The National Center for Personal Data Protection (NCPDP), in collaboration with the General Police Inspectorate (GPI), launched today, May 19, 2025, a large-scale public awareness and information campaign about the field of personal data protection. The campaign, conducted under the slogan “Maximum Vigilance When Sharing Personal Data,” aims to increase citizens’ awareness of the risks associated with the uncontrolled disclosure of personal data.

The awareness initiative involved the active participation of the Personal Data Protection Department within the GPI, as well as the National Public Security Inspectorate. During the campaign, traffic participants were provided with informational materials and practical advice, and were warned about the potential dangers related to sharing personal data contained in various documents, such as identity cards, passports, civil status certificates, pensioner cards, bank cards, and other similar documents containing sensitive information, as well as writing down such data on various lists for alleged purposes.

Representatives of the NCPDP emphasized that any request from third parties for access to such data should be treated with utmost caution. It is essential for the holders/owners of such data/acts to verify the legality of the request and the specific purpose of collecting the personal data before providing it.

The “Maximum Vigilance When Sharing Personal Data” campaign comes in the context of increasingly frequent fraud attempts, both nationally and internationally, involving the illegal collection of personal data. From phone scams and fake emails to fraudulent websites and requests disguised under various pretexts, the dangers citizens are exposed to are growing exponentially.

Another important objective of the campaign is to strengthen inter-institutional cooperation to prevent and combat violations of personal data protection laws. As part of joint actions, the NCPDP and the GPI will continue to organize information sessions in various regions. Citizens will be informed about potential cases of improper personal data processing and will receive guidance and practical recommendations on the actions they should take in such situations.

In this regard, the NCPDP, as the national authority responsible for surveillance the processing of personal data, emphasizes each citizen’s responsibility in ensuring the protection of personal data. The security and confidentiality of this data must be a priority.

In the period 14-16 May 2024, representatives of the National Centre for Personal Data Protection (NCPDP) participated in the 32nd Spring Conference of the European Data Protection Authorities in Batumi, Georgia.

This year Spring Conference was hosted by Personal Data Protection Service of Georgia and brought together Data Protection Authorities from across Europe to address issues of common interest, emerging trends and innovative developments in the field of privacy and personal data protection. At the same time, a key objective of the conference was to promote cooperation by encouraging collaboration between the different data protection bodies in Europe and the professionals working within them. In addition, the conference served as a unique European platform for the exchange of experience and good practices in the field of personal data protection.

This years’ conference tagline was: “ A person’s most valuable treasure is their identity.” These words belong to Ilia Chavchavadze, a Georgian publisher, writer, and poet who revitalized the sense of national identity in Georgia during the second half of the 19th century. 

During the working sessions, current topics in the field of data protection were presented, such as:

• the regulation of artificial intelligence and data protection legal frameworks at national, European, and global levels;

• the protection of children’s privacy and personal data;

• the impact of modern technological developments and artificial intelligence on the right to privacy;

• current challenges in protecting personal data related to an individual’s health;

• the role of data protection officers (DPOs) and privacy professionals, etc.

At the end of each conference day, two parallel side events were held: “Data Protection in Georgia — Challenges and Opportunities” and “Fundamental Rights Impact Assessment in Artificial Intelligence: From Legal Requirements to Implementation. The Catalan FRIA Model.”

The Spring Conference has been held since 1991 and plays a key role in facilitating discussions on emerging trends in privacy and data protection. The event promotes a constructive dialogue between European data protection authorities and practitioners in the field, creating a strong platform for addressing both challenges and opportunities in data protecion space. The conference is known as a major event for reviewing European standards in personal data protection and for sharing best practices across Europe.

In addition to the official conference sessions, the Personal Data Protection Service organized supplementary events and social activities for the guests, offering participants an opportunity to experience Georgia’s unique culture, history, and natural beauty.

On May 9, 2025, the National Center for Personal Data Protection (NCPDP) joined the initiative of the e-Government Academy to participate in the inauguration event of the European Town, organized annually on the occasion of Europe Day.

This year’s edition was held under the slogan “Peace, prosperity, dignity – Europe is you!“, the event taking place in the Great National Assembly Square in Chisinau.

Europe Day 2025 is about reaffirming our commitment to the values ​​that unite us and make us strong: Peace, Prosperity and Dignity. 19 member states of the European Union shared their cultural and culinary traditions.

