The National Center for Personal Data Protection (NCPDP) performed, on November 17, a training course on personal data protection at the request of the Training Center in the field of Labor Relations. The event was attended by about 150 persons – principals of schools, kindergartens, gymnasiums, but also employees in the medical field.

The topics addressed in the training course covered: principles of personal data protection, rights of personal data subjects, registration of the enterprise / institution as a personal data controller, recommendations on identifying personal data filing systems at enterprises / institutions and requirements on personal data protection regarding video surveillance systems.

Denis Coțofan, interim deputy head of  Legal Department, NCPDP, stated that: “if personal data are collected directly from the data subject and at the latest at the time of the first disclosure, the following information must be provided: the identity of the controller or of the processor, the purpose of processing for which the data are collected, the recipients of personal data, existence of the rights of access to data, the right of intervention upon data and the right to object, if the answers to the questions intended to collect data are mandatory or voluntary, as well as the possible consequences of denial to respond”.

Any personal data subject has the right to obtain from the controller, upon request, without delay and free of charge: the rectification, update, blocking or erasure of personal data the processing of which does not comply with this law. This is mainly due to the incomplete or inaccurate nature of the data and the notification to third parties to whom personal data have been disclosed about any operations performed, except where such notification proves to be impossible or involves disproportionate effort towards the legitimate interest that might be violated.

Daniela Movilă, senior State Inspector of Prevention, Surveillance and Evidence Department, spoke during the training course about the notification procedure of the filing systems managed by the personal data controllers. ” Each personal data controller, based on the specific activity, will elaborate and organize the implementation of document provisions which establish security policy of personal data, including the procedures and measures related to implementation of this policy by applying practical solutions with a level of proportional complexity and detailing, for users identification and authentication; the reaction to security incidents, IT and communication protection; to ensure personal data and IT information integrity; access management; audit and evidence insurance”.

The participants in the training asked questions to the representatives of  NCPDP regarding the application in practice of the legislation in the field of personal data protection, identification of personal data processing systems but also about the steps that should be followed during data processing.

During the 40th Plenary Session of the European Data Protection Board, following public consultation, was adopted the final version of the Guidelines on Data Protection by Design & Default.

The Guidelines focus on the obligation of Data Protection by Design and by Default as set forth in Article 25 of General Data Protection Regulation (GDPR). This means that controllers have to implement appropriate technical and organisational measures and the necessary safeguards, designed to ascertain data protection principles in practice and to protect the rights and freedoms of data subjects. In addition, controllers should be able to demonstrate that the implemented measures are effective.

The Guidelines also contain guidance on how to effectively implement the data protection principles as set forth in Article 5 of GDPR, listing key design and default elements, as well as practical cases for illustration.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of  EUR 15,000 applied to Vilnius City Municipality Administration by State Data Protection Inspectorate of the Republic of Lithuania, for infringements of the General Data Protection Regulation (GDPR). The fine was imposed for infringements of Articles 5(1)(d) and 5(1)(f) of the GDPR, namely a failure to implement appropriate technical and organisational measures, thus, failing to ensure the accuracy of processed personal data when processing personal data of the parents of an adopted child.

Having carried out an investigation, the State Data Protection Inspectorate of the Republic of Lithuania, has determined that when filling in an application for education of the adopted child in the Centralised Application Submission and Population Information System  of the Municipality Administration, the applicant indicated his personal data, data automatically updated monthly. When personal data was automatically updated, the contact personal data of the applicant was updated and replaced with the contact data (e-mail address) of one of the biological parents of the child available in the Population Register of the Republic of Lithuania.

When processing personal data, the Municipality Administration must follow the principle of accuracy which provides for that the data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (Article 5(1)(d) of the GDPR), and the principle of integrity and confidentiality providing for that personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (Article 5(1)(f) of the GDPR).

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection, for information and application purposes, communicates about the fine imposed by Norwegian Data Protection Authority to Bergen Municipality for non-compliant processing of personal information in the communication system between school and home.

In October 2019, the Data Protection Authority was notified of a personal data breach by Bergen Municipality regarding the municipality’s new tool for communication between school and home. Vigilo contains a module where school and parents can communicate via a portal or application. The municipality had not established nor communicated the necessary guidelines to secure the personal information of children and parents with a confidential address before the tool was put to use. Therefore, a contact list with information about “confidential address” was distributed to parents at a grade level.

The administrative fine of EUR 276,000 was imposed because the municipality did not implement technical and organizational measures to ensure an adequate level of security of personal data, as well as their confidentiality.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

This report analyses the impact on the rights to privacy and data protection of the measures taken to prevent the spread of the COVID-19 pandemic in the 55 African, Latin-American and European countries Parties to Convention 108. It includes an in-depth and technical review of the use of digital contact tracing applications and monitoring tools, identifies a number of shortcomings in some of the legal and technical measures adopted and calls on governments to notably ensure transparency of digital solutions in order to ensure greater respect of the rights to privacy and data protection.

“Digital solutions to fight COVID-19” – 2020 Data Protection Report can be viewed by accessing the following link:

https://rm.coe.int/report-dp-2020-en/16809fe49c

The National Center for Personal Data Protection (NCPDP) informs that the new website, since its launch and until now has gathered over 26 418 unique visitors.

The new website of the NCPDP www.datepersonale.md was developed with the support of the EU Twinning project “Capacity Building of the National Center for Personal Data Protection” and launched on January 31, 2020. It aims to promote a more interactive communication with its visitors, as well as the purpose of streamlining the process of searching for the most important information related to the field of personal data protection.

Thus, since its launch until now – over 26 418 unique visitors have accessed the information of the new website, which indicates an increased interest from visitors in the field of personal data protection.

