On April 08th, 2025, the National Center for Personal Data Protection (NCPDP) organized two training courses in the field of personal data protection for the employees of the Central Customs Office, Central Administration, the Training Center, at the request of the Customs Service (CS).

The aim of the training course was to increase the CS employees’ awareness on the principles of personal data protection, as well as to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the principles and legal grounds for processing personal data; the rights of personal data subjects; the processing of special categories of personal data; the requirements for personal data protection in the exercise of official duties; ensuring the security and confidentiality of personal data processed; aspects related to the appointment of the Data Protection Officer (DPO); aspects related to the Data Protection Impact Assessment (DPIA), etc.

The training courses proved to be interactive and useful, and aspects related to the term of storage of information containing personal data in accordance with the legal provisions, the correct procedure for accessing personal data through the state information systems, the examination of requests for personal data disclosure, as well as the correct depersonalization of information containing personal data were of great interest to the course participants.

During the events, 92 customs officials from the Central Customs Office, Central Administration, Training Center were trained.

The training courses are part of the training plan within the CS for the year 2025, approved and signed by the heads of the NCPDP and the CS on March 27th.

On April 2nd 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the representatives of the territorial subdivisions of the National Office of Social Insurance (NOSI), at their request.

The aim of the training course was to increase the NOSI employees’ awareness on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event important topics were discussed, such as:

• The definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Principles and legal grounds for the processing of personal data;

• Aspects related to the appointment of the Data Protection Officer (DPO);

• Ensuring the security and confidentiality of personal data by NOSI employees, etc.

The training course proved to be interactive, the participants asked multiple questions regarding the processing of personal data in the day-to-day work carried out by NOSI representatives, the legality of requests to disclose personal data to third parties, as well as the correct procedure for accessing personal data through the State Information Systems. 

The event took place in on-line format, being trained about 20 representatives of the territorial subdivisions of NOSI from Causeni, Ialoveni and Rezina.

On April 4th, the National Centre for Personal Data Protection (NCPDP) continued its information and awareness-raising campaign for the school community, organizing two training courses on “Personal Data Protection and Children’s Safety in the Online Environment” for the students of Public Institution “Mihai Stratulat” Theoretical High School in Boșcana village and the Public Institution “Nicolae Bălcescu” Theoretical High School in Ciorescu village. The event took place in the framework of the Personal Development class, the target audience being fourth grade students.

The aim of the information and awareness-raising campaign for the school community is to provide high visibility on personal data protection and children’s safety online environment at local and national level by promoting empowerment and best practices for intervention and support.

The topics covered in the training were: the definition of general notions related to the field of personal data protection; attitudes and practices when sending photos/videos online; risks and threats in the online environment, such as: malware, spam, online bullying, theft of information; communication on social networks, etc.

Students also played interactive games, completed a crossword puzzle based on the material presented and took part in a question-answer round, with the best students being awarded with prizes.

The event was organized at the initiative of the NCPDP, and about 85 students were trained. At the same time, the information materials and the gifts offered to the students were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on April 15, 2022, and the NCPDP aims to continue this format of training in schools in Chisinau municipality and in the districts of the Republic of Moldova.

On April 3rd, 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the representatives of the Municipal Enterprise “Infocom” at their request.

The aim of the training course was to increase the Infocom employees’ awareness on the principles of personal data protection and to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the principles and legal grounds for processing personal data; aspects related to the appointment of the Data Protection Officer (DPO); aspects related to the Data Protection Impact Assessment (DPIA); ensuring the security and confidentiality of personal data by Infocom employees, etc.

The training course was interactive, and the topics related to access to information of public interest through the framework of personal data protection, as well as the legal way of personal data disclosure in everyday activity, were of great interest to the participants.

About 25 representatives of the Municipal Enterprise “Infocom” were trained during the event.

The National Center for Personal Data Protection (NCPDCP), for information and enforcement purposes, informs about the administrative fine of €950 000 imposed by the Finnish Data Protection Authority (SA) on Sambla Group for violation of Article 5 – Principles relating to processing of personal data, Article 25 – Data protection by design and by default and Article 32 – Security of processing of the GDPR.

The Finnish SA launched an investigation based on a complaint filed by a customer. A technical investigation revealed serious data security issues with the controller’s loan comparison services. When the seriousness of the data security problems became apparent in spring of 2024, the company was ordered to immediately cease processing personal data relating to loan applicants in its e-services.

Sambla Group’s loan comparison services did not impose adequate restrictions to prevent third parties from accessing loan application data, thus violating the provisions of Art. 32, Art. 25 and Art. 5(1)(f) of the GDPR. Due to poor data security measures, the content of customer’ loan applications was accessible to third parties through personal customer URLs. Anyone with access to the URL and sufficient technical knowledge to exploit the security vulnerability had direct access to the data. The technical investigation revealed that the URLs had been targeted wit phishing and personal data had been disclosed to third parties. The information available through the links included at least the loan applicant’s contact details, as well as information on their income, housing costs, marital status and possible children.

