I.  Information and training activities carried out by the NCPDP

In the first quarter of 2024 (January – March), the National Centre for Personal Data Protection (NCPDP) continued to make progress in the area of information and awareness-raising activities in the field of personal data protection.

During the reporting period, the training courses for the subdivisions of the General Inspectorate of Police (GPI), initiated in 2023, has been continued to be organized, according to the training plan approved and signed by the heads of the NCPDP and GPI on 26 January 2024. 

Their purpose was to increase the perception of GPI subdivision employees on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in this field and in the activity they carry out. During the events important topics were addressed, such as: definition of general notions related to the field of personal data protection; the legal way of processing personal data in the activity carried out by the employees of the GPI’s subdivisions; the requirements of personal data protection in the exercise of their duties; the obligations of the police body as a data controller in relation to the data subject; the correct procedure of accessing personal data through the state informational systems, as well as keeping correct records of the audit of such accesses; ensuring the security and confidentiality of personal data processed etc. 

Thus, training courses were organised for the following subdivisions:

• 30 January – National Public Security Inspectorate of the GPI (Operational Coordination Directorate, Patrol Police Directorate, Public Order Directorate etc.);

• 02 February – National Public Security Inspectorate of the GPI (Special Missions Escort Section, Patrol Section “Chisinau” of the Patrol Directorate “Centre” etc.);

• 26 February – Northern Patrol Directorate of National Public Security Inspectorate;

• 26 February – Directorate of National Investigation Inspectorate „North”.

In this context, about 200 representatives from the GPI subdivisions were trained.

At the same time, the information and awareness-raising campaign for school communities continued during the reporting period with the title: “Personal data protection and children’s safety online”. The aim of the campaign was to provide the school community with high visibility on data protection and child safety online at local and national level by promoting empowerment and best practices for intervention and support. The topics covered in the training included: general notions on personal data; correct use of pictures/video online; risks and threats online; communication on social networks etc. The training course was organised on 25 January for the Public Institution „Theoretical Lyceum „Spiru Haret”, Chisinau. The event took place within the Personal Development class, the target audience being the pupils of the 5th “B”class. In this context, 36 pupils were trained.

On 21 February 2024, the training plan in the field of personal data protection for Border Police staff was approved and signed by the heads of the NCPDP and the General Inspectorate of the Border Police (GIBP) for organizing several training courses. The purpose of these was to increase the awareness of the employees of the GIBP’s subdivisions on the principles of personal data protection, as well as on ensuring the correct application of the legal provisions in the field and in the activity they carry out. Thus, training courses were organised for the following subdivisions:

• 06 March – GIBP Northern Regional Directorate (2 training courses);

• 13 March – GIBP Southern Regional Directorate (2 training courses);

• 20 March – GIBP Eastern Regional Directorate (2 training courses);

• 27 March – GIBP West Regional Directorate (2 training courses).

In this context, about 250 representatives from GIBP subdivisions were trained.

During the reporting period, the NCPDP has shown openness and a spirit of cooperation, organising multiple training courses for representatives of public institutions at their request. The training courses aimed at familiarising public officials with the aspects of personal data protection in the public service, the regulation of processing procedures, as well as the personal data confidentiality and security regime in accordance with the legislation in force. 

During the events important topics were discussed, such as: definition of general notions related to the field of personal data protection; principles and legal grounds for processing personal data; rights of personal data subjects; processing of special categories of personal data; requirements for the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of personal data processed; issues related to the appointment of the Data Protection Officer (DPO) and his/her obligations and tasks; issues related to the Data Protection Impact Assessment (DPIA) and the steps to carry out a DPIA etc. Thus, training courses were organised for the following institutions:

• 07 February – Chisinau City Hall; 

• 08 February – National Financial Market Commission;

• 23 February – Ministry of Health;

• 15 March – Râșcani District Court;

• 21 March – Chisinau Court;

• 22 March – Agency for Intervention and Payments for Agriculture;

• 26 March – Ministry of Economic Development and Digitalisation;

In this context, about 285 representatives of public institutions were trained.

II. Control activity

From January to March 2024, the NCPDP started the verification of compliance on personal data processing operations in 87 cases. During the reporting period, 96 decisions were issued, of which 34 cases were found to be in violation of the legal provisions, and 38 infringement notices were issued, which were subsequently handed over to the court for resolution.

