On 26 February 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for the employees of the General Inspectorate for Migration (GIM), South Regional Department, at their request.

The purpose of the training course was to increase the level of perception of employees of the GIM South Regional Department ​​on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

Important topics were discussed during the event, such as:

• The definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• The processing of special categories of personal data;

• The principles and legal grounds for the processing of personal data;

• The requirements for the protection of personal data in the exercise of official duties;

• Data Protection Officer (DPO) designation issues;

• The obligations and tasks of a DPO;

• Ensuring the security and confidentiality of personal data processed, etc.

The training course was an interactive one, the participants asking multiple questions to the trainers about the requests for personal data disclosure coming from countries that do not ensure an adequate level of data protection, the issues related to the proper procedure for accessing personal data through the State Information Systems, the proper audit trail of these accesses, as well as the correct depersonalization of information containing personal data.

During the event 21 representatives from GIM, South Regional Department were trained.

On 25 February 2025, a study visit of a group of students – members of the European Law Students Association of the Republic of Moldova (ELSA) – the largest international, independent, apolitical and non-profit organization managed by/and for students – took place at the National Center for Personal Data Protection.

The aim of the event focused on raising awareness among young generation/university community on the field of personal data protection, strengthening knowledge in the field, as well as exploring the applicable legal framework, the rights and obligations of the parties involved and the importance of compliance with various areas.

At the same time, the students were informed about the organization and functioning of the NCPDP, the attributions of the NCPDP’s subdivisions, structure, mission, and the role of the authority in monitoring compliance with the legislation on personal data protection.

The students were also familiarized with: general notions related to the field of personal data protection; the rights of personal data subjects; principles and legal grounds for processing personal data; processing of special categories of personal data; ensuring the security and confidentiality of personal data processed, etc.

The event ended with a question and answer session documented with practical examples, and the NCPDP aims to continue to support such efforts to educate and raise awareness among young people about the importance of personal data protection.

 The study visit was organized at the request of the European Association of Law Students, an organization which currently has 40,000 members in 42 countries from Europe.

On 14 February, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for maib representatives, at their request.

The aim of the training course was to increase the banking sector employees’ awareness of the principles of personal data protection and the correct application of the legal provisions in the field in their work.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the principles and legal grounds for processing personal data; the requirements for the protection of personal data in the exercise of official duties; the assurance of  the security and confidentiality of processed personal data, etc.

The training course was an interactive one, with multiple practical examples being presented in order to increase the perception of maib representatives on the principles of personal data protection. At the same time, the new legal provisions in the field of personal data protection, the aspects related to the obligations of the controller/ processor in relation to the appointment of the Data Protection Officer, his/her obligations and tasks, the conditions under which it is necessary to perform the Data Protection Impact Assessment, anonymization/pseudonymization of personal data, as well as the financial penalties in case of a breach of the legislation in the field, were of great interest to the participants.

About 100 maib representatives were trained at the event, moderated by personal data protection experts from the NCPDP.

The National Center for Personal Data Protection (NCPDP), for information and enforcement purposes, informs about the administrative fine of 240 000 euros imposed by the French Data Protection Authority (CNIL) on KASPR for violation of Article 5 – Principles relating to processing of personal data, Article 6 – Lawfulness of processing, Article 12 – Transparent information, communication and modalities for the exercise of the rights of the data subject, Article 14 – Information to be provided where personal data have not been obtained from the data subject, Article 15 – Right of access by the data subject. 

KASPR markets an extension for the Chrome browser that enables paying customers to obtain the professional contact details of people whose profiles they visit on the LinkedIn social network. To do this, the company builds a database of contact details from LinkedIn and other websites such as domain name registries. The contact details thus collected generally enable the company’s customers to contact the target persons, for example for commercial prospecting, recruitment or identity verification. KASPR’s database contains about 160 million contacts.

The French Supervisory Authority, CNIL received many complaints from people who had been canvassed by entities that obtained their contact details via the KASPR extension.

