Between July 2-3, 2025, representatives of the National Center for Personal Data Protection (NCPDP) participated in the 75th meeting of the International Working Group on Data Protection in Technology (known as the “Berlin Group”), which took place in the city of Tbilisi, Georgia.

       The aim of the event was to bring together international experts in the field of data protection to discuss and analyze the impact of new technologies on privacy and personal data security. During the meeting, participants exchanged good practices, presented national innovations, and addressed emerging challenges such as neurodata, 6G technology, and digital identity, with a view to developing common recommendations to support the improvement of data protection standards at the international level.

       During the two working days, important topics were addressed, such as:

–         Neurodata and the implications for privacy;

–         The evolution of 6G technology and the related challenges in the field of data protection;

–         Digital identity;

–         Government digital services and data protection within them (e.g. MY.GOV.GE – the unified portal of electronic services in Georgia);

–         National presentations on innovations and good practices in the field of data protection.

       The event represented a valuable framework for the international exchange of experience, strengthening cooperation between supervisory authorities and identifying common directions of action facing new technological challenges, bringing together representatives from 14 countries, as well as delegates from the European Data Protection Supervisor and the Electronic Privacy Information Center.

On July 3, 2025, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for members of the Moldovan Banks Association (ABM), at their request.

The aim of the training course was to provide ABM members with the necessary knowledge and skills to understand and effectively implement regulations and good practices regarding the protection of personal data, ensuring compliance with applicable legislation, as well as to promote a responsible and secure organizational culture in the management of personal data.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the principles and legal grounds for processing personal data; requirements regarding the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of processed personal data, etc.

The training course was interactive, with multiple practical examples presented, in order to increase the level of perception of ABM members on the principles of personal data protection. At the same time, the new legal provisions in the field of personal data protection, the aspects related to the obligations of the controller/ processor empowered by the operator in relation to the designation of the Data Protection Officer, his obligations and tasks, the conditions under which it is necessary to carry out the Data Protection Impact Assessment, as well as the pecuniary sanctions in case of a violation of the legislation in the field, presented a high interest for the course participants.

At the end of the course, participants expressed positive opinions, emphasizing the clarity and applicability of the information presented, the usefulness of case studies in understanding real challenges, the need to implement standardized internal procedures regarding data protection, as well as the need for periodic training to stay up to date with legislative changes.

During the event, 25 ABM representatives were trained.

On 13 June 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for representatives of the Cahul Refugee Council, at the request of the United Nations High Commissioner for Refugees (UNHCR).

The aim of the training was to inform participants about the field of personal data protection, in the context in which refugees are often exposed to security and confidentiality risks. Participants were also provided with the necessary tools to act in full compliance with the applicable legislation and professional ethics.

The event addressed several important topics, including:

• Compliance with the fundamental principles governing the collection, processing, and storage of personal data.
• Ensuring the confidentiality and security of sensitive information concerning refugees, asylum seekers, and other individuals registered by UNHCR;
• Prevention and reporting of data security incidents, etc.

Approximately 15 representatives took part in the event, including members of the Refugee Council, local authority representatives, and members of non-governmental organizations.

This event highlights NCPDP’s ongoing commitment to developing a data protection framework that responds to the needs of an increasingly diverse and interconnected society. Through such training sessions, NCPDP aims to contribute to raising awareness and responsibility regarding data protection among both public authorities and international organizations involved in supporting refugees.

The National Center for Personal Data Protection (NCPDP) informs, for public awareness purposes, about the participation of its leadership in the 106th Plenary Session of the European Data Protection Board (EDPB), which took place on 3–4 June 2025 in Brussels, Belgium.

During the meeting, several documents were adopted, including:

• Following a public consultation, the EDPB adopted the final version of the Guidelines on Data Transfers to Public Authorities in Third Countries, which focus on Article 48 of the GDPR and clarify how organizations can best assess the conditions under which they may lawfully respond to personal data transfer requests from authorities in non-EU countries.

• The EDPB presented the report “Law and Compliance in AI Security and Data Protection”, aimed at legal professionals such as Data Protection Officers (DPOs) or privacy experts.

• The EDPB also presented the report “Fundamentals of Secure AI Systems with Personal Data”, aimed at professionals with technical expertise, such as cybersecurity experts, developers, or implementers of high-risk AI systems.

• Lastly, the Board discussed the European Commission’s request for a joint opinion from the EDPB and the European Data Protection Supervisor (EDPS) on its proposal to simplify record-keeping obligations for small and medium-sized enterprises (SMEs), small mid-cap companies, and organizations with fewer than 750 employees. This proposal would amend Article 30(5) of the GDPR. The EDPB and EDPS will issue a joint opinion on the matter within eight weeks.

NCPDP, as the national supervisory authority for personal data processing, emphasizes the importance of Moldova’s participation in the EDPB Plenary Sessions, as well as the relevance of the documents adopted, in order to align national data protection legislation with EU standards.

