The National Center for Personal Data Protection (NCPDP) informs that the new website, since its launch and until now has gathered over 26 418 unique visitors.

The new website of the NCPDP www.datepersonale.md was developed with the support of the EU Twinning project “Capacity Building of the National Center for Personal Data Protection” and launched on January 31, 2020. It aims to promote a more interactive communication with its visitors, as well as the purpose of streamlining the process of searching for the most important information related to the field of personal data protection.

Thus, since its launch until now – over 26 418 unique visitors have accessed the information of the new website, which indicates an increased interest from visitors in the field of personal data protection.

Every month, the new website has up to 5554 unique visitors, respectively:

·         During the month of May, the web page was viewed by 5554 unique visitors;

·         During the month of June, the web page was viewed by 4842 unique visitors;

·         During the month of July, the web page was viewed by 5554 unique visitors;

The most viewed articles remain the Newsletters on the activity of NCPDP as well as the aspects regarding the compliance of different institutions with the provisions of the legislation in the field of personal data protection.

Please note that some of the information can be viewed on the old web page, by accessing the link old.datepersonale.md.

The National Center for Personal Data Protection, for information and application purposes, informs that following the decision of the Court of Justice of the European Union in the case of “Schrems II”,  Alessandra Pierucci, Chair of the Committee of Convention 108 and Jean-Philippe Walter, Data Protection Commissioner of the Council of Europe publish a joint Statement recalling the relevance and the influence of the Convention for the protection of individuals with regard to the processing of personal data (Convention 108+) in a context of international data flows.

On 16 July 2020, the Court of Justice of the European Union invalidates Decision 2016/1250 on the adequacy of personal data protection provided by the EU-US Data Protection Shield. Its main ground for that ruling is that the American legislation cannot adequately guarantee the protection of personal data transferred from the EU, notably in respect of access to these data by intelligence services.

The representatives of the Council of Europe mention that, for years, an increasing number of voices call for democratic and effective supervision of security and intelligence services worldwide to ensure better protection of the rights and fundamental freedoms of people.

The principles of Convention 108+ as well as the strict exception regime it allows, notably in the context of security and intelligence, are strong elements to answer the concerns expressed since Edward Snowden’s revelations. The Chair of the Committee of Convention 108 and the Data Protection Commissioner of the Council of Europe also think that the unique mandate of the Council of Europe, its experience in respect of Human rights, democracy and the rule of law, as well as its opening beyond the European borders (with some of its landmark instruments such as Convention 108 and the Budapest Convention inter alia), make the Organisation an ideal forum to engage in internationally reaching works on the delicate issue of national security services.

The joint Statement of the Chair of the Committee of Convention 108 and Data Protection Commissioner of the Council of Europe can be viewed by accessing the following link: https://www.coe.int/en/web/data-protection/-/to-better-protect-us-when-our-personal-data-falls-into-the-intelligence-trap-

The National Center for Personal Data Protection, for information and application purposes, communicates about the Court of Justice Decision declaring invalid Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield, however, considering that Commission Decision 2010/87 on standard contractual clauses for the transfer of personal data to processors established in third countries is valid.

The decision was taken following a complaint submitted by an Austrian national residing in Austria, a Facebook user since 2008. As in the case of other users residing in EU, some or all of his personal data is transferred by Facebook to servers that are located in the United States, where it undergoes processing. The complainant claimed that the law and practices in the US do not offer sufficient protection against access by the public authorities to the data transferred to that country.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC  provides that the transfer of such data to a third country may, in principle, take place only if the third country in question ensures an adequate level of data protection or details the conditions under which such a transfer may take place in the absence of an adequacy decision or appropriate safeguards.

In the complainant case, according to the Court, the limitations on the protection of personal data arising from the domestic law of the US on the access and use by US public authorities of such data transferred from the EU to that third country, which the Commission assessed in Decision 2016/1250, are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law, by the principle of proportionality, in so far as the surveillance programmes based on those provisions are not limited to what is strictly necessary. Furthermore, the Ombudsperson mechanism referred to that decision does not provide data subjects with any cause of action before a body which offers guarantees substantially equivalent to those required by EU law, such as to ensure both the independence of the Ombudsperson provided for by that mechanism and the existence of rules empowering the Ombudsperson to adopt decisions that are binding on the US intelligence services.

On all those grounds, the Court declares Decision 2016/1250 invalid.

The full decision of the Court of Justice of the European Union declaring invalid Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield can be found by accessing the following link:

https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf

           The National Center for Personal Data Protection, for information and application purposes, communicates about the fine imposed by Swedish Data Protection Authority to an Homeowners Association for the breach of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, (GDPR). The Swedish Homeowners Association placed four cameras in the building (one at the entrance to the building, two in the stairwell and one in the storage area) that processed both images and sounds.

The National Center for Personal Data Protection, for information and application purposes, communicates about a series of fines applied by Romanian National Supervisory Authority for Personal Data Processing for violating the provisions of General Data Protection Regulation (GDPR).

–  An economic agent was fined with 15 000 EUR for violating the security of personal data. On the Facebook page on which the controller conducted an online contest to attract customers participating in the car service, was posted a document with a screenshot of the source code of the website which included the access password to the forms completed by the contest participants.

This situation created the possibility of viewing and unauthorized access to personal data of a number of 436 customers of the controller, through its website and the unauthorized disclosure of such data, contrary to the provisions of art. 32 of  GDPR.

–    At the same time, a banking institution was fined with 5 000 EUR for collecting copies of customers’ ID card through an employee’s personal phone.

The investigation was initiated following a complaint and during its conduct, the Romanian National Supervisory Authority for Personal Data Processing found that the banking institution did not implement technical and organizational measures to ensure an adequate level of security appropriate to the risk of processing. The controller did not take steps to ensure that any natural person acting under his authority who has access to personal data does not process them except on instructions from the controller, unless this obligation is required by Union or Member State law.

Moreover, the banking institution should have implemented some technical measures so as to ensure the confidentiality of personal data and strictly authorized access to data transmitted by its customers.

The non-compliance with the requirements aforementioned, has led to the infringement of GDPR and the sanctioning of the controller concerned with 5 000 EUR.

Statements adopted by European Data Protection Board

During the Plenary Session of the European Data Protection Board, held online on 16 June 2020, the following documents were adopted:
•        Statement on the data protection impact of the interoperability of contact tracing apps;
The Statement emphasizes the need to respect the transparency and legal basis of the processing involved, data subject rights, principles of data minimization and personal data confidentiality. Furthermore, the goal of interoperability should not be used as an argument to extend the collection of personal data beyond what is necessary.

•        Statement on the processing of personal data in the context of reopening of borders following the COVID-19 outbreak.
The statement specifies the measures allowing a safe reopening of the borders currently envisaged or implemented by Member States include testing for COVID-19, requiring certificates issued by health professionals and the use of a voluntary contact tracing app. At the same time, the EDPB urges the Member States to take a common European approach when deciding which processing of personal data is necessary in this context.