III. Findings of the National Centre for Personal Data Protection

I. The NCPDP has examined the complaint of a data subject – the director of a technical educational institution concerning the alleged non-compliant processing of personal data of 96 employees of the institution by a former employee.

During the investigation, from the materials gathered, the NCPDP deduced that the latter, having access to the school’s archives during his period of activity, collected and disclosed information containing personal data of the institution’s employees such as: name, surname, position and salary to the Ministry of Education and Research in the form of a complaint regarding certain abuses committed by the administration of the institution during the period when he was employed, and the documents attached to the complaint served as evidentiary material to prove the allegations made by the latter.

The following is referred to the provisions of Art. 69 para. (2) of the Administrative Code, which stipulates that, in case of a petition, the public authority is obliged to initiate an administrative procedure.

  In this context, the NCPDP points out that the disclosure of information containing personal data may not contravene the principles of protection of personal data, as long as it is necessary for the fulfilment of a legitimate interest of the individual towards the competent bodies, for the purpose of proving certain facts in order to defend his rights and interests or those of society as a whole, in the case which is under examination, the processing of personal data was relevant to the purpose for which they were disclosed, in the circumstances in which the situation complained of by the controller to the Ministry of Education and Research also concerned employees whose personal data were recorded in the documents annexed to the complaint.

In the circumstances set out above, it should be noted that, in the light of Art. 5(5)(b) of the Law 133/2011, the consent of the personal data subject is not required where the processing is necessary for the purposes of complying with a legitimate interest of the controller or of the third party to whom the personal data are disclosed, provided that this interest does not adversely affect the interests or fundamental rights and freedoms of the personal data subject.

Thus, the NCPDP found that the processing of personal data of the persons reflected in the lists submitted by the former employee to the Ministry of Education and Research was not in contradiction with the principles of protection of personal data, or such processing of personal data was based on a legitimate interest, which is provided for in Art. 5 para. (5) (e) of Law 133/2011.

II.  The NCPDP received a complaint from an individual concerning the verification of the lawfulness of the processing of personal data by means of a video surveillance system that was installed in the staircase of a residential block as well as on the outside wall of the block by her neighbour.

In the case in question, the NCPDP found that the video surveillance system processes the personal data (image) of data subjects registered at the address of the apartment block and of visitors, since the angle of capture of the surveillance cameras monitors/records video of the space that is the common part of the block (the entrance to the block, the staircase of the block, the common courtyard and the public road) which is crossed daily by a large number of individuals (the tenants of other entrances), thereby infringing their fundamental rights and freedoms in excess of the declared purpose.

Thus, the NCPDP has found that if the video surveillance carried out by means of the video surveillance camera managed by the controller extends to the common space or public space and, consequently, is directed outside the private zone of the person processing personal data by these means, it cannot be considered as an activity exclusively “for personal or family needs”.

 However, even if there is the consent/agreement of the tenants at the staircase to process personal data by means of the video surveillance system, it is noted that in the case of apartment blocks, a video surveillance system could only be installed by the Condominium Owners’ Association at the entrance/exit to/from the apartment blocks, on the external perimeter of the building, as well as in the spaces adjacent to them (parking spaces, access roads etc.).

Based on the provisions of Art. 34(3)(f) of the Condominium Act and Art. 546(1) and 546(2) of the Civil Code, if video surveillance takes place on a common area of the condominium, then only the Condominium Owners’ Association would have a legal basis to process personal data for this purpose.

Furthermore, it was determined that the video surveillance camera had an audio recording function.

Thus, it has been emphasised that, before installing video surveillance cameras with audio recording, the operator must always critically examine whether this measure is, firstly, appropriate to achieve the desired objective and, secondly, proportionate and necessary for its purposes, in relation to the fundamental rights and freedoms of the data subjects. However, during data processing, not only the private conversations of family members and data subjects, but also of third persons who come within the range of the video/audio recording devices are recorded and stored, thus breaching the principle of inviolability of privacy, enshrined in Art. 28 of the Constitution of the Republic of Moldova, according to which the State respects and protects the intimacy, as well as family and private life.

Therefore, the collection/recording of the image and voice of the personal data subjects by means of the video surveillance cameras in question constitutes an excessive and disproportionate measure in relation to the stated purpose.

