In the Official Gazette of the Republic of Moldova No 151-157 of 20 May 2022, Order No 33 of 22 April 2022 was published on the approval of the Standard Contract for the cross-border transfer of personal data to states that do not ensure an adequate level of person personal data protection.

The Standard Contract, has been drawn up for the purpose of implementing Art. 32 para. (5) let. i) of Law 133/2011 on personal data protection and its clauses establish adequate safeguards, including enforceable rights of data subjects and effective remedies in relation to cross-border transfers of data from controllers to controllers from controllers to processors and/or from processors to controllers, provided they are not modified, except to select the appropriate module or to add or update information in the annexes.

Thus, data controllers may adjust their activities in the cross-border transfer of personal data in the light of the Standard Contract for the cross-border transfer of personal data to states that do not ensure an adequate level of personal data protection, approved by the Order of NCPDP Director No 33 of 22 April 2022.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of 1,5 million euros applied by the French Lead Supervisory Authority (CNIL) to Dedalus Biologie for the infringement of articles 28, 29 and 32 of GDPR.

On February 23, 2021, a massive data breach regarding nearly 500,000 people was revealed in the press, involving the company Dedalus Biologie. The name, first name, social security number, name of the prescribing doctor, date of the examination, but also and above all medical information (HIV, genetic diseases, drug therapy or genetic data) of these people were thus released on the Internet.

The French Lead Supervisory Authority carried out several onsite and online investigations, in particular concerning the company Dedalus Biologie, which sells software solutions for medical analysis laboratories. Based on the elements collected during the investigations, CNIL identified three breaches. First, in the context of the migration of a software package to another tool, requested by two laboratories using the services of Dedalus Biologie, the latter extracted a larger volume of data than required. The company therefore processed data beyond the instructions given by the data controller and had failed to comply with Article 29 GDPR. Second, the company had not ensured security of personal data within the meaning of Article 32 GDPR. Numerous technical and organisational breaches in terms of security were found in the context of the migration of the software to another: lack of a specific procedure for data migration operations; lack of encryption of personal data stored on the problematic server; no automatic deletion of data after migration to the other software; no authentication required from the Internet to access the public area of the server; lack of a procedure for monitoring and reporting security alerts on the server. Furthermore, were also established that the general conditions of sale proposed by the company Dedalus Biologie and the contracts of maintenance transmitted to the CNIL did not contain the mentions provided for in Article 28 (3) GDPR.

In this context, CNIL imposed to the controller an administrative fine of 1.5 million euros for the non-compliance with Articles 28, 29, and 32 of GDPR and make the decision public.

 The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on April 19, the representatives of the local public authorities (LPA) from Rezina district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 50 mayors, local councilors and representatives of Rezina district administration.

The event, moderated by experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 463 000 applied by Irish Data Protection Authority (SA) to Bank of Ireland Group for the infringement of articles 32, 33, 34 of GDPR.

Irish SA launched an investigation following the 22 personal data breach notifications that Bank of Ireland Group plc (BOI) made to Irish SA between 9 November 2018 and 27 June 2019. The notifications related to the corruption of information in the BOI’s data feed to the Central Credit Register (CCR), a centralised system that collects and securely stores information about loans. The incidents included unauthorised disclosures of customer personal data to the CCR and accidental alterations of customer personal data on the CCR.

The investigation found that:

·        Article 33 of the GDPR was infringed by BOI in 17 of the incidents, by the fact that BOI failed to report the personal data breach without undue delay and to provide sufficient detail to Irish SA in respect of some personal data breaches;

·        Article 34 of the GDPR was infringed by BOI in 14 of the incidents. The infringements concerned a failure by BOI to issue communications to data subjects without undue delay in circumstances where the personal data breaches were likely to result in a high risk to data subjects’ rights and freedoms; and

·        Article 32(1) of the GDPR was infringed as BOI failed to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by its processing of customer data in transferring information to the CCR.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

On 15 April, the National Centre for Personal Data Protection (NCPDP) launched the information and awareness campaign for school communities. The first training course was organized at the Public Institution High School “Onisifor Ghibu” in Chisinau, the target audience being the students of the 4th class. The event took place within the Personal Development lesson.