The CNIL found several breaches of the GDPR:

• Failure to comply with the obligation to have a legal basis (Article 6 of the GDPR)

• Failure to comply with the obligation to define and respect a data retention period proportionate to the purpose of the processing (Article 5-1-e of the GDPR)

• Failure to comply with the obligation to provide transparency and information to individuals (Articles 12 and 14 of the GDPR)

In this context, CNIL imposed a fine of 240,000 euros on KASPR for all these breaches, and ordered the company to: cease collecting the data of persons who chose to limit the visibility of their contact details, and delete the data collected in this way. If it is impossible to distinguish the data whose visibility had been limited, the company will have to inform the persons concerned, within 3 months, of the processing of their data and of the possibility of objecting to it, and to use their data solely for this purpose; stop the automatic renewal of the storage of personal data of target persons; inform the people whose data is collected in a language they understand; respond to requests for access from individuals, providing all available information on the sources of data collection.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

Every year on January 28, the European community celebrates the European Data Protection Day, an event supported by the European Commission to promote the right to privacy and the right to protection of personal data.

It is a very special day, not only for the Member States of the Council of Europe, but also for the entire global Data Protection Community and, above all, for every individual protected by this fundamental right.

On the occasion of this day, the National Centre for Personal Data Protection (NCPDP), together with other similar European authorities, organises specific activities to raise awareness and promote good practices in the field of privacy and data protection. These activities include street actions aimed at the general public to inform and raise awareness about data protection.

In this context, today, January 29th, several employees of the NCPDP distributed to people walking in front of the Triumphal Arch in mun. Chisinau, information materials, informing them about the European Data Protection Day, the definition of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. At the same time, citizens were informed about possible situations of non-compliant processing of personal data and were given practical guidance and recommendations that should be taken in such cases.

In the current year, the NCPDP aims to organize several information and awareness-raising activities for the general public in order to educate, motivate and encourage Moldovan citizens to pay more attention to the protection of their personal data.

Awareness of the need for information, promote and ensure the protection of the rights of individuals with regard to the processing of personal data, as well as the need for joint efforts to implement these values, on January 28, 2025, the National Center for Personal Data Protection (NCPDP), represented by the Director Victoria MUNTEAN signed the Training Plan in the field of personal data protection with the General Inspectorate of Police (GIP), represented by the Chief, Viorel CERNĂUĂȚEANU, and with the General Inspectorate of Border Police (GIBP), represented by the Chief, Ruslan GALUȘCA for employees of the structural subdivisions of the GIBP and GIP.

The primary goal of the above-mentioned training plans is to raise awareness of the employees of the GIP and GIBP structural subdivisions on the principles of personal data protection and to ensure the correct implementation/application of the legal provisions in the field of data protection in their daily work. The training plans have been drawn up and approved by mutual agreement and provide for offline training in the GIP and GIBP structural subdivisions.

At the same time, we would like to point out that the strengthening of interinstitutional cooperation at the national level, in order to reinforce the actions aimed at raising society’s awareness of the importance of the personal data protection, as well as to increase the level of correct interpretation and consistent application of the legal provisions in the field of the personal data protection by the actors involved in the processing of personal data, remains one of the priorities of the NCPDP for 2025, and only in the month of January, three cooperation agreements have already been signed with public institutions, such as General Inspectorate of Migration, General Inspectorate of Police and General Inspectorate of Border Police.

The above-mentioned cooperation agreements are also part of the activities planned to be organized in the context of the 19th European Data Protection Day.

Today, January 28th, the National Centre for Personal Data Protection (NCPDP), in cooperation with the e-Government Academy (eGA), is organising the national conference “New legal provisions in the field of personal data protection in the Republic of Moldova”.

The aim of the conference is to raise awareness among representatives of both public institutions and the private sector about the new legal provisions in the field of personal data protection, in order to ensure an adequate level of protection for data subjects worldwide.

The event was opened by the Director of the NCPDP, Ms Victoria Muntean: “In the current context, with the rapid expansion of new technologies such as artificial intelligence, big data analytics and digital surveillance, the challenges for data protection are becoming increasingly complex. At the national level, the implementation of the new legislation reflects our commitment to harmonise the legal framework with international standards, but also to respond to today’s specificities and needs. These changes come at a crucial moment of particular national importance, as the Republic of Moldova is taking firm steps towards integration into the European Union, and the protection of personal data is an important pillar in this process. The discussions at today’s conference will provide a valuable opportunity to analyse how these new rules can be implemented effectively, while ensuring a balance between the protection of individual citizens’ rights and the opportunities for sustainable economic and social development”.

