tasked to evaluate the impact of the processing of applications and will play an important role in ensuring the system’s compliance with fundamental rights, in particular with regard to privacy and personal data protection.

·        A joint opinion on the European Commission’s Proposal for a Regulation laying down harmonised rules on artificial intelligence (AI).

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

Experience of the National Center for Personal Data Protection, a benchmark for the Data Protection Authority of the Republic of Belarus

On May 21, 2021, the Management of the National Center for Personal Data Protection (NCPDP) had a working meeting with the Management of the newly created institution at national level, responsible for the field of personal data protection from the Republic of Belarus.

The meeting took place online and was focused on the experience of the Republic of Moldova regarding the application of legislation in the field of personal data protection both at national and international level, the State Register of personal data controllers, the requirements for ensuring personal data security when processing them within the personal data filing systems as well as other aspects related to the proper functioning of an institution.

In this context, the NCPDP team wishes good luck to their colleagues of the Data Protection Authority of the Republic of Belarus and expresses its readiness to continue to provide them with the necessary support.