In this regard, it was determined that the collection of the category of personal data, such as image and voice, by means of the video surveillance system complained of, was contrary to the provisions of Article 4(4) of the Personal Data Protection Act, and the processing of personal data through the video surveillance system complained of was ordered to cease.

III. The NCPDP examined the complaint of a personal data subject concerning the alleged non-compliant personal data processing operations carried out by an educational institution, manifested by the publication of an audio recording of him and his minor child on the institution’s social network “Facebook”, invoking the right of reply, followed by a media conflict. 

In this context, the decision found that the processing of personal data concerning the data subject was carried out in breach of the provisions of Art. 4 para. (1) lit. a), b), c) and art. 5 of Law no. 133/2011 on the personal data protection, emphasizing that no legal basis was identified for the publication of personal data on the “Facebook” page, which is open to the general public, as well as the invocation of the right to reply is not relevant, however, the NCPDP did not question and did not deny the right of the controller to reply or to deny false reports, but all these actions were to be carried out in compliance with all the principles of personal data processing established by Law no. 133/2011. Moreover, given that the case involved a minor, the NCPDP held that the purpose invoked could be achieved through the use of harmless and less intrusive means in the minor’s private life.

IV. The NCPDP examined the complaint of a Public Association with a request for a verification of the lawfulness of the personal data processing by a public person, manifested by the publication of a video sequence on the channel ”Youtube”, which contains the personal data of a minor. 

During the investigation it was determined that the image of the minor was clear and led to her identification, and several personal details of the minor were communicated, such as her name and surname, address, date and year of birth, age, sex, state of health etc. 

Based on the circumstances described, the NCPDP found that the online placement of information containing the minor’s personal data was excessive and unfounded and took place contrary to the legal provisions set out in Articles 4, 5 and 29 of Law No. 133/2011 on the personal data protection. 

However, the public person, as data controller, had to ensure the personal data confidentiality, the blurring of the facial image and the non-disclosure in the public domain of information leading to the identification of the minor.

IV. Supervisory activity

In order to provide methodological and advisory support to personal data controllers and/or processors, more than 30 telephone consultations and 10 responses via e-mail were provided and recommendations were proposed to resolve discrepancies identified by the data controller.

V. International and European news

• On 26 January 2024, the NCPDP, in collaboration with TAIEX project experts, organised the national conference “Raising Awareness of Convention 108+“.

The aim of the conference is to raise awareness of both public institutions and the private sector about Convention 108 + as a viable tool to facilitate international data transfers, thus ensuring an adequate level of protection for data subjects globally.

The conference was moderated by data protection experts from Italy, Slovenia and Spain. Among the topics addressed by the experts were:

• The impact of Convention 108+ on adequacy decisions and data transfers, with a focus on compliance with the EU acquis;

• Convention 108+ as a viable tool to facilitate international data transfers while ensuring an adequate level of protection for individuals worldwide;

• Convention 108+ as a bridge between legal regimes and countries;

• The ratification process of Convention 108+

• Lessons learned and advice from ratifying countries;

• Convention 108+: Evaluation and Review Mechanism etc.

The event was attended by about 100 representatives from both public institutions and the private sector.

The event was organised and funded by the European Commission Technical Assistance and Information Exchange Instrument (TAIEX).

• On 13-14 February, the representative of the NCPDP attended the 90th plenary meeting of the European Data Protection Board (EDPB), which was organised with physical attendance. During the meeting, there were discussed, analysed and adopted some important documents for the EDPB’s activity, which will be submitted as recommendations to the Data Protection Authorities later.

One of the working aspects of the plenary focused on the adoption of the Opinion on the notion of main establishment and on the criteria for the application of the One-Stop-Shop mechanism, following an Art. 64 (2) GDPR request by the French Data Protection Authority (DPA). It was specified that the EDPB considers that the One Stop Shop mechanism can only apply if there is evidence that one of the establishments of the controller in the Union takes decisions on the purposes and means for the relevant processing operations and has the power to have these decisions implemented. Therefore, where decisions on purposes, means and the power to implement those decisions are exercised outside the Union, there should be no principal place of business under Article 4(16)(a) of the GDPR and the one-stop shop mechanism should not apply.

