The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 17 million applied by Irish Data Protection Authority (SA) to Meta Platforms (formerly Facebook) for the infringement of articles 5(2) and 24(1) GDPR.

The Irish SA launched an inquiry of its own-volition, arising from receipt of a series of twelve data breach notifications in the period between 7 June – 4 December 2018.  The purpose of the inquiry was to examine the extent to which Meta Platforms achieved compliance with the requirements of articles 5(2) and 24(1) GDPR.

Following investigations, the Irish SA found that Meta Platforms failed to have in place appropriate technical and organisational measures such as would enable it to readily demonstrate the security measures that it implemented in practice to protect EU users’ data, thus imposing an administrative fine of EUR 17 million.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on March 25, the representatives of the local public authorities (LPA) from Soroca district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by 41 mayors and local councilors of Soroca district.

The event, moderated by experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 20 million applied by Italian Data Protection Authority (SA) to Clearview AI for illegal personal data processing.

The Italian SA launched an own volition proceeding following press reports on several issues in connection with facial recognition products which were offered by the Clearview AI Inc. Moreover, the Italian SA received, during 2021, four complaints and two alerts by two organizations that are active in the field of protecting privacy and the fundamental rights of individuals against Clearview.

The inquiries and assessment by the Italian SA found several infringements by Clearview AI: the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis, since the legitimate interest of the US-based company does not qualify as such; the company infringed several fundamental principles of the GDPR, such as transparency, purpose limitation, and storage limitation; it failed to provide the information set out by Article 13-14, to provide information on an action taken on a request under Article 15 within the due timeframe, and to designate a representative in the EU.

In this context, Italian SA imposed a ban on any further collection, by way of web scraping techniques, of images and the relevant metadata concerning persons in the Italian territory and on further processing of the standard and biometric data that are handled by the Company via its facial recognition system. Furthermore, ordered erasure of the data, including biometric data, processed by its facial recognition system and designation of a representative in the territory of the European Union.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 62nd Plenary Session of the European Data Protection Board (EDPB), which was held on-line, on 14 March 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Art. 60 GDPR. The drafting of such guidance is part of the EDPB Strategy and Work Programme 2021-2022 to support effective enforcement and efficient cooperation between national supervisory authorities (SAs).

·        Guidelines on dark patterns in social media platform interfaces. The guidelines offer practical recommendations to designers and users of social media platforms on how to assess and avoid so-called “dark patterns” in social media interfaces that infringe on GDPR requirements.

·        A toolbox on essential data protection safeguards for enforcement cooperation between EEA and third country SAs. This contributes to one of the key actions of the EDPB Strategy and Work Programme 2021-2022 and aims to facilitate the engagement between EDPB members and the SAs of third countries. The toolbox covers key topics, such as enforceable rights of data subjects, compliance with data protection principles and judicial redress.

·        A joint EDPB-EDPS opinion on the proposals to extend the Digital COVID Certificate by up to 12 months. The subject will continue to be discussed at the next Plenary Session.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP) trained, on March 11, the representatives of the local public authorities (LPA) from Dondușeni district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Dondușeni district.

The event, moderated by experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP) trained, on February 25, the representatives of the local public authorities (LPA) from Drochia district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Drochia district.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of of EUR 26.5 million applied by Italian Data Protection Authority (SA) to Enel Enegia for illegal personal data processing.

The decision was issued following complex inquiries the SA had started on account of hundreds of complaints by users who had received unsolicited calls made on behalf of Enel Energia, some of them based on pre-recorded messages.

The inquiries by the SA showed an invasive reliance on unsolicited promotional calls without the required consent addressed to users, additionally, the feedback to users’ requests to access their personal data or to object to processing for marketing purposes was delayed or missing altogether.

In the light of the infringements found, the Italian SA imposed a fine of EUR 26.5 million to Enel Energia and ordered to bring all personal data processing into compliance with legal provisions, in order to demonstrate that promotional services or contracts are only activated following promotional calls addressed to numbers that are listed in the Register of Communications Operators. Furthermore, Enel Energia will also have to implement further technical and organisational measures to handle data subjects’ requests to exercise their rights including, in particular, the right to object to processing for promotional purposes – so as to provide feedback on those requests by no later than thirty days.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 3 000 000 applied by Spanish Data Protection Agency (AEPD) to CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. for lack of specific and informed consent regarding profiling for commercial purposes.

An investigation was initiated following several indications that there might be an incorrect practice in relation to the automated profiling and decision-making of the controller in the context of its commercial activity (the controller is a financial establishment and payment institution).

CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U is an entity acting as a financial establishment and payment institution whose business consists of marketing credit or debit cards, credit accounts with or without a card.

In the framework of its commercial activity, Caixabank makes profiles for the following purposes:

·        Analyse the risk of default upon application for a product;

·        Analyse the risk of default during the application for a product;

·        Selection of target audience.

Consent is requested in the various channels of prescribers and agents for study and profiling purposes. Thus, consent is requested in the following terms: “I authorise the CaixaBank Group to use my data for study and profiling purposes”. In the present case, the interested party is provided only with generic information on the different profiling treatments and with this information the interested party is not able to know exactly what the treatment is you are consenting to. Nor is there any provision for the person concerned to express his or her choice on all purposes for which the data are processed.  

In this regard, AEPD fine of EUR 3 000 000 to CAIXABANK PAYMENTS & CONSUMER EFC, EP, S.A.U. for lack of specific and informed consent regarding profiling for commercial purposes and ordered the controller to bring processing operations into compliance with the provisions of the GDPR within six months of this decision.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP) trained, on February 11, the representatives of the local public authorities (LPA) from Edineț district. The event took place online.

The training course aimed to strengthen the capacities of LPA representatives by familiarizing, raising awareness and inform them with the field of personal data protection.

The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing, recording and live streaming of local councils’ meetings and the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry.

The training was organized at the initiative of NCPDP, the event being attended by mayors and local councilors of Edineț district.

The event, moderated by two experts in the field of personal data protection within NCPDP, was a dynamic and productive one, the participants in the training asking questions regarding the practical application of the legislation in the field of personal data protection, including providing access to information containing personal data.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the total fine in the amount of EUR 9 250 000 applied by Hellenic Data Protection Authority (DPA) to telecommunications companies COSMOTE and OTE S.A. due to personal data breach and illegal data processing.

Following a personal data breach notification (subscriber call data leakage between 01/09/2020 and 05/09/2020) by COSMOTE S.A., the Hellenic DPA investigated the circumstances under which the breach took place and, in this regard, examined the lawfulness of record-keeping in relation to leaked data, as well as the security measures applied. The investigation of the case revealed that COSMOTE had infringed the principles of legality and transparency due to the provision of unclear and insufficient information to subscribers. The company was also found responsible for poor data protection impact assessment, poor anonymisation, inadequate security measures taken, and failure to allocate the roles of the two companies (COSMOTE / OTE) in relation to the processing in question. In addition, ΟΤΕ S.A. was found to have infringed Article 32 of the GDPR due to inadequate security measures taken in relation to the infrastructure used in the context of the breach.

The Hellenic DPA, on the one hand, fined COSMOTE a total of EUR 6 000 000, and imposed the sanction of stopping the processing and destroying the data, and, on the other, fined OTE S.A. a total of EUR 3 250 000.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.