Every month, the new website has up to 5554 unique visitors, respectively:

·         During the month of May, the web page was viewed by 5554 unique visitors;

·         During the month of June, the web page was viewed by 4842 unique visitors;

·         During the month of July, the web page was viewed by 5554 unique visitors;

The most viewed articles remain the Newsletters on the activity of NCPDP as well as the aspects regarding the compliance of different institutions with the provisions of the legislation in the field of personal data protection.

Please note that some of the information can be viewed on the old web page, by accessing the link old.datepersonale.md.

The National Center for Personal Data Protection, for information and application purposes, informs that following the decision of the Court of Justice of the European Union in the case of “Schrems II”,  Alessandra Pierucci, Chair of the Committee of Convention 108 and Jean-Philippe Walter, Data Protection Commissioner of the Council of Europe publish a joint Statement recalling the relevance and the influence of the Convention for the protection of individuals with regard to the processing of personal data (Convention 108+) in a context of international data flows.

On 16 July 2020, the Court of Justice of the European Union invalidates Decision 2016/1250 on the adequacy of personal data protection provided by the EU-US Data Protection Shield. Its main ground for that ruling is that the American legislation cannot adequately guarantee the protection of personal data transferred from the EU, notably in respect of access to these data by intelligence services.

The representatives of the Council of Europe mention that, for years, an increasing number of voices call for democratic and effective supervision of security and intelligence services worldwide to ensure better protection of the rights and fundamental freedoms of people.

The principles of Convention 108+ as well as the strict exception regime it allows, notably in the context of security and intelligence, are strong elements to answer the concerns expressed since Edward Snowden’s revelations. The Chair of the Committee of Convention 108 and the Data Protection Commissioner of the Council of Europe also think that the unique mandate of the Council of Europe, its experience in respect of Human rights, democracy and the rule of law, as well as its opening beyond the European borders (with some of its landmark instruments such as Convention 108 and the Budapest Convention inter alia), make the Organisation an ideal forum to engage in internationally reaching works on the delicate issue of national security services.

The joint Statement of the Chair of the Committee of Convention 108 and Data Protection Commissioner of the Council of Europe can be viewed by accessing the following link: https://www.coe.int/en/web/data-protection/-/to-better-protect-us-when-our-personal-data-falls-into-the-intelligence-trap-

The National Center for Personal Data Protection, for information and application purposes, communicates about the Court of Justice Decision declaring invalid Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield, however, considering that Commission Decision 2010/87 on standard contractual clauses for the transfer of personal data to processors established in third countries is valid.

The decision was taken following a complaint submitted by an Austrian national residing in Austria, a Facebook user since 2008. As in the case of other users residing in EU, some or all of his personal data is transferred by Facebook to servers that are located in the United States, where it undergoes processing. The complainant claimed that the law and practices in the US do not offer sufficient protection against access by the public authorities to the data transferred to that country.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC  provides that the transfer of such data to a third country may, in principle, take place only if the third country in question ensures an adequate level of data protection or details the conditions under which such a transfer may take place in the absence of an adequacy decision or appropriate safeguards.

In the complainant case, according to the Court, the limitations on the protection of personal data arising from the domestic law of the US on the access and use by US public authorities of such data transferred from the EU to that third country, which the Commission assessed in Decision 2016/1250, are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law, by the principle of proportionality, in so far as the surveillance programmes based on those provisions are not limited to what is strictly necessary. Furthermore, the Ombudsperson mechanism referred to that decision does not provide data subjects with any cause of action before a body which offers guarantees substantially equivalent to those required by EU law, such as to ensure both the independence of the Ombudsperson provided for by that mechanism and the existence of rules empowering the Ombudsperson to adopt decisions that are binding on the US intelligence services.

On all those grounds, the Court declares Decision 2016/1250 invalid.

The full decision of the Court of Justice of the European Union declaring invalid Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield can be found by accessing the following link:

https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf

           The National Center for Personal Data Protection, for information and application purposes, communicates about the fine imposed by Swedish Data Protection Authority to an Homeowners Association for the breach of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, (GDPR). The Swedish Homeowners Association placed four cameras in the building (one at the entrance to the building, two in the stairwell and one in the storage area) that processed both images and sounds.

The National Center for Personal Data Protection, for information and application purposes, communicates about a series of fines applied by Romanian National Supervisory Authority for Personal Data Processing for violating the provisions of General Data Protection Regulation (GDPR).

–  An economic agent was fined with 15 000 EUR for violating the security of personal data. On the Facebook page on which the controller conducted an online contest to attract customers participating in the car service, was posted a document with a screenshot of the source code of the website which included the access password to the forms completed by the contest participants.

This situation created the possibility of viewing and unauthorized access to personal data of a number of 436 customers of the controller, through its website and the unauthorized disclosure of such data, contrary to the provisions of art. 32 of  GDPR.

–    At the same time, a banking institution was fined with 5 000 EUR for collecting copies of customers’ ID card through an employee’s personal phone.

The investigation was initiated following a complaint and during its conduct, the Romanian National Supervisory Authority for Personal Data Processing found that the banking institution did not implement technical and organizational measures to ensure an adequate level of security appropriate to the risk of processing. The controller did not take steps to ensure that any natural person acting under his authority who has access to personal data does not process them except on instructions from the controller, unless this obligation is required by Union or Member State law.

Moreover, the banking institution should have implemented some technical measures so as to ensure the confidentiality of personal data and strictly authorized access to data transmitted by its customers.

The non-compliance with the requirements aforementioned, has led to the infringement of GDPR and the sanctioning of the controller concerned with 5 000 EUR.