The plenary session made clear how the Supervisory Authorities should apply Article 4(4) (16)(a) of the GDPR in practice in order to ensure its consistent application. Especially it was reiterated that the burden of proof as to where the relevant processing decisions are taken and where the power to implement such decisions exists in the Union ultimately lies with controllers and that they have an obligation to cooperate with supervisory authorities.

The next issue discussed at the EDPB plenary session was the adoption of the Statement on the legislative developments regarding the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse. The Statement follows the EDPB-EDPS Joint Opinion on the European Commission’s Proposal for a Regulation and focuses on the latest legislative developments, in particular the position of the European Parliament of November 2023.

During the plenary, the EDPB also discussed the scope of the guidance related to the “Consent or Pay” model. In addition to the upcoming Art. 64 (2) Opinion, which will address the Consent or Pay model in the context of large online platforms, it was agreed that there is a need to consecutively develop Guidelines with a broader scope.

• On 11-13 March 2024, representatives of the NCPDP participated in the “Learning and Networking Week in Estonia on Personal Data Protection in Digital Era”, which took place in Tallinn, Estonia.

The aim of the event was to present the Estonian experience in the GDPR implementation process, providing a comprehensive and practical overview of the challenges that have arisen in the implementation process.

At the same time, given that Estonia is known as a global leader in the digitisation of public services and ranks 3^rd in the Global Cybersecurity Index as the most secure country, the information was presented on how the processing of personal data is organised in public institutions, as well as new trends in the process of ensuring cybersecurity.

During the “ Learning and Networking Week in Estonia on Personal Data Protection in Digital Era”, some important topics were addressed, such as:

• Challenges of the Estonian Data Protection Authority before and after the GDPR;

• Processing of personal data in public databases: processing practices and access to such data;

• GDPR case law: significant trends and findings from Estonian judicial and supervisory practice;

• Privacy vs. data reuse in the context of a digitally modernised society: challenges and recommendations;

• Data sharing and personal data protection;

• Cybersecurity etc.

The event was organised by the Eastern Partnership Regional Fund for Public Administration Reform (implemented by the German International Cooperation Agency (GIZ) and funded by the German Federal Ministry for Economic Cooperation and Development (BMZ) and brought together representatives of Data Protection Authorities from Moldova, Armenia, Georgia and Ukraine.

• From 11 to 13 March 2024, representatives of the NCPDP made the study visit “Processing of personal data through video surveillance systems“. The event was hosted by the Spanish Data Protection Authority (AEPD) – Agencia Española de Protección de Datos.

The purpose of the event was both to take up legal and operational best practices on the use of video surveillance means, and to provide employees of the NCPDP with the skills and resources necessary to effectively address issues related to the processing of personal data through video surveillance systems, in accordance with current legislation and in the interest of protecting the rights of data subjects.

During the study visit, moderated by experts in the field of personal data protection from the AEPD, topics of importance were analysed in depth, such as:

• The evolution of video-surveillance regulations, the latest legislative changes and regulations related to personal data processing through video-surveillance systems, with a focus on GDPR regulations;

• Data subjects’ rights and ethics in video-surveillance;

• Reception and classification of complaints;

• Inspection procedures and instructions;

• Technical and organisational measures to ensure the security of personal data;

• Promotion of technologies applied to video-surveillance etc.

The study visit was organised with the support of the EU TAIEX Project – Technical Assistance and Information Exchange Instrument, managed and funded by the Directorate-General for European Neighbourhood Policy and Enlargement Negotiations (DG NEAR) of the European Commission.

VI. Other data protection authorities

• On 22 January, the final decision of the Belgian SA of 16 January 2024 was announced, imposing a fine of €174,640 for breach by Black Tiger Belgium of the Art. 5 Principles relating to processing of personal data, Art. 6 Lawfulness of processing, Art. 12 Transparent information, communication and modalities for the exercise of the rights of the data subject, Art. 14 Information to be provided where personal data have not been obtained from the data subject, Art. 15 Right to access by the data subject, Art. 24 Responsibility of the controller, Art. 25 Data protection by design and by default and Art. 30 Records of processing activities of the GDPR.

The Belgian SA received a complaint about the processing activities carried out by BISNODE BELGIUM, which was subsequently taken over by the French BLACK TIGER GROUP and renamed BLACK TIGER BELGIUM (hereinafter “BTB”), claiming that the company had indirectly collected and unlawfully processed personal data of the plaintiffs for over 15 years, without properly informing them beforehand.

