Today, January 28th, the National Centre for Personal Data Protection (NCPDP), in cooperation with the e-Government Academy (eGA), is organising the national conference “New legal provisions in the field of personal data protection in the Republic of Moldova”.

The aim of the conference is to raise awareness among representatives of both public institutions and the private sector about the new legal provisions in the field of personal data protection, in order to ensure an adequate level of protection for data subjects worldwide.

The event was opened by the Director of the NCPDP, Ms Victoria Muntean: “In the current context, with the rapid expansion of new technologies such as artificial intelligence, big data analytics and digital surveillance, the challenges for data protection are becoming increasingly complex. At the national level, the implementation of the new legislation reflects our commitment to harmonise the legal framework with international standards, but also to respond to today’s specificities and needs. These changes come at a crucial moment of particular national importance, as the Republic of Moldova is taking firm steps towards integration into the European Union, and the protection of personal data is an important pillar in this process. The discussions at today’s conference will provide a valuable opportunity to analyse how these new rules can be implemented effectively, while ensuring a balance between the protection of individual citizens’ rights and the opportunities for sustainable economic and social development”.

The conference is moderated by personal data protection experts from the NCPDP, Estonia and Romania. Among the topics to be addressed by the experts are: New personal data protection legislation in the Republic of Moldova; The data protection legal framework: from data subjects’ rights and controllers’ responsibilities to breach management; Erasing footprints: exploring the right to be forgotten; Bridging the gap: personal data protection versus network and information security; Generative Artificial Intelligence and data privacy: striking the balance between innovation and safeguarding the privacy of individuals; and two panel discussions: Demystifying privacy enhancing techniques and ways it can help an Organization stay ahead of the ever evolving regulatory curve and What can cybersecurity enforcement teach us about strengthening data protection?

More than 150 representatives of both public and private institutions are participating in the event.

The national conference is organized with the support of the EU Cybersecurity 2.0 Rapid Assistance project, implemented by the Estonian E-Government Academy..

On January 13, 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for employees of the State Enterprise “Moldelectrica”, at their request.

The purpose of the training course was to increase the level of perception of employees of the State Enterprise “Moldelectrica” ​​on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

Important topics were discussed during the event, such as:

• The definition of general notions related to the field of personal data protection;

• The rights of personal data subjects;

• The processing of special categories of personal data;

• The principles and legal grounds for the processing of personal data;

• The aspects related to the appointment of the Data Protection Officer (DPO);

• The obligations and tasks of a DPO;

• Aspects related to the Data Protection Impact Assessment (DPIA);

• The stages and obligation to perform a DPIA, etc.

The training course was interactive, with participants asking multiple questions regarding the legal way of processing personal data in the daily activity carried out by the company’s employees, as well as ensuring the security and confidentiality of this data.

About 40 representatives from the State Enterprise “Moldelectrica” ​​participated in the event.

The National Center for the Protection of Personal Data (NCPDP), for information and enforcement purposes, communicates about the administrative fine of 2,4 million euro imposed by the Finnish Data Protection Authority (SA) on Posti for violation of Article 6 (Lawfulness of processing), Article 13 (Information to be provided where personal data are collected from the data subject), Article 5 (Principles relating to processing of personal data) and Article 25 (Data protection by design and by default) of the GDPR.

The Finnish Supervisory Authority (SA) investigated the processing of personal data of Posti related to the creation of an electronic mailbox. The Finnish SA had received complaints about the forwarding of letters to Posti‘s online service without the customer’s consent. The controller had automatically created an electronic mailbox for customers without a separate request. The electronic mailbox had been linked to a wider set of services. The investigation showed that the customer could not choose whether to use it or not, as the different services were linked together in a single contract. 

Following the investigation, the Finnish SA found out that the service requested by the customer could have been provided without the automatic creation of an electronic mailbox. Also, the controller did also not inform its customers clearly about the activation of the electronic mailbox. There were also technical settings in the service that did not meet data protection requirements. These included an automatically activated selector function and a pre-ticked checkbox.

