The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management in the 52nd meeting of the Bureau of the Consultative Committee of the Convention  for the protection of individuals with regard to automating processing of personal data, which was held online on 24 -26 March, 2021.

During the Meeting, several topics were discussed, among which:

·        Convention 108+ State of play, ratifications and accessions;

·        Evaluation and follow up mechanism under Convention 108+;

·        Law enforcement transborder access to data;

·        Digital identity;

·        Personal data processing by and for political campaigns;

·        Automatic Exchange of data;

·        Cooperation with other Council of Europe bodies and entities;

·        Major developments and activities in the field of data protection, etc.

At the same time, during the Meeting, a topic of major importance related to COVID-19 vaccination certificates was addressed. The representatives of the Committee on Bioethics (DH-BIO), as well as the representatives of the Secretariat, made a considerable contribution in this regard. In this context, will be submitted to delegations the draft Statement on “Covid-19 Vaccination, digital attestations and data protection”

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection Director at the 46th Plenary session of the European Data Protection Board (EDPB), which was held online.

During the mentioned Session, a wide range of topics were discussed, among which:

•           EDPB adopted its Work Programme for 2021-2022, according to Article 29 of the EDPB Rules of Procedure.

 •          The EDPB adopted a Statement on the draft ePrivacy Regulation. “The ePrivacy Regulation must not – under no circumstances – lower the level of protection offered by the current ePrivacy Directive, and should complement the GDPR by providing additional strong guarantees for confidentiality and protection of all types of electronic communication” said Andrea Jelinek, EDPB Chair.

•           The EDPB adopted Guidelines 02/2021 on Virtual Voice Assistants (VVAs). These Guidelines aim to identify some of the most relevant compliance challenges for VVAs and to provide recommendations to relevant stakeholders on how to address them. The Guidelines will be submitted for public consultation for a period of six weeks.

•           The EDPB adopted a final version of the Guidelines 01/2021 on Connected Vehicles following public consultation. The Guidelines focus on the processing of personal data in relation to the non-professional use of connected vehicles by data subjects. The final version integrates updated wording, and further clarifications in order to address comments and feedback received during the public consultation.

•           The EDPB adopted EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance.

•           The EDPB adopted, following public consultation, the Guidelines 09/2020 on relevant and reasoned objection.

•           Furthermore, the EDPB discussed the draft UK adequacy decisions, which were received from the European Commission.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents, in order to align national data protection legislation to EU standards.

The National Center for Personal Data Protection trained for three days (February 17, 18, 19) the local authorities from the north, center and south of the Republic of Moldova. The training aimed at familiarizing the participants with video surveillance and live streaming of local councils’ meetings.

”Depersonalization of individual documents, access to information, provision of information to legal entities, protection of access to state registers, audit of accesses, data security and confidentiality, but also the need to register local public authorities as data controllers were the most important aspects, to which the attention of the local authorities, who participated in the training was drawn”, explained Denis Coțofan, interim deputy head of the Legal Department of NCPDP.

The participants in the training were interested in: how the meetings of the local councils are to be live streamed, who is responsible for their live streaming and how the information will be provided.

By publishing the meetings of local councils in Internet, access will be provided to certain information that is discussed during the meetings, not only to stakeholders from the locality, but also to an unlimited number of people.

According to the NCPDP, certain information, including personal data concerning a local elected official, could become information of public interest insofar it does not affect the capacity to exercise the public function, taking into account the existence of the right to respect for his private and family life.

The training took place online and was attended by 300 people.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the company Notebooksbilliger.de AG, which deals with video surveillance of potential thieves. The company was fined with EUR10.4 million by State Commissioner for Data Protection in Lower Saxony, Barbara Thiel. The economic entity monitor its employees for at least two years with no legal justification. The video cameras were installed in the workspaces, sales floors, warehouses and staff rooms.

According to the company the video cameras had been installed to prevent and investigate criminal offences and to track the flow of goods in warehouses. At the same time, many of the recordings were stored for more than 60 days, contrary to the law.

“This is a serious case of workplace surveillance. Companies have to understand that such intensive video surveillance is a major violation of their employees’ rights. Employees do not have to sacrifice their personal rights just because their employer puts them under general suspicion. According to the case law of the Federal Labour Court, this can put staff under pressure to act as inconspicuously as possible to avoid being criticised or sanctioned for their behaviour”, explained Barbara Thiel.

The customers of notebooksbilliger.de were also affected by the illegal video surveillance, because some cameras were directed at seating on the sales floor.

The fine of  EUR 10.4 million is the highest penalty that has ever been imposed by the State Commissioner for Data Protection in Lower Saxony under the General Data Protection Regulation (GDPR). The GDPR enables supervisory authorities to impose fines of up to 20 million euros – or up to 4% of a company’s total annual turnover worldwide.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

At the same time, NCPDP warns about the non-disclosure and prohibition of personal data processing by third parties. The data cover different areas of activity, and their non-compliant processing can have negative consequences.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 12,250,000 applied by Italian data protection supervisory authority (Garante per la protezione dei dati personali) to the mobile network operator, Vodafone, for having unlawfully processed the personal data of millions of users for telemarketing purposes.

This decision marks the final step in a complex proceeding that Italian data protection supervisory authority had initiated following hundreds of complaints and alerts submitted by users against unsolicited phone calls made by Vodafone and/or the company’s sales network in order to promote telephone and Internet services.