The aim of the information and awareness campaign for school communities is to provide high visibility on personal data protection and child safety online, at local and national level, by promoting empowerment and best practice for intervention and support.

The topics addressed in the training were: general notions on personal data (what it means, how we identify it, how we work with it); the correct use of photos/videos online (the privacy of a social networking page, privacy settings, working with photos/videos in a chat, attitude and actions taken in case if a photo/video is taken without your consent and distributed afterwards); risks and threats online (malware, spam, online harassment, information theft, situations that threaten children’s privacy/security and solutions for such situations).

At the same time, the NCPDP experts carried out interactive activities: role-playing, puzzles completion crossword, discussions on the basis of the information material presented took place, video spots were presented and in the end the pupils completed a test based on the discussed material.

It should be noted that NCPDP aims to continue this training format for school communities both in the educational institutions from Chisinau municipality and from the districts of the Republic of Moldova.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 724 000 applied by Swedish Authority for Privacy Protection (IMY) to Klarna Bank AB for the infringement of the rights of the data subject and principles relating to processing of personal data.

Klarna Bank is a financial company that processes personal data about many people and in many different ways. It is important that the information that Klarna Bank provides about how the company processes personal data is correct and as complete as possible. During the investigation, Klarna Bank has continuously changed the information provided on how the company handles personal data. The IMY’s decision concerns the information provided in the spring of 2020. Following the investigation, Klarna Bank did not provide information on the purpose and the legal basis for which personal data was processed in one of the company’s services. The company also provided incomplete and misleading information about who were the recipients of different categories of personal data when data was shared with Swedish and foreign credit information companies. Furthermore, Klarna Bank did not provide information on to which countries outside the EU/EEA personal data were transferred or on where and how individuals could obtain information on the safeguards that applied to the transfer to third countries.

In this context, IMY found that the company provided incomplete information about the data subjects’ rights, including the right to delete data, the right to data portability and the right to object to how one’s personal data is processed, violating the Articles 5 (1) (a), 5.2, 12.1, 13.1 c, e-f and 13.2 a-b, f and 14.2 g of GDPR.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fines imposed by Spanish Data Protection Authority (SA) on several mobile phone companies for a loss of confidentiality related to mobile phone SIM cards duplicate.

The Spanish SA initiated investigations following various claims as a result of the issuance of duplicate SIM cards to third parties other than subscribers. Consequently, the holders of the telephone line are not only left without service, but the third parties access their bank accounts. As a result of the investigations, the Spanish SA identified vulnerabilities in the implemented operating procedures: duplication of SIM cards without the consent of their legitimate holders; accesses of confidential information for criminal purposes (known as “SIM Swapping”); personal data processed to issue a duplicate SIM card (Subscriber Identity Module), which unequivocally identifies the subscriber on the network processed contrary to data protection regulations; the measures implemented by mobile phone companies were insufficient, so they generated a loss of confidentiality and the transfer of personal data to a third party; the lack of accountability by not having implemented an effective GDPR compliance and management model to avoid the risk of identity theft, in relation to the absence of adequate security measures and aimed at ensuring the procedure of identification and delivery of the SIM card and the delayed temporary reaction to the events described, in addition to the inadequacy of the measures taken.

In this context, Spanish Data Protection Authority applied a fine in the amount of EUR 900 000 to TELEFÓNICA MÓVILES ESPAÑA, a fine in the amount of EUR 70 000 to ORANGE ESPAÑA VIRTUAL, a total fine in the amount of EUR 3 940 000 to VODAFONE ESPAÑA and a fine in the amount of EUR 200 000 to XFERA MÓVILES, S.A for a loss of confidentiality related to mobile phone SIM cards duplicate.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 525 000 applied by Dutch Data Protection Authority (SA) to DPG Media Magazines for the infringement of article 12 (2) GDPR, namely for unnecessarily requesting copies of identity documents.

The Dutch SA received various complaints regarding how Sanoma Media Netherlands B.V. (before Sanoma was taken over by DPG Media in April 2020) handled requests from people to view their data or have their data deleted. Anyone who wanted to know what personal data of theirs Sanoma and DPG Media kept or who wanted their data deleted was required to first upload or send in a copy of their identity document. What’s more, when sending such a copy electronically, they were not informed by Sanoma and DPG Media that they could redact certain data. Even if parts are redacted, it will often be disproportionate to require a copy of an identity document in order to confirm that a person really is who they claim to be.

