On 10 December 2021, Law No. 175 of 11 November 2021 on the amendment of certain legal acts was published in the Official Gazette of the Republic of Moldova, which contains amendments in the field of personal data protection.

By the mentioned normative act, some provisions of the Law no. 133/2011 on personal data protection were amended, including:

–         New wording of the notion “consent of the data subject”, being excluded the obligation to express consent in written or electronic form.

–         Exclusion of the obligation for personal data controllers to notify the National Centre for Personal Data Protection (NCPDP). Thus, the notification procedure has been replaced by an obligation for the controller to carry out a Data Protection Impact Assessment, if personal data processing is likely to result in an increased risk to the rights and freedoms of individuals.

–          Introduction of the obligation for the controller and for the processor to designate the Data Protection Officer.

–         Repeal of art. 28 of Law 133/2011 on personal data protection, following that the Record Register of personal data controllers will be deleted, within two months from the publication of Law no. 175/2021 in the Official Gazette.

–         Rewording of Article 32 of Law 133/2011 on personal data protection, with amendments relating to the cross-border transfer of personal data and approval of the list of states ensuring an adequate level of personal data protection.

Similarly, amendments have been made to the provisions of the Contravention Code of the Republic of Moldova, in terms of contraventions attributable to the processing of personal data in violation of the legislation on personal data protection.

It should be noted that Law no. 175/2021 will enter into force within 30 days of its publication in the Official Gazette.

The NCPDP received a complaint from a data subject, requesting the verification of the legality processing of his personal data, manifested by the transmission, by a district health center, of information on his health, in the address to a lawyer, who would subsequently present them at the court hearing, considering that through these actions his private and family life had been harmed.

According to Law no. 133/2011 on personal data protection, data on patient health, results of investigations, diagnosis, prognosis, treatment, entered in the medical documentation of a patient, constitute special categories of personal data, these having an increased level of protection.

In this context, when examining the case, NCPDP took into account the provisions of Law no. 133/2011 on personal data protection, order in which, in the light of art. 6 and 7 of the Law on personal data protection, the processing of personal data on health status would be allowed only if personal data subject has given his consent or one of the following situations has occurred:

–       processing is necessary for the purposes of carrying out the obligations and specific rights of the controller in the field of employment law, providing safeguards set by law, as well as taking into account that possible disclosure of the personal data processed for this purpose to a third party may take place only if there is an appropriate legal obligation of the controller, therefore;

–       processing is necessary to protect the life, physical integrity or health of the personal data subject or of another person where the data subject is physically or legally incapable of giving his consent;

–       processing relates to data which are voluntary and manifestly made public by the personal data subject;

–       processing is necessary to establish, exercise or defend of legal claims of the personal data subject;

–       processing is necessary for the purposes to ensure national security, of reducing the risk of unleashing or in case of triggering public health emergencies where the processing is unlikely adversely to affect the rights of personal data subject and the other appropriate safeguards provided for in this law.

Alternative, art. 29 para. (1) of Law no. 133/2011 on personal data protection, establishes the obligation of controllers and third parties who have access to personal data to ensure the confidentiality of those data, except where:

a)     processing relates to data which are voluntary and manifestly made public by the personal data subject;

b)    personal data are rendered anonymous.

In accordance with the provisions mentioned above, art. 14 of the Health Care Law, states that doctors, other health care workers, pharmacists are obliged to keep secret the information regarding the disease, the intimate and family life of the patient, except the cases of danger of spread of communicable diseases, at the motivated request of the criminal investigation bodies or of the courts.

Also, the provisions of Law on the rights and responsibilities of the patient 263/2005 which contains special legal rules aimed at strengthening fundamental human rights in the health care system, ensuring respect for the dignity and integrity of the patient, and based on the nature of sensitive health data, establishes strict conditions for their disclosure. It will be emphasized that patient health data, by their nature, may present a risk for data subjects when are processed and therefore require increased protection. These data are subject to a prohibition principle and there must be a limited number of circumstances in which such processing is lawful. At the same time, the confidentiality of medical data is a professional secret, which is a form of the right to respect for privacy. Prohibition of the disclosure of medical information, classified as confidential, is necessary to ensure that medical institutions ensure the patient’s right to privacy.

In this regard, given the content of the medical certificate issued to the lawyer, NCPDP found that the disclosure of information on the nature of data subject’s diseases, which represents data on health, time of treatment, and date of the last visit to the health center, took place contrary to the legal provisions mentioned above and the principles of personal data processing provided in art. 4 para. (1) let. a) and b), as well as art. 6, 7 and art. 29 of Law no. 133/2016 on personal data protection, an action classified within the contravention norm provided by art. 741 para. (4) Contravention Code.

Following the examination of the case, NCPDP issued the decision regarding the violation of the principles of personal data processing and concluded the report on the contravention, being referred to the court and as a result the person in charge of the district health center was found guilty of committing the contravention provided by art. 741 para. (4) Contravention Code.

Recommendations:

Taking into account the provisions of art. 53 of the Law on Advocacy, in conjunction with art. 5 para. (5) of the Law on personal data protection, the request for information by a lawyer is a right and not an obligation of a lawyer. Respectively, it cannot be retained as the legal basis of the data controller – district health center, for the disclosure of personal data concerning the personal data subject, as long as the processing was not necessary for the express fulfillment of an obligation directly to the controller according to the law, the representative of the entity being obliged to ensure the confidentiality of personal data.

However, the NCPDP notes that, in a trial, in order to avoid a serious violation of the principles of personal data protection by their unauthorized disclosure, the resolution of requests for access to personal data on health status will be achieved taking into account the provisions of art. 118 Code of Civil Procedure, according to which the circumstances that are important for the fair settlement of the case are definitively determined by the court based on the claims and objections of the parties and other participants in the trial, as well as the following material and procedural law to be applied.