The investigations carried out by Italian data protection supervisory authority brought to light major criticalities of a ‘structural’ nature having to do with the violation not only of consent requirements, but also of key principles such as accountability and data protection by design as set forth in the EU GDPR.

Finally, the Italian data protection supervisory authority, not only fined the mobile network operator, Vodafone, with EUR 12,250,000, but also banned from further processing data for marketing or commercial purposes where such data are acquired from third parties that have not obtained the users’ free, specific, and informed consent to data disclosure.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) performed, on November 17, a training course on personal data protection at the request of the Training Center in the field of Labor Relations. The event was attended by about 150 persons – principals of schools, kindergartens, gymnasiums, but also employees in the medical field.

The topics addressed in the training course covered: principles of personal data protection, rights of personal data subjects, registration of the enterprise / institution as a personal data controller, recommendations on identifying personal data filing systems at enterprises / institutions and requirements on personal data protection regarding video surveillance systems.

Denis Coțofan, interim deputy head of  Legal Department, NCPDP, stated that: “if personal data are collected directly from the data subject and at the latest at the time of the first disclosure, the following information must be provided: the identity of the controller or of the processor, the purpose of processing for which the data are collected, the recipients of personal data, existence of the rights of access to data, the right of intervention upon data and the right to object, if the answers to the questions intended to collect data are mandatory or voluntary, as well as the possible consequences of denial to respond”.

Any personal data subject has the right to obtain from the controller, upon request, without delay and free of charge: the rectification, update, blocking or erasure of personal data the processing of which does not comply with this law. This is mainly due to the incomplete or inaccurate nature of the data and the notification to third parties to whom personal data have been disclosed about any operations performed, except where such notification proves to be impossible or involves disproportionate effort towards the legitimate interest that might be violated.

Daniela Movilă, senior State Inspector of Prevention, Surveillance and Evidence Department, spoke during the training course about the notification procedure of the filing systems managed by the personal data controllers. ” Each personal data controller, based on the specific activity, will elaborate and organize the implementation of document provisions which establish security policy of personal data, including the procedures and measures related to implementation of this policy by applying practical solutions with a level of proportional complexity and detailing, for users identification and authentication; the reaction to security incidents, IT and communication protection; to ensure personal data and IT information integrity; access management; audit and evidence insurance”.

The participants in the training asked questions to the representatives of  NCPDP regarding the application in practice of the legislation in the field of personal data protection, identification of personal data processing systems but also about the steps that should be followed during data processing.

During the 40th Plenary Session of the European Data Protection Board, following public consultation, was adopted the final version of the Guidelines on Data Protection by Design & Default.

The Guidelines focus on the obligation of Data Protection by Design and by Default as set forth in Article 25 of General Data Protection Regulation (GDPR). This means that controllers have to implement appropriate technical and organisational measures and the necessary safeguards, designed to ascertain data protection principles in practice and to protect the rights and freedoms of data subjects. In addition, controllers should be able to demonstrate that the implemented measures are effective.

The Guidelines also contain guidance on how to effectively implement the data protection principles as set forth in Article 5 of GDPR, listing key design and default elements, as well as practical cases for illustration.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of  EUR 15,000 applied to Vilnius City Municipality Administration by State Data Protection Inspectorate of the Republic of Lithuania, for infringements of the General Data Protection Regulation (GDPR). The fine was imposed for infringements of Articles 5(1)(d) and 5(1)(f) of the GDPR, namely a failure to implement appropriate technical and organisational measures, thus, failing to ensure the accuracy of processed personal data when processing personal data of the parents of an adopted child.

Having carried out an investigation, the State Data Protection Inspectorate of the Republic of Lithuania, has determined that when filling in an application for education of the adopted child in the Centralised Application Submission and Population Information System  of the Municipality Administration, the applicant indicated his personal data, data automatically updated monthly. When personal data was automatically updated, the contact personal data of the applicant was updated and replaced with the contact data (e-mail address) of one of the biological parents of the child available in the Population Register of the Republic of Lithuania.

When processing personal data, the Municipality Administration must follow the principle of accuracy which provides for that the data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (Article 5(1)(d) of the GDPR), and the principle of integrity and confidentiality providing for that personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (Article 5(1)(f) of the GDPR).

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection, for information and application purposes, communicates about the fine imposed by Norwegian Data Protection Authority to Bergen Municipality for non-compliant processing of personal information in the communication system between school and home.

In October 2019, the Data Protection Authority was notified of a personal data breach by Bergen Municipality regarding the municipality’s new tool for communication between school and home. Vigilo contains a module where school and parents can communicate via a portal or application. The municipality had not established nor communicated the necessary guidelines to secure the personal information of children and parents with a confidential address before the tool was put to use. Therefore, a contact list with information about “confidential address” was distributed to parents at a grade level.

The administrative fine of EUR 276,000 was imposed because the municipality did not implement technical and organizational measures to ensure an adequate level of security of personal data, as well as their confidentiality.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

This report analyses the impact on the rights to privacy and data protection of the measures taken to prevent the spread of the COVID-19 pandemic in the 55 African, Latin-American and European countries Parties to Convention 108. It includes an in-depth and technical review of the use of digital contact tracing applications and monitoring tools, identifies a number of shortcomings in some of the legal and technical measures adopted and calls on governments to notably ensure transparency of digital solutions in order to ensure greater respect of the rights to privacy and data protection.

“Digital solutions to fight COVID-19” – 2020 Data Protection Report can be viewed by accessing the following link:

https://rm.coe.int/report-dp-2020-en/16809fe49c