In this context, the Finnish SA has imposed an administrative fine of €950 000 on the controller, being ordered to notify its customers of the incident. The controller has announced that it has stopped using the vulnerable URLs and has improved data security measures of its services. 

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

Recognizing the need to inform, promote and ensure the protection of the rights of individuals with regard to the processing of personal data, as well as the need for joint efforts to implement these values, on March 27th, 2025, the National Center for Personal Data Protection (NCPDP), represented by the Director Victoria MUNTEAN signed the Training Plan in the field of personal data protection with the Customs Service (CS), represented by the Director, Alexandru IACUB, for Customs Service employees.

The primary goal of the above-mentioned training plan is to raise awareness of the employees of the CS on the principles of personal data protection and to ensure the correct implementation/application of the legal provisions in the field of data protection in their daily work. The training plan has been drawn up and approved by mutual agreement and provide for offline training within Customs Service.

At the same time, we would like to point out that the strengthening of interinstitutional cooperation at the national level, in order to reinforce the actions aimed at raising society’s awareness of the importance of the personal data protection, as well as to increase the level of correct interpretation and consistent application of the legal provisions in the field of personal data protection by the actors involved in the processing of personal data, remains one of the priorities of the NCPDP, as only during the first quarter of 2025, cooperation agreements were concluded with three other state institutions, such as the General Inspectorate of Police, the General Inspectorate of Border Police and the General Inspectorate for Migration. 

On March 28th, 2025, the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for representatives of structural and specialized subdivisions of the General Inspectorate for Migration (GIM), at their request.

The aim of the training course was to increase the GIM employees’ awareness on the principles of personal data protection, as well as to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the requirements for personal data protection in the exercise of their duties; aspects related to the appointment of the Data Protection Officer (DPO); the obligations and tasks of a DPO; ensuring the security and confidentiality of personal data processed, etc.

The training course was an interactive one, with participants asking multiple questions to the trainers about the accuracy of the examination of queries containing personal data, the proper procedure of accessing personal data through the State Information Systems and the correct auditing of these accesses, the lawfulness of installing video surveillance cameras and the processing of personal data through them.

The event was attended by around 25 representatives from the structural and specialized subdivisions of the General Inspectorate for Migration.

The training course is part of the training plan within the GIM for 2025, approved and signed by the heads of the NCPDP and the GIM on January 27th.

On 25 March 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for representatives of the National Agency for Settlement of Claims (NASC), at their request.

The aim of the training course was to increase the NASC representatives’ awareness on the principles of personal data protection and to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the principles and legal grounds for processing personal data; issues related to the appointment of the Data Protection Officer (DPO); the obligations and tasks of a DPO; aspects related to the Data Protection Impact Assessment (DPIA); ensuring the security and confidentiality of personal data, etc.

The training course proved to be a useful and interactive, with participants asking multiple questions about the correct depersonalization of information containing personal data in the Decisions issued by NASC and published on the institution’s website, access to information of public interest from the perspective of the legislation on personal data protection, as well as the legal aspects of disclosure of personal data in their daily work.

During the event, 20 NASC representatives were trained.

On 26 March 2025, the National Centre for Personal Data Protection(NCPDP) organized a training course in the field of personal data protection for the employees of the General Inspectorate for Migration (GIM), Center Regional Department, at their request.

The aim of the training course was to increase the awareness of the employees of the GIM, Center Regional Department, on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the requirements for personal data protection in the exercise of official duties; ensuring the security and confidentiality of personal data processed, etc.

The training course was interactive, and the aspects related to the examination of requests for personal data disclosure, the term of retention/storage and use of personal data at the end of processing operations, as well as the aspects related to the proper procedure for accessing personal data through the State Information Systems and proper audit of these accesses, were of great interest to the participants.

The event was attended by 15 representatives from GIM, Center Regional Department.

The training course is part of the training plan for the GIM for the year 2025, approved and signed by the heads of NCPDP and GIM on January 27.

On March 26, 2025, a study visit of a group of students from the Faculty of Law of the Moldova State University (MSU) took place at the National Center for Personal Data Protection (NCPDP).

The aim of the event focused on raising the awareness of the university community on the field of personal data protection, strengthening knowledge in the field, as well as exploring the applicable legal framework, the rights and obligations of the parties involved and the importance of compliance with various areas.

At the same time, the students were informed about the organization and functioning of the NCPDP, the duties of the NCPDP’s subdivisions, the structure, mission, role of the authority in monitoring compliance with the legislation on personal data protection, as well as with the problems, objectives and case law in the work of the NCPDP.

The study visit was organized at the request of the Faculty of Law of the MSU, and the NCPDP aims to continue to support such efforts to educate and raise awareness of young people about the importance of the field of personal data protection.