The National Center for Personal Data Protection (NCPDP), for informational and practical purposes, reports on the administrative fine of €262,500 imposed by the Polish Data Protection Authority (SA) on the company Centrum Medyczne Ujastek Sp. z o.o. for violations of Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data is collected from the data subject), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), and Article 32 (Security of processing) of the GDPR.

Between July 1 and 23, 2023, Centrum Medyczne Ujastek Sp. z o.o., based in Krakow, carried out monitoring through video surveillance in the neonatology department, recording images of both newborns and their mothers engaged in intimate activities such as breastfeeding According to the explanations provided by the facility, the children whose images were captured on the recordings no longer required intensive care, so their health was not at risk. 

Following investigations, the Polish SA found that the video surveillance conducted by the medical center violated applicable regulations and was furthermore covert in nature—neither the patients nor the employees of the facility were informed about the continuous video recording. determined that the memory cards that contained the recordings had not been encrypted, and that the devices used for image recording had not been configured to meet the requirements of the facility. In addition, the risk analysis provided by the medical center did not cover the risks that were the cause of the incident and did not identify security measures that could have prevented the incident from occurring. 

In this context, the Polish SA has imposed an administrative fine of €157,500 for violations of Article 6(1), Article 9(1), and Article 13(1,2) of the GDPR, and an additional fine of €105,000 for violations of Article 24(1), Article 25(1), and Article 32(1,2) of the GDPR.

As the national supervisory authority for personal data processing, the NCPDP emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework on personal data protection and to ensure that personal data processing operations are carried out in accordance with the applicable legislation.

On 6 June 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for representatives of Level I and II Local Public Authorities (LPAs) from the jurisdiction of the Hîncești Territorial Office, at the request of the State Chancellery (SC).

The purpose of the training was to familiarize public officials from Level I and II LPAs within the jurisdiction of the Hîncești Territorial Office of the SC with key aspects related to the field of personal data protection in public service, the regulation of data processing procedures, as well as the confidentiality and security requirements for personal data, in accordance with the current legislation.

The event addressed important topics, such as: the definition of general concepts related to the field of personal data protection; the principles and legal grounds for personal data processing; the rights of data subjects; the processing of special categories of personal data; data protection requirements in the performance of official duties; ensuring the security and confidentiality of processed personal data; aspects concerning the appointment of a Data Protection Officer (DPO), including their responsibilities and tasks, among others.

The training proved to be interactive, with particular interest shown in topics such as: access to information of public interest with regard to personal data protection legislation; the proper procedure for accessing personal data through state information systems; and the obligation to anonymize/depersonalize excessive personal data when publishing normative acts.

The event was attended by approximately 85 representatives of Level I and II LPAs from the districts of Hîncești, Cimișlia, Leova, and Basarabeasca, as well as employees of the Hîncești Territorial Office of the SC.

On June 3, 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for the representatives of 10 local public authorities (LPAs) participating in the financial support program “Strengthening Governance Based on Reliable and Disaggregated Demographic Data for Central and Local Public Authorities”, at the request of the United Nations Population Fund (UNFPA).

The purpose of the training session was to strengthen the capacities of LPA representatives by familiarizing, raising awareness, and informing them about the field of personal data protection.

The event addressed important topics, such as:

• The definition of general concepts related to the field of personal data protection;

• The principles and legal grounds for personal data processing;

• The access to information of public interest with regard to personal data protection legislation;

• The proper procedure for accessing personal data through state information systems and the record maintained by municipal representatives of such access;

• Examination of requests for the disclosure of personal data, among other topics.

The event was held online, and was attended by 42 representatives from the municipalities of Ghidighici, Budești, Ruseștii Noi, Edineț, Bălți, Florești, Copceac, Cimișlia, Nisporeni, and Strășeni.

This event underscores the strong commitment of the NCPDP to continue organizing training sessions in the field of personal data protection, thereby contributing to the strengthening of a culture of respect for the right to privacy, and increasing awareness among LPA representatives regarding the importance of processing personal data in accordance with legal requirements.