The company thus made it overly complicated for customers to access their data or have their data deleted. After taking over Sanoma, DPG Media changed its practices. DPG Media now confirms the identity of a person requesting access to their data or deletion of their data by sending a verification email. The violation is therefore no longer being committed.

Administrative fine in the amount of EUR 525 000 applied by Dutch Data Protection Authority was contested by DPG Media Magazines.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on April 8, the representatives of the local public authorities (LPA) from Bălți municipality. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 92 mayors, municipal councilors and representatives of the Balti municipal council administration. There was a significant increase in the number of participants at the event, which shows an increased interest on the part of LPAs to comply with the legal provisions in the field of personal data processing.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

În contextul pandemiei de COVID-19, comerțul electronic și economia digitală s-au dezvoltat continuu. Ca rezultat, au crescut riscurile de utilizare online a datelor referitoare la cardurile bancare. În scopul reducerii riscurilor fraudelor bancare, Centrul Național pentru Protecția Datelor cu Caracter Personal al Republicii Moldova, recomandă:

1.                  Nu furnizați niciodată informații personale sau financiare prin telefon sau prin e-mail. Atenție la escrocherii, în care printr-un mesaj sau e-mail sunt solicitate informații personale sau financiare ce vă vizează.

2.                  Evitați utilizarea programelor descărcate de pe site-uri web necunoscute. Ignorați programele care pretind a fi jocuri distractive, colectează informații în „scopuri de marketing” sau promit „accelerarea conexiunilor la internet”. Acestea sunt de fapt programe care pot include fișiere spion.

3.                  Nu stocați chitanțele cardurilor de credit, corespondența nedorită și alte documente cu informații personale sau financiare sensibile. Nu lăsați niciodată aceste tipuri de documente expuse într-un spațiu public.

4.                  Nu postați niciodată informații personale despre Dvs. (cum ar fi data nașterii, locul nașterii, numele membrilor familiei) pe site-uri web de rețele sociale. Aceste informații pot fi găsite cu ușurință de motoarele de căutare și utilizate pentru a ajuta la comiterea furtului informației de pe cardurile bancare.

5.                  Fiți cu ochii pe datele de pe cardul Dvs., verificați raportul de venit/cheltuieli în fiecare lună, astfel încât să puteți identifica orice activitate necunoscută, delincvențe sau inexactități.

6.                  Activați autentificarea prin doi pași pe dispozitivele și conturile Dvs., ar trebui să configurați mecanismul de autentificare pe două nivele pentru e-mail, conturi de rețele sociale și conturi bancare.

7.                  Ștergeți datele de pe dispozitivele electronice înainte de a le vinde sau dona. Când ștergeți fișiere de pe calculatoare și alte dispozitive electronice precum tablete, acele fișiere nu dispar cu adevărat, părți din ele rămân și pot fi reasamblate cu un program de recuperare a datelor până când sunt suprascrise cu date noi. Acest lucru poate fi realizat prin suprascrierea unui software care șterge hardware-ul sau transferă date de pe calculatorul vechi pe unul nou.

8.                      Creați parole diferite pentru conturile Dvs., o parolă sigură este lungă, complexă și unică. Creați parole diferite pentru diferite conturi. Evitați utilizarea informațiilor legate de identitatea Dvs., cum ar fi cifrele din numărul Dvs. de telefon, ziua de naștere, inițialele sau părți din numele Dvs.

9.                      Instalați software antivirus, el poate împiedica hackerii să acceseze informații de pe calculatorul și dispozitivele mobile ce vă aparțin, Dvs. ați putea fi o victimă a programelor nedorite care includ viruși, atrageți atenția dacă calculatorul Dvs. manifestă următoarele semne:

·         Încetinește, se blochează sau afișează mesaje de eroare;

·         Nu se închide sau nu se repornește;

·         Oferă ferestre pop-up sau alte reclame nedorite;

·         Vă trimite către pagini web pe care nu le-ați căutat;

·         Afișează bare de instrumente noi, neașteptate;

·         Schimbă browserul web implicit;

·         Consumă rapid bateria.