The National Center for Personal Data Protection (NCPDCP), for information and enforcement purposes, informs about the administrative fine of €950 000 imposed by the Finnish Data Protection Authority (SA) on Sambla Group for violation of Article 5 – Principles relating to processing of personal data, Article 25 – Data protection by design and by default and Article 32 – Security of processing of the GDPR.

The Finnish SA launched an investigation based on a complaint filed by a customer. A technical investigation revealed serious data security issues with the controller’s loan comparison services. When the seriousness of the data security problems became apparent in spring of 2024, the company was ordered to immediately cease processing personal data relating to loan applicants in its e-services.

Sambla Group’s loan comparison services did not impose adequate restrictions to prevent third parties from accessing loan application data, thus violating the provisions of Art. 32, Art. 25 and Art. 5(1)(f) of the GDPR. Due to poor data security measures, the content of customer’ loan applications was accessible to third parties through personal customer URLs. Anyone with access to the URL and sufficient technical knowledge to exploit the security vulnerability had direct access to the data. The technical investigation revealed that the URLs had been targeted wit phishing and personal data had been disclosed to third parties. The information available through the links included at least the loan applicant’s contact details, as well as information on their income, housing costs, marital status and possible children.

In this context, the Finnish SA has imposed an administrative fine of €950 000 on the controller, being ordered to notify its customers of the incident. The controller has announced that it has stopped using the vulnerable URLs and has improved data security measures of its services. 

The NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legal framework for the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

Recognizing the need to inform, promote and ensure the protection of the rights of individuals with regard to the processing of personal data, as well as the need for joint efforts to implement these values, on March 27th, 2025, the National Center for Personal Data Protection (NCPDP), represented by the Director Victoria MUNTEAN signed the Training Plan in the field of personal data protection with the Customs Service (CS), represented by the Director, Alexandru IACUB, for Customs Service employees.

The primary goal of the above-mentioned training plan is to raise awareness of the employees of the CS on the principles of personal data protection and to ensure the correct implementation/application of the legal provisions in the field of data protection in their daily work. The training plan has been drawn up and approved by mutual agreement and provide for offline training within Customs Service.

At the same time, we would like to point out that the strengthening of interinstitutional cooperation at the national level, in order to reinforce the actions aimed at raising society’s awareness of the importance of the personal data protection, as well as to increase the level of correct interpretation and consistent application of the legal provisions in the field of personal data protection by the actors involved in the processing of personal data, remains one of the priorities of the NCPDP, as only during the first quarter of 2025, cooperation agreements were concluded with three other state institutions, such as the General Inspectorate of Police, the General Inspectorate of Border Police and the General Inspectorate for Migration. 

On March 28th, 2025, the National Centre for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for representatives of structural and specialized subdivisions of the General Inspectorate for Migration (GIM), at their request.

The aim of the training course was to increase the GIM employees’ awareness on the principles of personal data protection, as well as to familiarize them with the personal data confidentiality and security regime in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the requirements for personal data protection in the exercise of their duties; aspects related to the appointment of the Data Protection Officer (DPO); the obligations and tasks of a DPO; ensuring the security and confidentiality of personal data processed, etc.

The training course was an interactive one, with participants asking multiple questions to the trainers about the accuracy of the examination of queries containing personal data, the proper procedure of accessing personal data through the State Information Systems and the correct auditing of these accesses, the lawfulness of installing video surveillance cameras and the processing of personal data through them.

The event was attended by around 25 representatives from the structural and specialized subdivisions of the General Inspectorate for Migration.

The training course is part of the training plan within the GIM for 2025, approved and signed by the heads of the NCPDP and the GIM on January 27th.

On 25 March 2025, the National Center for Personal Data Protection organized a training course in the field of personal data protection for representatives of the National Agency for Settlement of Claims (NASC), at their request.

The aim of the training course was to increase the NASC representatives’ awareness on the principles of personal data protection and to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the principles and legal grounds for processing personal data; issues related to the appointment of the Data Protection Officer (DPO); the obligations and tasks of a DPO; aspects related to the Data Protection Impact Assessment (DPIA); ensuring the security and confidentiality of personal data, etc.

The training course proved to be a useful and interactive, with participants asking multiple questions about the correct depersonalization of information containing personal data in the Decisions issued by NASC and published on the institution’s website, access to information of public interest from the perspective of the legislation on personal data protection, as well as the legal aspects of disclosure of personal data in their daily work.

During the event, 20 NASC representatives were trained.

On 26 March 2025, the National Centre for Personal Data Protection(NCPDP) organized a training course in the field of personal data protection for the employees of the General Inspectorate for Migration (GIM), Center Regional Department, at their request.

The aim of the training course was to increase the awareness of the employees of the GIM, Center Regional Department, on the principles of personal data protection, as well as to familiarize them with the confidentiality and security regime of personal data in accordance with the provisions of the legislation in force.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the requirements for personal data protection in the exercise of official duties; ensuring the security and confidentiality of personal data processed, etc.

The training course was interactive, and the aspects related to the examination of requests for personal data disclosure, the term of retention/storage and use of personal data at the end of processing operations, as well as the aspects related to the proper procedure for accessing personal data through the State Information Systems and proper audit of these accesses, were of great interest to the participants.

The event was attended by 15 representatives from GIM, Center Regional Department.

The training course is part of the training plan for the GIM for the year 2025, approved and signed by the heads of NCPDP and GIM on January 27.

On March 26, 2025, a study visit of a group of students from the Faculty of Law of the Moldova State University (MSU) took place at the National Center for Personal Data Protection (NCPDP).