Every year, on May 9th, Europe Day is celebrated as a symbol of peace and unity in Europe. Europe Day 2025 marks the fundamental values that served as the foundation for the formation and development of the European Union— principles that have transformed the 27 member states into prosperous countries dedicated to promoting human rights, peace, and progress. Additionally, Europe Day 2025 commemorates the 75th anniversary of the Schuman Declaration, which laid the foundation for the European Union as we know it today. In a speech delivered in Paris in 1950, then French Minister of Foreign Affairs Robert Schuman proposed establishing a new form of political cooperation in Europe to forever eliminate the possibility of another war between European nations. Robert Schuman’s proposal is considered the cornerstone of the European Union. To mark this day, EU institutions open their doors to the public in early May in Brussels and Strasbourg. Local EU offices throughout Europe and worldwide organize various activities and events for all ages.

In the Republic of Moldova, Europe Day was officially established in 2017, making it one of the country’s youngest holidays. This year, Europe Day will be celebrated under the slogan “Peace, Prosperity, Dignity – Europe Is You!” The traditional European Village will take place in the Great National Assembly Square under the aegis of the Government, the Delegation of the European Union to the Republic of Moldova, together with the embassies of EU member states and EU-funded projects.

The National Centre for Personal Data Protection (NCPDP), alongside other institutions from the Republic of Moldova and the EU, participates every year in the celebration of Europe Day, organizing various events to raise public awareness about the EU.

Over the years, NCPDP has followed the European trajectory, collaborating closely with EU institutions and benefiting from their support. For example, in 2025, in partnership with the e-Government Academy, NCPDP organized, on January 28, the national conference “New Legal Provisions in the Field of Personal Data Protection in the Republic of Moldova,” for around 150 representatives from both public institutions and the private sector. The event, supported by the EU’s Cybersecurity Rapid Assistance 2.0 project, served as an opportunity to exchange experience and best practices with EU experts regarding raising awareness and informing the public and private sectors about personal data protection.

Although the field of personal data protection is relatively new for the society of the Republic of Moldova, significant progress has been made in recent years towards achieving the national objective of ensuring an adequate level of personal data protection, in line with the norms of the European Union and the Council of Europe, as well as guaranteeing the protection of fundamental rights and freedoms of citizens, especially the right to privacy regarding personal data processing.

In this context, on August 23, 2024, Law No. 195/2024 on Personal Data Protection was published in the Official Gazette of the Republic of Moldova. This law faithfully transposes the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR). The new legislation will enter into force two years after its publication in the Official Gazette.

Furthermore, international cooperation remains a key driver for the institutional development objectives of NCPDP. Successes in this area have been achieved thanks to the exchange of experience, knowledge, and best practices with data protection authorities, training provided by EU experts, and the adoption and practical implementation of international standards for the protection of personal data. Cooperation, both at the European and international levels, represents a strategic aspect requiring engagement in all ongoing initiatives.

Europe Day 2025 is about reaffirming the commitment to the values that unite us and make us strong: Peace, Prosperity, and Dignity; it is about the future of every European citizen, with the EU at the same time representing a democratic model of values and principles that have been-and remain-fundamental for their prosperity.

On April 15, 2025, the National Centre for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for the employees of the Briceni Police Inspectorate.

The purpose of the training session was to enhance the understanding of personal data protection principles among the Briceni Police Inspectorate staff, as well as to ensure the correct application of the legal provisions in this field, in the performance of their duties.

Key topics discussed during the event included: the definition of general concepts related to personal data protection; the rights of data subjects; the processing of special categories of personal data; the legal manner of processing personal data in the activities carried out by police authorities; data protection obligations in the performance of official duties; ensuring the security and confidentiality of processed personal data, etc.

The training session proved to be highly beneficial and interactive, with participants showing particular interest in topics such as the correct procedure for accessing personal data through State Information Systems, including the application of exceptions and restrictions regulated by Article 15 of Law No. 133/2011, as well as the legal aspects of processing personal data through video surveillance systems.

A total of 75 representatives of the Briceni Police Inspectorate took part in the event.

This training session is part of the 2025 training plan for the subdivisions of the General Inspectorate of Police (GIP), approved and signed by the heads of NCPDP and GIP on January 28 of the current year.

On 22 May 2025, the National Centre for Personal Data Protection (NCPDP) conducted a training session in the field of personal data protection for representatives of the Ungheni Refugee Council, at the request of the United Nations High Commissioner for Refugees (UNHCR).