Respectively, the parties or other participants in the trial may address to the court (judge), pursuant to art. 119 Code of Civil Procedure, a request for evidence, and the judge, analyzing the reasons invoked in the request for evidence and assessing the proportionality of the volume of information for solving the civil case, will request the necessary evidence from organizations and individuals.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on November 5, the representatives of the local public authorities (LPA) from Râșcani district. The training course aimed to strengthen the capacities of LPA representatives and to familiarize, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; depersonalization of data within Local Documents Registry; approval of security policy and personal data filling systems instructions, etc.

The training was organized at the initiative of NCPDP, the event being attended by about 60 mayors, local councilors and secretaries of local councils of Râșcani district.

The event, moderated by three experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

On November 11, 2021, the National Center for Personal Data Protection at the request of Fălești district Council, organized a training course for the representatives of local public authorities from Fălești district, to ensure proper implementation of the provisions of personal data protection legislation. The training took place physically, at the request of Fălești district Council and was attended by about 55 persons.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; data subjects’ rights; approval of security and confidentiality of personal data within filling systems.

Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities in the State Local Documents Registry were discussed, according the point 13 sub-point 7) of the Regulation on the manner of keeping the State Local Documents Registry.

At the end, the participants in the training asked questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

On 18 November 2021, the National Center for Personal Data Protection (NCPDP) and the Office of the Information and Data Protection Commissioner of Malta signed a Collaboration Agreement in the field of personal data protection. The Agreement was signed by the Director of NCPDP, Eduard Răducan, and the Commissioner of the Office of the Information and Data Protection of Malta, Ian Deguara, during the Plenary Session of the European Data Protection Board, Brussels, Belgium.

The Agreement provides for the development of cooperation relations between the two institutions in terms of achieving constant progress in the field of personal data protection and the promotion of good practices that will create favorable conditions for ensuring effective protection of personal data of Malta’s and Moldova’s citizens.

The NCPDP states that the agreement is aimed at various activities that will encourage the exchange of information on the application of European laws, regulations, standards and recommendations in the field of personal data protection, the exchange of short-term experts for mutual professional development in specific sectors, cooperation in vocational training and qualification, consultations, conferences, workshops, study visits, organization of activities focused on promoting the protection of privacy and personal data protection, cooperation in order to organize projects of common interest for both institutions at regional and national level, etc.

We remind you that the NCPDP has concluded another 14 national collaboration agreements with institutions from different fields of activity, as well as 8 international collaboration agreements with the Personal Data Protection Authorities from Romania, Ukraine, Georgia, Italy, Hungary, Latvia, etc.

On November 19, was held the Public Action – “Protect personal data”, organized by NCPDP representatives. The target audience – the inhabitants of Ialoveni district, were informed about the importance of personal data protection.

The action took place near Ialoveni District Council and the citizens were informed about the notion of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. At the same time, the citizens were informed on possible situations in which personal data are not processed in accordance with the provisions of the national legislation in the field, by personal data controllers, and the representative of the Legal Department provided them with practical guidance and recommendations that should be undertaken in such situations.

The purpose of this action was to educate, motivate and encourage the citizens of the Republic of Moldova to pay more attention to the protection of their personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 57th Plenary Session of the European Data Protection Board (EDPB), which was held on 18 November 2021, at Brussels, Belgium.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on the interplay between Art. 3 and Chapter V GDPR. By clarifying the interplay between the territorial scope of the GDPR (Art. 3) and the provisions on international transfers in Chapter V, the Guidelines aim to assist controllers and processors in the EU in identifying whether a processing operation constitutes an international transfer, and to provide a common understanding of the concept of international transfers. The Guidelines will be subject to public consultation until the end of January.

·        Statement on the European Commission’s Digital Services Package and Data Strategy. In its statement, the EDPB reiterates its call for a ban on any use of Artificial Intelligence for an automated recognition of human features in publicly accessible spaces and urges the co-legislator to consider a phase-out leading to a prohibition of targeted advertising on the basis of pervasive tracking while the profiling of children should overall be prohibited.

·        Finally, the EDPB nominated two representatives from the Belgian and Hessen (DE) SA to take part in the 6th Joint Review of the EU-US Terrorist Finance Tracking Program (TFTP) Agreement.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP) trained, on October 7, the representatives of the local public authorities (LPA) from Căușeni district. The training course aimed to strengthen the capacities of LPA representatives and to familiarize, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; depersonalization of data within Local Documents Registry; approval of security policy and personal data filling systems instructions, etc.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Căușeni district.

The event, moderated by three experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management in the 53rd meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online on 28 – 30 September, 2021.

During the Meeting, several topics were discussed, among which:

·        Convention 108+ State of play, ratifications and accessions;

·        Evaluation and follow up mechanism under Convention 108+;

·        Digital identity;

·        Personal data processing by and for political campaigns;

·        Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·        Contractual clauses in the context of transborder data flows;

·        Cooperation with other Council of Europe bodies and entities;

·        Major developments and activities in the field of data protection, etc.

At the same time, NCPDP as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the meeting of the Bureau of the Consultative Committee of the Convention 108, as well as the weight of adopted documents.

On September 6, 2021, the National Center for Personal Data Protection (NCPDP) performed a training course for the employees of the National Administration of Penitentiaries to ensure the compliant implementation of the provisions of the legislation on personal data protection. The training was held online at the request of the National Administration of Penitentiaries and was attended by 30 employees.

The topics addressed in the training were: general notions on personal data protection, the principles of personal data protection, data subjects’ rights, assurance the security and confidentiality of personal data within the personal data filling systems.

At the end, the participants in the training asked questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.