Following the investigation, the Belgian SA found that BTB could not rely on its legitimate interests, since the personal data collected indirectly could not be deemed necessary to pursue the interest of maintaining updated records of the data subjects. At the same time, Belgian SA also found that the interests of BTB were overridden by the fundamental rights of the data subjects, due to the lack of information provided proactively and individually to them, the context of the processing and the nature of the personal data, as well as the retention period of 15 years. Moreover, BTB did not properly consider all the risks derived from the processing, including the risks of invisible discrimination of the data subjects, when balancing the interests at stake.

In addition, the Belgian SA established that BTB did not adequately respond to the plaintiffs’ requests under Article 15. Lastly, the Belgian SA found the record of processing activities to be incomplete.

In this context, Belgian SA imposed three administrative fines on BTB, amounting to a total of €174.640. These fines relate to the unlawful and unfair processing of personal data without informing data subjects in a proactive, individual and transparent manner; to the failure to respond appropriately to data access requests; and lastly to various infringements relating to the record of processing activities.

Additionally, the Belgian SA imposed several corrective measures on BTB, including a temporary ban of the processing of the personal data of data subjects for whom BTB possesses contact details, until BTB has individually notified them about the processing of their data and given them an opportunity to object to the processing.

I.  Information and training activities carried out by the NCPDP

In the last quarter of 2023 (October – December), the National Centre for Personal Data Protection (NCPDP), continued to make progress in the aspect regarding information and awareness-raising activities in the field of personal data protection.

During the reporting period, the organization of training courses for the subdivisions of the General Inspectorate of Police (GPI) continued, according to the training plan approved and signed by the heads of the NCPDP and GPI on 25 January 2023.

The aim was to increase the awareness of the employees of the GPI’s subdivisions on the principles of personal data protection and on ensuring the correct application of the legal provisions in the field, in the activity they carry out. During the events important topics were addressed, such as: definition of general notions related to the field of personal data protection; the legal way of personalo data  processing in the activity carried out by the employees of the GPI’s subdivisions; the requirements of personal data protection in the exercise of their duties; the obligations of the police body as a data controller in relation to the data subject; the correct procedure of accessing personal data through the state information systems, as well as keeping correct records of the audit of such accesses; ensuring the security and confidentiality of personal data processed, etc.

Thus, training courses were organised for the following subdivisions:

• 3 October – Telenesti Police Inspectorate of the GPI;

• 10 October – Taraclia Police Inspectorate of the GPI;

• 7 November – DAI, DCPI Interpolal GPI, DPC and DPI of GPI;

• 27 November – Central Police Inspectorate of the Police Directorate;

• 5 December – Police Department of Chisinau municipality.

In this context, about 200 representatives from GPI subdivisions were trained.

At the same time, training courses for medical institutions continued. On 3 November, a training course on “Legal provisions in the field of personal data protection” was held for the representatives of the “Chiril Draganiuc” Physiopneumology Institute, with the aim of strengthening the capacities of medical staff by familiarizing, raising their awareness and informing them about personal data protection.

During the event were addressed topics such as: definition of personal health data; processing of common categories of personal data; processing of special categories of personal data; legal grounds for processing personal health data; principles of processing personal data; patients’ rights; obligation of secrecy of personal data; confidentiality and professional secrecy; disclosure of personal health data; obligation to ensure confidentiality and security of personal data; data minimization and storage limitation, etc. About 80 representatives of the IMPS of Physiopneumology “Chiril Draganiuc” were trained during the event.

During the reporting period, the information and awareness-raising campaign for school communities continued under the title: “Personal data protection and children’s safety online“. The aim of the campaign, was to provide the school community with high visibility on data protection and child safety online at local and national level by promoting empowerment and best practice intervention and support. The topics covered in the training included: general notions on personal data; correct use of pictures/video online; risks and threats online; communication on social networks, etc. The training course was organized on December 7th for the public institution Liceul Teoretic “Dante Alighieri” from Chisinau. The event took place within the Personal Development class, the target audience being the students of the 5th class “B”. In this context, 37 students were trained.