The Slovenian Supervisory Authority (SA) launched an inspection ex officio after receiving an official notification regarding a data security breach. A school reported unauthorized access to students’ personal data by an external catering service provider contracted to supply meals at the school. The provider had been granted access to the school’s entire student database, including sensitive data such as subsidies and account balances, although it only needed the students’ names and surnames to monitor the catering services.

The Slovenian SA identified significant deficiencies in the school’s data protection practices. The external catering provider received unrestricted access to the entire student database, including unnecessary information such as subsidies and account balances. The school failed to implement appropriate measures to ensure compliance with the principle of data protection by design and by default, as required under Article 25 of the GDPR. Although the school promptly reported the breach, it failed to implement effective long-term technical and organizational measures to address the root causes and prevent recurrence. The case highlights the importance of adopting proper data protection protocols in educational institutions to ensure the security and integrity of students’ personal data.

The Slovenian SA issued a reprimand to the school and its principal, as the person responsible. The controller filed a request for judicial protection with the local court, which dismissed the request and upheld the decision of the Slovenian Supervisory Authority. The court emphasized that proper implementation of the principle of data protection by design and by default could have prevented the subsequent abusive practices, including unauthorized modifications of the data by the external provider and even potential fraud.

This example draws attention to the specific nature of the school environment, where the processing of students’ personal data requires special care. IT systems are often used in schools for various purposes—from managing school records to organizing meals. Precisely because of the complexity of such solutions, it is essential for schools, when establishing cooperation with external providers, to clearly define the scope of data access granted to providers and, by implementing adequate measures, ensure strict compliance with the data minimization principle.

NCPDP, as the national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the legal framework on personal data protection and to ensure that data processing operations are conducted in accordance with the applicable law.

The National Center for the Protection of Personal Data (NCPDP), for informational and practical purposes, reports on the administrative fine of €80,000 imposed by the French Data Protection Authority (CNIL) on CALOGA for violations of article 5 (Principles relating to the processing of personal data), article 6 (Lawfulness of processing), and article 7 (Conditions for consent) of the General Data Protection Regulation (GDPR).

As part of its 2022 priority focus on the oversight of direct marketing practices, CNIL investigated the activities of actors in this ecosystem—particularly data intermediaries known as data brokers. CNIL thus carried out investigations into CALOGA, which obtained marketing data primarily from other data brokers, online game competition organizers, and product testing websites. CALOGA used these data to send email marketing messages to potential customers on behalf of its advertising clients. It also shared part of these data with its clients so they could conduct their own electronic marketing campaigns.

Following the investigations, CNIL identified several infringements, including:

• Failure to obtain valid consent from individuals to receive electronic commercial offers (article L.34-5 of the French Postal and Electronic Communications Code): the misleading nature of the consent forms used by data brokers made it impossible to obtain freely given and unambiguous consent, as required under the GDPR, which should have formed the legal basis for CALOGA’s marketing activities;

• Failure to allow for withdrawal of consent (article L.34-5 of the CPCE, as referenced in article 7 GDPR): in CALOGA’s system, potential clients could not unsubscribe from the company’s various databases with a single click. Therefore, withdrawing consent was not as easy as giving it;

• Failure to ensure a legal basis for data processing (article 6 GDPR): in its role as a data broker, the company shared databases with other partners, who then used them to send marketing emails on behalf of their own advertising clients;

• Failure to define and respect a proportional data retention period (article 5(1)(e) GDPR): every time a potential client opened one of the company’s emails—even by mistake—CALOGA extended the retention period for that individual’s data in its databases, potentially indefinitely.

In this context, CNIL imposed an administrative fine of €80,000, which was made public. The amount of the fine was determined based on the large number of individuals involved, the company’s longstanding position on the market, the financial gain obtained from the violations, and the company’s complete cessation of operations in 2024.

NCPDP, as the national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the legal framework on personal data protection and to ensure that data processing operations are conducted in accordance with the applicable law.

The National Center for Personal Data Protection (NCPDP), for informational and practical purposes, reports on the administrative fine of 5 million euros imposed by the Italian Data Protection Authority (SA) on Luka Inc. for violations of Article 5 (Principles relating to the processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 13 (Information to be provided where personal data are collected from the data subject), Article 24 (Responsibility of the controller), and Article 25 (Data protection by design and by default) of the GDPR.

The Italian SA launched an investigation on its own initiative following press reports and a preliminary inquiry into the Replika service — a chatbot with both written and voice interfaces developed and managed by the U.S.-based company Luka Inc., based on a generative AI system. The chatbot enables users to “create” a “virtual companion” that can serve as a confidant, therapist, romantic partner, or mentor.

Following the investigation, the Italian SA confirmed that the alleged violations, which had prompted it to order the app’s blocking in February 2023, did indeed occur. Until February 2, 2023, the company had not identified a legal basis for the data processing operations carried out through Replika. Additionally, Luka Inc. provided a privacy policy that was non-compliant in several respects. The Italian SA also found that, until February 2, 2023, the company had not implemented any age verification mechanisms—either at registration or during use of the service—despite having stated that minors were excluded from the category of potential users.