The conference is moderated by personal data protection experts from the NCPDP, Estonia and Romania. Among the topics to be addressed by the experts are: New personal data protection legislation in the Republic of Moldova; The data protection legal framework: from data subjects’ rights and controllers’ responsibilities to breach management; Erasing footprints: exploring the right to be forgotten; Bridging the gap: personal data protection versus network and information security; Generative Artificial Intelligence and data privacy: striking the balance between innovation and safeguarding the privacy of individuals; and two panel discussions: Demystifying privacy enhancing techniques and ways it can help an Organization stay ahead of the ever evolving regulatory curve and What can cybersecurity enforcement teach us about strengthening data protection?

More than 150 representatives of both public and private institutions are participating in the event.

The national conference is organized with the support of the EU Cybersecurity 2.0 Rapid Assistance project, implemented by the Estonian E-Government Academy..

On January 13, 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for employees of the State Enterprise “Moldelectrica”, at their request.

The purpose of the training course was to increase the level of perception of employees of the State Enterprise “Moldelectrica” ​​on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

Important topics were discussed during the event, such as:

• The definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• The processing of special categories of personal data;

• The principles and legal grounds for the processing of personal data;

• The aspects related to the appointment of the Data Protection Officer (DPO);

• The obligations and tasks of a DPO;

• Aspects related to the Data Protection Impact Assessment (DPIA);

• The stages and obligation to perform a DPIA, etc.

The training course was interactive, with participants asking multiple questions regarding the legal way of processing personal data in the daily activity carried out by the company’s employees, as well as ensuring the security and confidentiality of this data.

About 40 representatives from the State Enterprise “Moldelectrica” ​​participated in the event.

The National Center for the Protection of Personal Data (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 2,4 million euro imposed by the Finnish Data Protection Authority (SA) on Posti for violation of Article 6 (Lawfulness of processing), Article 13 (Information to be provided where personal data are collected from the data subject), Article 5 (Principles relating to processing of personal data) and Article 25 (Data protection by design and by default) of the GDPR.

The Finnish Supervisory Authority (SA) investigated the processing of personal data of Posti related to the creation of an electronic mailbox. The Finnish SA had received complaints about the forwarding of letters to Posti‘s online service without the customer’s consent. The controller had automatically created an electronic mailbox for customers without a separate request. The electronic mailbox had been linked to a wider set of services. The investigation showed that the customer could not choose whether to use it or not, as the different services were linked together in a single contract. 

Following the investigation, the Finnish SA found out that the service requested by the customer could have been provided without the automatic creation of an electronic mailbox. Also, the controller did also not inform its customers clearly about the activation of the electronic mailbox. There were also technical settings in the service that did not meet data protection requirements. These included an automatically activated selector function and a pre-ticked checkbox.

In this context, the Finnish SA imposed an administrative fine of €2,4 million on the controller for unlawful processing of personal data. At the same time, the controller was reprimanded for the shortcomings in informing the customers and was ordered to correct its unlawful practices and to take into account that electronic services must be built from the outset so that only necessary personal data is processed.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

The National Center for the Protection of Personal Data (NCPDP), for information and enforcement purposes, communicates about the administrative fines of on COSMOSPACE – 250 000 euro and on TELEMAQUE – 150 000 euro, imposed by the French Data Protection Authority (CNIL) for violation of Article 5 Principles relating to processing of personal data and Article 9 Processing of special categories of personal data of the GDPR.

COSMOSPACE and TELEMAQUE provide remote clairvoyance services, one by telephone and the other by online chat and text messages. Inspections carried out by the CNIL in 2021 revealed several breaches, including the collection of sensitive data without prior explicit consent (in particular health data and data relating to sexual orientation), the retention of data for an excessive period, the sending of commercial prospection communications to people who had not given their consent and, in the case of COSMOSPACE, systematic recording of telephone calls. 

In this context, CNIL imposed a fine of €250,000 on COSMOSPACE and a fine of €150,000 on TELEMAQUE. These fines were adopted in cooperation with about fifteen European counterparts of the CNIL in both cases. The amounts of these fines were decided on the basis of the seriousness of the breaches, the number of people concerned – the database shared by the two companies containing the data of more than 1.5 million people – and the sensitivity of the data processed. The financial situations of the companies and their structures were also taken into account, in order to set dissuasive but proportionate fines.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.