In the last quarter of 2023, as throughout the year, the NCPDP showed openness and a spirit of collaboration, organising multiple training courses for representatives of public institutions, at their request. The training courses aimed at familiarising public officials with the aspects of personal data protection in the public service, the regulation of processing procedures, as well as the personal data confidentiality and security regime in accordance with the legislation in force.

During the events important topics were discussed, such as: definition of general notions related to the field of personal data protection; principles and legal grounds for personal data processing; rights of personal data subjects; processing of special categories of personal data; requirements for the protection of personal data in the exercise of official duties; ensuring the security and confidentiality of personal data processed; issues related to the appointment of the Data Protection Officer (DPO) and his/her obligations and tasks; issues related to the Data Protection Impact Assessment (DPIA) and the steps to be carried out  by a DPIA, etc. Thus, training courses were organised for the following institutions:

• 02 October –  General Inspectorate of Carabineers;

• 06 October – General Inspectorate Training Centre of Carabineers;

• 11 October – Regional Directorate “Centre” of the General Inspectorate of Carabineers;

• 12 October – Agency for Court Administration, Northern Region;

• 13 October – Agency for Court Administration, Centre Region;

• 18 October – Regional Directorate “Centru” of the General Inspectorate of Carabinieers;

• 20 October – Regional Directorate “SUD” of the General Inspectorate of Carabineers;

• 25 October – Regional Directorate “NORTH” of the  General Inspectorate of Carabineers;

• 31 October – Ministry of Energy;

• 1 November – General Directorate for Education, Youth and Sport of the Chisinau Municipal Council;

• 9 November – National Integrity Authority;

• 16 November – State Chancellery;

• 17 November – Directors of early education institutions in Chisinau municipality;

• 22 November – Directors of educational institutions from Chisinau municipality;

• 23 November – Ministry of Infrastructure and Regional Development;

• 28 November – Ministry of Labour and Social Protection;

• 29 November – Republican Centre for Psycho-pedagogical Assistance;

• 6 December – State Protection and Guard Service;

• 08 December – Ministry of Agriculture and Food Industry;

• 18 December – National Agency for Food Safety.

In this context, about 1200 representatives of public institutions were trained.

II. Control activity

From October to December 2023, the NCPDP started the verification of compliance of personal data processing operations in 85 cases. During the reporting period, 89 decisions were issued, of which 43 cases were found to be in violation of the legal provisions, and 42 infringement notices were issued, which were subsequently handed over to the court for resolution.

III. Findings of the National Centre for Personal Data Protection

The NCPDP has examined the complaint of a data subject concerning the alleged non-compliant processing of personal data, materialized by the fraudulent storage and use of personal data belonging to him (name, surname, date/month/year of birth, IDNP). In the course of the investigation, the NCPDP found that personal data concerning the data subject had previously been transmitted by the complainant to the owner of a shop in order to support the payment of a fine via the RunPay terminal at the premises where he was working.

Subsequently, the data subject’s personal data were also used to apply for a loan by entering the IDNP and date/month/year of birth into the terminal. Although, the shop owner claimed that he had mistakenly entered the IDNP of the complainant, (believing that he had entered the personal data of the latter’s daughter), the NCPDP did not determine that there was any justification for entering the date/month/year of birth in the credit application, yet every parent knows the date of birth of their child.

It is imperative to point out that according to Article 11 of the Personal Data Protection Law the conditions and time limits for storing personal data are provided for by law, taking into account the provisions of Article 4 para. (1) letter e). At the end of personal data processing operations, if the subject of these data has not given his consent for another purpose or for further processing, they will be destroyed.

As the data subject did not consent to further processing of the personal data, the data subject’s identification data was to be destroyed immediately after the fine was paid via the terminal.

Thus, the NCPDP, verifying the fulfilment of the mandatory elements implying the conformity and legality of the personal data processing operations, established that there was no purpose and legal basis justifying the actions of the shop owner to store and further use the personal data of the data subject, manifested by their transmission to a credit company, actions contrary to the provisions of Article 4 para. (1) (a) and (e), Art. 5 para. (1) and Art. 11 of the Personal Data Protection Law.

II. The NCPDP has examined the complaint of a Public Authority submitted under its competence, requesting verification of the lawfulness of the processing of personal data of a data subject and his/her child, manifested by accessing/consulting/extracting personal information stored in a state information resource.