Technical assessments revealed that the age verification system currently implemented by the controller still has several deficiencies.

In this context, the Italian SA imposed an administrative fine of 5 million euros on Luka Inc. for violations of Articles 5(1)(a), 5(1)(c), 6, 12, 13, 24, and 25(1) of the GDPR. Furthermore, the Italian SA reserves the right to investigate and assess, in a separate and autonomous procedure, the lawfulness of the processing operations carried out by Luka Inc., specifically regarding the legal bases applicable throughout the lifecycle of the generative AI system underlying the Replika service.

As the national supervisory authority for personal data processing, the NCPDP emphasizes the responsibility of data controllers to comply with the legal framework on personal data protection and to ensure that all data processing activities are conducted in accordance with the applicable legislation.

On June 10, 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for the employees of the Cantemir Police Inspectorate.

The purpose of the training session was to raise awareness among Cantemir Police Inspectorate staff regarding the principles of personal data protection, as well as to ensure the proper application of legal provisions in this field within their professional duties.

During the event, several important topics were addressed, including:

• The definitions of general concepts related to the field of personal data protection;

• The rights of data subjects;

• The processing of special categories of personal data;

• The lawful processing of personal data in police work;

• The requirements for data protection in the performance of job responsibilities;

• Ensuring the security and confidentiality of processed personal data, etc.

The training course proved to be highly useful and interactive. Particular interest was shown in topics related to the proper procedures for accessing personal data via State Information Systems, including the application of exceptions and restrictions governed by Article 15 of Law No. 133/2011.

Approximately 50 representatives of the Cantemir Police Inspectorate took part in the training.

This training session is part of the 2025 training plan for IGP subdivisions, approved and signed by the leadership of both the NCPDP and the General Police Inspectorate on January 28 of the current year.

The National Center for Personal Data Protection (NCPDP), for informational and practical purposes, announces the imposition of an administrative fine of €13,500 by the Polish Data Protection Authority (SA) for violations of Article 24 (Responsibility of the controller) and Article 32 (Security of processing) of the GDPR.

In 2022, Polskie Radio Szczecin released a press article in which a conviction for sexual harassment was described. The journalist revealed that a parliament member’s son was the victim and did it in such a way that the child could be identified. Following the discovery of harassment, this person committed suicide. 

Following the investigation carried out by the Polish SA, the following violations were found:

• Polskie Radio Szczecin, as the data controller, did not carry out a risk analysis for the processing of personal data in connection with its editorial activities;

• It failed to comply with its own personal data protection documentation;

• It also failed to implement data security measures to ensure the ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and processing services due to:

  • lack of clear and transparent rules on the handling of press material containing personal data, regulating the obligation to verify such material prior to publication in terms of personal data identifying natural persons whose publication may infringe the law or the rights and freedoms of natural persons;

  • lack of encryption for personal data storage devices used outside the processing area;

• Polskie Radio Szczecin has not put in place appropriate technical and organisational measures to ensure that the effectiveness of the technical and organisational measures to ensure the security of personal data is regularly tested, measured and evaluated.

In this context, the Polish SA imposed an administrative fine of €13,500 for violations of Article 24(1) and Article 32(1,2) of the GDPR. Additionally, on the basis of the issued decision, Polskie Radio Szczecin is to correct organisational and technical errors within 60 days.

As the national supervisory authority for personal data processing, NCPDP emphasizes the responsibility of personal data controllers to comply with the legal framework on data protection and to ensure that data processing operations are carried out in accordance with the applicable legislation.

The National Center for Personal Data Protection (NCPDP), for informational and practical purposes, reports on the administrative fine of €262,500 imposed by the Polish Data Protection Authority (SA) on the company Centrum Medyczne Ujastek Sp. z o.o. for violations of Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data is collected from the data subject), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), and Article 32 (Security of processing) of the GDPR.

Between July 1 and 23, 2023, Centrum Medyczne Ujastek Sp. z o.o., based in Krakow, carried out monitoring through video surveillance in the neonatology department, recording images of both newborns and their mothers engaged in intimate activities such as breastfeeding According to the explanations provided by the facility, the children whose images were captured on the recordings no longer required intensive care, so their health was not at risk. 

Following investigations, the Polish SA found that the video surveillance conducted by the medical center violated applicable regulations and was furthermore covert in nature—neither the patients nor the employees of the facility were informed about the continuous video recording. determined that the memory cards that contained the recordings had not been encrypted, and that the devices used for image recording had not been configured to meet the requirements of the facility. In addition, the risk analysis provided by the medical center did not cover the risks that were the cause of the incident and did not identify security measures that could have prevented the incident from occurring. 

In this context, the Polish SA has imposed an administrative fine of €157,500 for violations of Article 6(1), Article 9(1), and Article 13(1,2) of the GDPR, and an additional fine of €105,000 for violations of Article 24(1), Article 25(1), and Article 32(1,2) of the GDPR.

As the national supervisory authority for personal data processing, the NCPDP emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework on personal data protection and to ensure that personal data processing operations are carried out in accordance with the applicable legislation.