The aim of the event focused on raising the awareness of the university community on the field of personal data protection, strengthening knowledge in the field, as well as exploring the applicable legal framework, the rights and obligations of the parties involved and the importance of compliance with various areas.

At the same time, the students were informed about the organization and functioning of the NCPDP, the duties of the NCPDP’s subdivisions, the structure, mission, role of the authority in monitoring compliance with the legislation on personal data protection, as well as with the problems, objectives and case law in the work of the NCPDP.

The study visit was organized at the request of the Faculty of Law of the MSU, and the NCPDP aims to continue to support such efforts to educate and raise awareness of young people about the importance of the field of personal data protection.

On March 26th 2025, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the representatives of the Chisinau Probation Office, at their request.

The aim of the training course was to increase the probation counselors’ awareness on the principles of personal data protection and to ensure the correct application of the legal provisions in this field in their work.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the principles and legal grounds for personal data processing; the rights of personal data subjects; the requirements for personal data protection in the exercise of the probation counselors official duties; ensuring the security and confidentiality of personal data processed; aspects related to the appointment of the Data Protection Officer (DPO), etc.

The training course proved to be interactive and useful, with participants asking many questions arising from their work, to which they received documented answers with practical examples from the trainers. At the same time, the aspects related to the access to information of public interest from the point of view of the legislation on personal data protection, the correct procedure of accessing personal data through the State Information Systems and the record of such accesses by the representatives of the Probation Office, as well as the examination of requests for personal data disclosure, were of great interest to the participants.

During the event 29 representatives of the Chisinau Probation Office were trained.

On March 27th, the National Centre for Personal Data Protection (NCPDP) continued the information and awareness-raising campaign for the school community, organizing two training courses on “Personal Data Protection and Children’s Safety in the Online Environment” for the students of Fundul Galbenei Gymnasium and ”Anton Bunduchi” Gymnasium from Hâncești. The events took place within the Personal Development class, the target audience being fourth grade students.

The aim of the information and awareness-raising campaign for the school community is to provide high visibility on personal data protection and children’s safety in the online environment at local and national level by promoting empowerment and best practices for intervention and support.

Topics covered in the training were: 

• The definition of general notions related to the field of personal data protection (what it means, how to identify it, how to operate with it);

• Attitudes and practices when sending photos/videos online (the privacy of a social networking site, privacy settings, working with photos/videos in a chat room, attitudes and actions to take in case an image/video is taken without your consent and distributed later);

• Risks and threats in the online environment (malware, spam, online bullying, online harassment, theft of information, situations that threaten the privacy/security of the child and solutions for such situations);

• Communication on social networks, etc.

Students also played interactive games, completed a crossword puzzle based on the material presented and took part in a question-answer round, with the best students being awarded with prizes.

The events were organized at the initiative of the NCPDP, and around 60 students were trained. At the same time, the information materials, as well as the gifts offered to the students, were developed with the support of the United Nations Children’s Fund (UNICEF).

It should be noted that the information and awareness-raising campaign for the school community was launched on April 15, 2022, and the NCPDP aims to continue this format of training in schools in Chisinau municipality and in the districts of the Republic of Moldova.

On March 06-07, 2025, the representatives of the National Center for Personal Data Protection (NCPDP), participated in the Forum “EaPWomeninCyber- an initiative to strengthen cyber resilience by empowering women. The event brought together industry leaders, experts, academics and professionals from Eastern Partnership countries and EU Member States.

The Forum provided a strategic platform to bridge gender gaps in the cybersecurity sector, facilitate the expansion of professional communities and encourage international cooperation. Through these efforts, the initiative contributes to the development of an inclusive and innovative ecosystem capable of responding to emerging cybersecurity challenges.

Several topics were addressed during the event, such as:

• International security, with a focus on global and regional cybersecurity challenges;

• Sharing knowledge, skills and best practices, mentoring and professional development;

• Inspirational personalities and examples of impact in the cybersecurity sector;

• Bridging the cybersecurity workforce gap through greater inclusion of women.

The Forum was organized with the support of the European Union through the Moldova Cybersecurity Rapid Assistance 2.0 project and Improving Cyber Resilience in Eastern Partnership Countries 2.0, implemented by the e-Governance Academy (eGA) in Moldova and the European Institute of Policy Studies in Moldova, which reaffirm their commitment to promoting gender equality and capacity building in the field of cybersecurity, continuing to support initiatives that contribute to Moldova’s alignment with European standards.

On March 18, 2025, the National Center for Personal Data Protection (NCPDP) organized a training course in the field of personal data protection for the employees of the National Agency for the Prevention and Combating of Violence against Women and Domestic Violence (NAPCV), at their request.

The aim of the training course was to familiarize the NAPCV representatives with the aspects related to the field of personal data protection, the regulation of processing procedures, the confidentiality and security regime of personal data in accordance with the normative framework.

During the event, important topics were discussed, such as: the definition of general notions related to the field of personal data protection; the rights of personal data subjects; the processing of special categories of personal data; the principles and legal grounds for processing personal data; the requirements for personal data protection in the exercise of the official duties; issues relating to the appointment of the Data Protection Officer (DPO); the obligations and tasks of a DPO; aspects related to the Data Protection Impact Assessment (DPIA); the stapes and obligation to perform a DPIA, etc.

The training course proved to be a useful and interactive, and the aspects related to the examination of requests for the disclosure of personal data, the term of retention/storage and use of personal data at the end of the processing operations, as well as the new legal provisions in the field of personal data protection, were of great interest to the participants.

During the event 12 representatives of the National Agency for Prevention and Combating Violence against Women and Domestic Violence were trained.