The training aimed to inform participants about personal data protection, given that refugees are often exposed to security and confidentiality risks. Additionally, participants were provided with all the necessary tools to act in full compliance with applicable legislation and professional ethics.

The event addressed important topics, such as:

• Respecting fundamental principles regarding the collection, processing, and storage of personal data;

• Ensuring the confidentiality and security of sensitive data concerning refugees, asylum seekers, and other individuals registered with the UNHCR;

• Preventing and reporting data security incidents, etc.

In this context, members of the Refugee Councils strengthened the necessary competencies to manage personal data responsibly, thereby contributing to a safe, transparent, and dignified environment for beneficiaries.

Around 20 representatives took part in the training session, including Ukrainian refugees, local authorities, and members of UNHCR.

This event underscores the NCPDP’s commitment to developing a data protection framework that responds to the needs of an increasingly diverse and interconnected society. Through these training sessions, NCPDP aims to raise awareness and promote responsibility regarding data protection, both among authorities and international organizations supporting refugees.

Between 27–29 May 2025, representatives of the National Centre for Personal Data Protection (NCPDP) took part in the 11th edition of the international e-Governance Conference 2025, held in Tallinn, Estonia. Titled “From Bytes to Benefits”, the conference focused on the impact of digital transformation on the economy, along with the financial costs and benefits it entails. This event was a a landmark in the field of digital governance, aimed to provide participants with valuable insights into digital transformation, interoperability, cybersecurity, and the use of artificial intelligence in public administration, while also highlighting best practices and opportunities for international collaboration.

Throughout the working sessions, a series of current topics were addressed, including:

• From bytes to benefits: a strategic approach to digital transformation

• The true cost of digital transformation: investing in long-term value

• Building trust and value through interoperability: the engine of digital efficiency and economic growth

• Shaping prosperity: political leadership and strategic choices for digital economic growth

• Cybersecurity and public-private partnerships: strength in collaboration

• Digital strategies: building a secure and prosperous future

In addition, practical sessions and thematic presentations were held, showcasing best practices from Estonia, Kenya, Ukraine, and Brazil in areas such as cybersecurity, digital education, defence, open data and sustainability, political leadership in digitalization, the role of citizen-centred digital infrastructures, and public-private partnerships in cybersecurity. The agenda also included thematic workshops focusing on interoperability, digital governance, and Digital Public Infrastructure (DPI) frameworks, AI-assisted design of public services, the transition from paper-based to digital services, the role of civil society in cybersecurity resilience, as well as exhibitions and demonstrations of technological solutions applied in public administration and emergency services.

The e-Governance Conference 2025 served as a global meeting point for digital governance leaders and practitioners worldwide, hosting over 600 digital development leaders, policymakers, and donors from more than 80 countries. The event was organized by the e-Governance Academy (eGA), the Ministry of Foreign Affairs of Estonia, and the Estonian Centre for International Development Cooperation, with support from ITL, the European Union, CybExer, Digital Nation, EstoniaHub, FIAP, Recorded Future, the City of Tallinn, Visit Estonia, the World Bank Group and Zetes.

The National Center for Personal Data Protection (NCPDP), in collaboration with the General Inspectorate of the Border Police (GIBP), continues its public awareness campaign on personal data protection. The campaign, carried out under the slogan “Maximum Vigilance When Sharing/Providing Personal Data,” took place at Chișinău International Airport—one of the Republic of Moldova’s most important transit points—with the aim of raising citizens’ awareness about the risks associated with uncontrolled disclosure of personal data.

The awareness activities involved the active participation of the Personal Data Protection Department within the GIBP, as well as the Personal Data Protection Service of the Ministry of Internal Affairs. During the event, data subjects received informative materials and practical advice, being warned that identity documents (such as ID cards, passports), civil status certificates, pensioner ID cards, bank cards, etc., contain a multitude of personal data that require effective protection by their holders. Providing or transmitting copies of these documents, as well as writing personal data in various lists or documents for purposes other than those explicitly provided by law, may lead to illegal use of such data for purposes contrary to those initially intended, to the detriment of the data subjects.

Representatives of the NCPDP emphasized that any request from third parties for access to such data must be treated with utmost caution. It is essential that holders of these data/documents verify the legality of the request and the exact purpose of collecting personal data before providing them.