In this context, the Finnish SA imposed an administrative fine of €2,4 million on the controller for unlawful processing of personal data. At the same time, the controller was reprimanded for the shortcomings in informing the customers and was ordered to correct its unlawful practices and to take into account that electronic services must be built from the outset so that only necessary personal data is processed.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

The National Center for the Protection of Personal Data (NCPDP), for information and enforcement purposes, communicates about the administrative fines of on COSMOSPACE – 250 000 euro and on TELEMAQUE – 150 000 euro, imposed by the French Data Protection Authority (CNIL) for violation of Article 5 Principles relating to processing of personal data and Article 9 Processing of special categories of personal data of the GDPR.

COSMOSPACE and TELEMAQUE provide remote clairvoyance services, one by telephone and the other by online chat and text messages. Inspections carried out by the CNIL in 2021 revealed several breaches, including the collection of sensitive data without prior explicit consent (in particular health data and data relating to sexual orientation), the retention of data for an excessive period, the sending of commercial prospection communications to people who had not given their consent and, in the case of COSMOSPACE, systematic recording of telephone calls. 

In this context, CNIL imposed a fine of €250,000 on COSMOSPACE and a fine of €150,000 on TELEMAQUE. These fines were adopted in cooperation with about fifteen European counterparts of the CNIL in both cases. The amounts of these fines were decided on the basis of the seriousness of the breaches, the number of people concerned – the database shared by the two companies containing the data of more than 1.5 million people – and the sensitivity of the data processed. The financial situations of the companies and their structures were also taken into account, in order to set dissuasive but proportionate fines.

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

The representatives of the National Center for Personal Data Protection (NCPDP) participated in Human Rights and Equality Forum (3^rd edition), which was organized in the context of the International Human Rights Day and held on 10-11 December. The Forum created a unique platform for discussion and exchange of ideas between public institutions, civil society organizations, national and international experts in the field of fundamental human rights and freedoms.

The first day, 10 December, was dedicated to the Human Rights and Equality Forum, with debate sessions and discussions on current topics in the field, such as: digitization and its impact on people in vulnerable groups; protection and promotion the rights of children in alternative care; the situation of the rights of vulnerable persons in public custody, etc. The UN Human Rights Awards were also awarded.

The second day, December 11, was dedicated to celebrating and raising awareness of the importance of respecting human rights. The festival included interactive activities, games, workshops, movie screenings and information stands. In this context, NCPDP representatives set up a stand with educational and informative materials, as well as the promotional items. The general public was informed about the field of personal data protection. Among the topics that were of particular interest were the concept of personal data, the rights of data subjects, data security and confidentiality measures, principles of personal data protection etc. At the same time, citizens were informed about possible situations of non-compliant processing of personal data and were given practical guidance and recommendations that should be taken in such cases.

The event was organized under the initiative of the Office of the People’s Advocate and the Equality Council, with the support of development partners such as UN Agencies and the Council of Europe.

On December 3rd, the National Centre for Personal Data Protection (NCPDP) continued its information and awareness-raising campaign for the school community, organizing two training courses on “Personal Data Protection and Children’s Safety in the Online Environment” for the Public Institution “George Coșbuc” Theoretical High School and the Public Institution “Lucian Blaga” Theoretical High School in Balti. The events took place in the framework of the Personal Development class, the target audience being fourth grade students.

The aim of the information and awareness-raising campaign for the school community is to provide high visibility on personal data protection and children’s safety in the online environment at local and national level by promoting empowerment and best practices for intervention and support.

Topics covered in the training were: 

• The definition of general notions related to the field of personal data protection (what it means, how to identify it, how to operate with it); 

• Attitudes and practices when sending photos/videos online (the privacy of a social networking site, privacy settings, working with photos/videos in a chat room, attitudes and actions to take in case an image/video is taken without your consent and distributed later);

• Risks and threats in the online environment (malware, spam, online bullying, online harassment, theft of information, situations that threaten the privacy/security of the child and solutions for such situations);

• Communication on social networks, etc.

Students also played interactive games, completed a crossword puzzle based on the material presented and took part in a question-answer round, with the best students being awarded with prizes.

The events were organized at the initiative of the NCPDP, and around 210 students were trained. At the same time, the information materials, as well as the gifts offered to the students, were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on April 15, 2022, and the NCPDP aims to continue this format of training in schools in Chisinau municipality and in the districts of the Republic of Moldova.