56 projects funded by the European Union, which provide assistance in various fields, such as rural, economic, social development, provided visitors with information about the activities carried out and who are or can become concrete beneficiaries of this assistance. The participants of the event had the opportunity to interact with representatives of public institutions, diplomatic missions of EU member states accredited in Chisinau, to participate in various educational, creative and interactive activities, to taste European cuisine and to participate in informative sessions on current topics.

Representatives of the NCPDP set up a stand with educational and informative materials and promotional articles, and the general public was informed about the field of personal data protection. Among the topics addressed that showed increased interest, we can list: the notion of personal data, the rights of data subjects, data security and confidentiality measures, the principles of personal data protection, etc. Citizens were informed about possible situations of non-compliant processing of personal data, being offered practical guidelines and recommendations that should be undertaken in such cases. At the same time, children were informed about adopting responsible and safe behavior in the digital space in order to browse the internet safely and ethically, reducing their vulnerability to online threats. Children played interactive games, completed a crossword puzzle and participated in the question-answer round, being awarded with appropriate gifts.

The European Town is traditionally organized by the EU Delegation to the Republic of Moldova, in partnership with public authorities and diplomatic missions accredited in our country, in order to celebrate the annual celebration of peace and unity in Europe – Europe Day.

On April 07th, 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the representatives of the Agency for Geodesy, Cartography and Cadastre (AGCC)), at their request.

The aim of the training course was to increase the awareness of the employees of AGCC, Cadastre of Immovable Property and INGEOCAD state enterprise on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event important topics were discussed, such as:

• The definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• The processing of special categories of personal data;

• The principles and legal grounds for personal data processing;

• Aspects related to the appointment of the Data Protection Officer (DPO);

• Aspects related to the Data Protection Impact Assessment (DPIA);

• Ensuring security and confidentiality of personal data by GCCA employees, etc.

The training course was an interactive one, with participants asking multiple questions on aspects related to access to information of public interest in the light of personal data protection legislation, aspects related to the correct procedure for accessing personal data through the State Information Systems, the correct auditing of these accesses, the correct depersonalization of information containing personal data, as well as the examination of personal data disclosure requests received from state institutions.

During the event 25 representatives of the Agency for Geodesy, Cartography and Cadastre, Cadastre of Immovable Property and INGEOCAD state enterprise were trained.

On April 10th 2025, the National Centre for Personal Data Protection (NCPDP) organized two training courses in the field of personal data protection for employees of the Central Customs Office, Central Administration, the Training Centre, at the request of the Customs Service (CS).

The aim of the training courses was to increase the CS employees’ awareness on the principles of personal data protection, as well as to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the principles and legal grounds for processing personal data; the rights of personal data subjects; the processing of special categories of personal data; the requirements for the personal data protection in the exercise of official duties; ensuring the security and confidentiality of personal data processed; aspects related to the appointment of the Data Protection Officer (DPO); aspects related to the Data Protection Impact Assessment (DPIA), etc.

The training courses proved to be interactive and useful, with participants asking multiple questions based on their daily activity, to which they received documented answers with practical examples from the trainers.

About 100 customs officials from the Central Customs Office, Central Administration, the Training Centre were trained during the events.

The training courses are part of the training plan within the CS for the year 2025, approved and signed by the heads of the NCPDP and the CS on March 27th.

On April 08th, 2025, the National Center for Personal Data Protection (NCPDP) organized two training courses in the field of personal data protection for the employees of the Central Customs Office, Central Administration, the Training Center, at the request of the Customs Service (CS).

The aim of the training course was to increase the CS employees’ awareness on the principles of personal data protection, as well as to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the principles and legal grounds for processing personal data; the rights of personal data subjects; the processing of special categories of personal data; the requirements for personal data protection in the exercise of official duties; ensuring the security and confidentiality of personal data processed; aspects related to the appointment of the Data Protection Officer (DPO); aspects related to the Data Protection Impact Assessment (DPIA), etc.

The training courses proved to be interactive and useful, and aspects related to the term of storage of information containing personal data in accordance with the legal provisions, the correct procedure for accessing personal data through the state information systems, the examination of requests for personal data disclosure, as well as the correct depersonalization of information containing personal data were of great interest to the course participants.