The campaign “Maximum Vigilance When Sharing/Providing Personal Data” took place in a public, interactive setting, with the participation of Ms. Victoria Muntean, Director of the NCPDP, who, as an active promoter of citizens’ fundamental rights, highlighted the crucial role of continuous education and information of the public in the face of increasingly frequent and sophisticated threats related to identity theft and the abusive use of personal data: “Personal data is not just simple information; it reflects who we are, what we do, and what defines us as individuals. Once publicly exposed or stolen, these data can open the door to abuses, financial fraud, or serious violations of privacy. Through this campaign, we aim to build an informational safeguard as well as a culture of data protection among the population.”

As part of interinstitutional collaboration, the NCPDP and GIBP will continue to organize informational sessions in regional areas. Citizens will be informed about potential cases of non-compliant processing of personal data, and they will receive guidance and practical recommendations on the actions to take in such cases.

Additionally, we specify that the mentioned awareness campaign was simultaneously carried out at the regional departments of the GIBP and state border crossing points.

In this regard, as the national supervisory authority for the processing of personal data, the NCPDP stresses the responsibility of every citizen to ensure the protection of personal data, as the security and confidentiality of these data must remain a priority.

On 19 May 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for staff members of the Information Technology and Cyber Security Service (ITCSS), following a request from the institution.

The purpose of the training was to familiarize ITCSS staff with key aspects of personal data protection in the public service, the regulation of processing procedures, and the confidentiality and security measures for personal data in accordance with current legislation.

The event addressed several important topics, such as:

• Definition of general concepts related to personal data protection;

• The rights of personal data subjects; 

• The processing of special categories of personal data;

• Personal data protection obligations in the performance of official duties;

• Ensuring the security and confidentiality of processed personal data;

• Aspects related to the appointment of the Data Protection Officer (DPO), along with their responsibilities and duties;

• Aspects related to the Data Protection Impact Assessment (DPIA), including the stages involved in conducting one, etc.

The training session was interactive, featuring numerous practical examples to enhance the participants’ understanding of personal data protection principles. Additionally, topics such as access to public interest information, as regulated by data protection legislation, the proper disclosure of such information in accordance with the principle of proportionality in limiting access to public interest information, the retention/storage, and use of personal data after the completion of processing operations were of particular interest to the participants. 

The event was moderated by representatives of the National Center for Personal Data Protection, and around 15 representatives of the Information Technology and Cyber Security Service participated in the training session.

On May 17th, 2025, the National Center for Personal Data Protection (NCPDP) participated in the celebration of Europe Day, which took place in Stefan cel Mare Square in Causeni.

This year’s edition was held under the slogan “Peace, Prosperity, Dignity – Europe is You!”, celebrating the 75th anniversary of the Schuman Declaration (May 9, 1950), which laid the foundation for the European Union, marking the core values that have guided its formation and development.

Participants in the event had the opportunity to engage with representatives of public institutions, diplomatic missions of EU Member States accredited in Chisinau, and to take part in various educational, creative, and interactive activities. They could also enjoy European cuisine and attend informational sessions on current topics. 

EU member states showcased the support they provide to the Republic of Moldova, highlighting the assistance offered while also sharing their cultural and culinary traditions. EU-funded projects, which provide support in various fields, offered visitors information about ongoing activities and who the concrete or potential beneficiaries of this assistance might be.

Representatives of the NCPDP set up a stand with educational-informative materials and promotional items, and the general public was informed about the field of personal data protection. The topics that were of great interest were: the notion of personal data, data subjects’ rights, data security and confidentiality measures, principles of personal data protection, etc. Citizens were informed about possible situations of non-compliant processing of personal data and were given practical guidance and recommendations that should be taken in such cases. At the same time, children were informed about adopting responsible and safe behavior in the digital space in order to surf the internet in a safe and ethical way, reducing their vulnerability to online threats. Children played interactive games, completed a crossword puzzle and took part in a question-answer round, and were rewarded with prizes.

The European Village is traditionally organized by the EU Delegation to the Republic of Moldova, in partnership with public authorities and diplomatic missions accredited in our country, in order to celebrate the annual holiday of peace and unity in Europe – Europe Day. NCPDP participated in the event, joining the initiative of the e-Government Academy.