On November 13, 2024, representatives of the National Center for Personal Data Protection organized a training course for representatives of the General Directorate for the Protection of Children’s Rights (DGPDC) of the Chisinau Municipal Council, at their request.

The purpose of the training course was to familiarize the DGPDC officials with the aspects related to personal data protection in the public service, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the normative framework.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the requirements for the protection of personal data in the exercise of the duties of the office; issues related to the appointment of the Data Protection Officer (DPO); the obligations and tasks of a DPO; issues related to the Data Protection Impact Assessment (DPIA); the stages and obligation to perform a DPIA, etc.

The training course proved to be a useful and interactive one, and the issues related to the examination of requests for the disclosure of personal data, the term of retention/storage and use of personal data at the end of processing operations, as well as the legality of installing surveillance cameras in children’s placement centers, were of great interest to the representatives attending the course.

During the event, organized in hybrid format, about 165 representatives of the General Directorate for the Protection of Children’s Rights of the Chisinau Municipal Council have been trained.

On November 12, the National Centre for Personal Data Protection (NCPDP) continued the information and awareness-raising campaign for the school community, organizing the training course “Personal Data Protection and Children’s Safety in the Online Environment ” for the public institution “Mihai Eminescu” Theoretical Lyceum in Cahul. The event took place in the framework of the Personal Development class, the target audience being the students of classes IV “A”, IV “B” and IV “C”.

The aim of the information and awareness-raising campaign for the school community is to provide high visibility on personal data protection and child safety in the online environment at local and national level by promoting empowerment and best practices for intervention and support.

Topics covered in the training:

• Overview of personal data (what it means, how to identify it, how to operate with it); 

• Attitudes and practices when sharing photos/video online (privacy of a social networking site, privacy settings, working with photos/video in a chat room, attitudes and actions to take in case an image/video is taken without your consent and distributed later);

• Risks and threats in the online environment (malware, spam, online harassment, online harassment, theft of information, situations that threaten a child’s privacy/security and solutions for such situations);

• Communication on social networks, etc.

At the same time, students played interactive games, completed a crossword puzzle based on the material presented and participated in a question-answer round, and the best were awarded with gifts.

The event was organized at the initiative of the NCPDP, and about 80 students were trained. At the same time, the information materials and the gifts given to the pupils were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on April 15, 2022, and the NCPDP aims to continue this format of training in schools in Chisinau municipality and in the districts of the Republic of Moldova.

On November 12, 2024, the National Center for Personal Data Protection (NCPDP) organized a training course for the representatives of the General Territorial Directorate “South” of the National Anticorruption Center, at their request.

The purpose of the training course, entitled “The legal regime of personal data protection”, was to increase the NAC employees’ awareness of the principles of personal data protection, in order to know and assimilate the best practices in the field, as well as to ensure the correct application of the legal provisions in the activity they perform.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; principles and legal grounds for processing personal data; the requirements for the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of personal data processed, etc.

The training course proved to be an interactive one, the participants asked multiple questions arising from their work, to which they received documented answers with practical examples from the trainers. 

At the same time, we would like to mention that this was the last training course organized for NAC representatives this year, thus, training courses will be organized for the following subdivisions:

October 17 – NAC representatives, headquarters;

October 25 – representatives of the Territorial General Directorate “North” of the NAC;

November 12 – representatives of the NAC Directorate General Territorial “South”.

In this context, about 200 representatives from NAC subdivisions were trained.

On November 11, 2024, the representatives of the National Center for Personal Data Protection (CNPDCP) organized a training course in the field of personal data protection for representatives of the State Tax Service (SFS), at their request.

The purpose of the training course was to familiarize tax officials with aspects related to the protection of personal data in the public service, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; principles and legal grounds for personal data processing; issues related to the appointment of the Data Protection Officer (DPO), as well as the obligations and tasks of a DPO; issues related to the Data Protection Impact Assessment, etc.

The training course was an interactive one. The participants asked the trainers many questions on the legal aspects related to the protection of personal data when exercising their duties. At the same time, access to information of public interest under the personal data protection legislation, the examination of requests for disclosure of personal data, as well as ensuring the security and confidentiality of personal data by FSS employees, were of particular interest to the participants.

About 120 representatives of the State Tax Service were trained during the event.