During the events, 92 customs officials from the Central Customs Office, Central Administration, Training Center were trained.

The training courses are part of the training plan within the CS for the year 2025, approved and signed by the heads of the NCPDP and the CS on March 27th.

On April 2nd 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the representatives of the territorial subdivisions of the National Office of Social Insurance (NOSI), at their request.

The aim of the training course was to increase the NOSI employees’ awareness on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event important topics were discussed, such as:

• The definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• Processing of special categories of personal data;

• Principles and legal grounds for the processing of personal data;

• Aspects related to the appointment of the Data Protection Officer (DPO);

• Ensuring the security and confidentiality of personal data by NOSI employees, etc.

The training course proved to be interactive, the participants asked multiple questions regarding the processing of personal data in the day-to-day work carried out by NOSI representatives, the legality of requests to disclose personal data to third parties, as well as the correct procedure for accessing personal data through the State Information Systems. 

The event took place in on-line format, being trained about 20 representatives of the territorial subdivisions of NOSI from Causeni, Ialoveni and Rezina.

On April 4th, the National Centre for Personal Data Protection (NCPDP) continued its information and awareness-raising campaign for the school community, organizing two training courses on “Personal Data Protection and Children’s Safety in the Online Environment” for the students of Public Institution “Mihai Stratulat” Theoretical High School in Boșcana village and the Public Institution “Nicolae Bălcescu” Theoretical High School in Ciorescu village. The event took place in the framework of the Personal Development class, the target audience being fourth grade students.

The aim of the information and awareness-raising campaign for the school community is to provide high visibility on personal data protection and children’s safety online environment at local and national level by promoting empowerment and best practices for intervention and support.

The topics covered in the training were: the definition of general notions related to the field of personal data protection; attitudes and practices when sending photos/videos online; risks and threats in the online environment, such as: malware, spam, online bullying, theft of information; communication on social networks, etc.

Students also played interactive games, completed a crossword puzzle based on the material presented and took part in a question-answer round, with the best students being awarded with prizes.

The event was organized at the initiative of the NCPDP, and about 85 students were trained. At the same time, the information materials and the gifts offered to the students were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on April 15, 2022, and the NCPDP aims to continue this format of training in schools in Chisinau municipality and in the districts of the Republic of Moldova.

On April 3rd, 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the representatives of the Municipal Enterprise “Infocom” at their request.

The aim of the training course was to increase the Infocom employees’ awareness on the principles of personal data protection and to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the principles and legal grounds for processing personal data; aspects related to the appointment of the Data Protection Officer (DPO); aspects related to the Data Protection Impact Assessment (DPIA); ensuring the security and confidentiality of personal data by Infocom employees, etc.

The training course was interactive, and the topics related to access to information of public interest through the framework of personal data protection, as well as the legal way of personal data disclosure in everyday activity, were of great interest to the participants.

About 25 representatives of the Municipal Enterprise “Infocom” were trained during the event.

The National Center for Personal Data Protection (NCPDCP), for information and enforcement purposes, informs about the administrative fine of €950 000 imposed by the Finnish Data Protection Authority (SA) on Sambla Group for violation of Article 5 – Principles relating to processing of personal data, Article 25 – Data protection by design and by default and Article 32 – Security of processing of the GDPR.

The Finnish SA launched an investigation based on a complaint filed by a customer. A technical investigation revealed serious data security issues with the controller’s loan comparison services. When the seriousness of the data security problems became apparent in spring of 2024, the company was ordered to immediately cease processing personal data relating to loan applicants in its e-services.

Sambla Group’s loan comparison services did not impose adequate restrictions to prevent third parties from accessing loan application data, thus violating the provisions of Art. 32, Art. 25 and Art. 5(1)(f) of the GDPR. Due to poor data security measures, the content of customer’ loan applications was accessible to third parties through personal customer URLs. Anyone with access to the URL and sufficient technical knowledge to exploit the security vulnerability had direct access to the data. The technical investigation revealed that the URLs had been targeted wit phishing and personal data had been disclosed to third parties. The information available through the links included at least the loan applicant’s contact details, as well as information on their income, housing costs, marital status and possible children.

In this context, the Finnish SA has imposed an administrative fine of €950 000 on the controller, being ordered to notify its customers of the incident. The controller has announced that it has stopped using the vulnerable URLs and has improved data security measures of its services. 

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.