The investigation determined that from a user account that was assigned to a former employee of the authority, who resigned in 2019, using the work computer of a current employee, the data subject’s state border crossing information was searched, the information was saved in PDF format, then printed and transmitted to third parties.

Thus, it was established that the user account of the former employee was active even 3 years after the resignation of the employee, being disconnected only two months after the access referred to in the complaint.

Subsequently, it was determined that the work computer that was used for the processing of the data subject’s personal data was located in the common office of several employees and that the employee who was in charge of the computer was not at work at the time of the access. At the same time, it was established that other computers were connected under the IP-device (remote VPN user), and the service office where the  computer is located serves as a common office for all employees of the section, with unrestricted physical access to the computer.

In these circumstances, it was not possible to identify with certainty the person/controller who processed the personal data of the data subjects, in which order the NCPDP found in rem that the processing of personal data of the data subjects concerned was carried out contrary to the provisions of Article 4 para. (1) (a), (b), (c) and Art. 5 para. (1) and para. (3) of the Personal Data Protection Law, in the absence of a legal basis and without the consent of the data subject, since the security incident was generated due to improper management and organization of the tasks set for the staff within the institution, which through malicious actions or even errors or negligence in the use of information resources generated the given incident, or the controller was obliged to review the access rights of users at regular intervals, as well: – review of access rights of the SIIV user – once in 6 months and after each change that occurred in the user’s activity, and review of granting access rights of privileged roles – once in 3 months.

At the same time, the Centre determined that the entity is liable for violation of Article 30 para. (1) of the Personal Data Protection Act, as it failed to ensure the necessary organisational and technical measures for the protection of the personal data made available to it, which consequently led to the unlawful processing of the personal data of the data subjects.

III.  The NCPDP received, in accordance with its competence, a request from the police, which concerned the request of an individual to verify the lawfulness of the processing of personal data.

In fact, the data subject reported that he had received numerous phone calls from various lending companies in the Republic of Moldova informing him about the examination of applications for credit based on his personal data submitted through the online applications applied for.

Following the actions carried out during the control, in the light of Law no. 133/2011 on the personal data protection, the NCPDP identified the person who processed the personal data, thus falling under the notion of data controller and being responsible for the personal data processing operations, as well as for ensuring the confidentiality and security of personal data.

In this context, the Personal Data Protection Authority found that the processing of the data subject’s personal data, carried out by the data controller, by disclosing the name, surname, state identification number (IDNP) and contact details of the complainant to the credit companies, took place contrary to the legal provisions laid down in Article 4 para. (1) letters a), b), c), Art. 5 para. (1), Art. 9 and Art. 29 para. (1) of Law No. 133/2011 on personal data protection.

IV. The NCPDP was referred to by an initiative group, which alleged that Law No 356/2022 on the amendment of some normative acts introduced amendments to Law No 93/1998 on the entrepreneur’s patent, which would have created conditions for the violation of legal provisions on the protection of personal data of holders of entrepreneur’s patents.

Thus, entrepreneurs operating in the markets, who have complied with the new tax regime, have found that the tax receipts issued to buyers contain personal data, in particular, the state identification number, indicated in the tax code field – C. F.

From the stipulated provisions, it was determined that the tax legislation regulates the record of tax liabilities of individuals on the basis of tax codes assigned in the prescribed order, resulting from the exercise of independent economic activity.

Examining the existing legal bases in force, in particular – Art. 5(28), Art. 162 para. (1) letter b), art. 163 of the Tax Code, point 10 letter i) of the Instruction on Taxpayer Records, point 24 of the Regulation on the Single Register of Cash Register and Control Equipment, which frames the fact of processing the IDNP of individuals, in the context of self-employed activity, subject from 1 July 2023 to the documentation of the sale of goods and the use only of cash register and control equipment connected to the Automated Information System “Electronic Monitoring of Sales”, in conjunction with the provisions of Art. 5 para. (5) b), art. 9 b) of Law no. 133/2011, the personal data processing operations in the case in question are carried out for the fulfilment of an obligation incumbent on the controller under the law.

At the same time, it has been identified as vulnerable the fact that any self-employed natural person is required by the existing legal framework, in particular the one concerning the algorithm of operation of cash register and control equipment, to make public/known his IDNP in the tax receipts issued daily.

However, similar regulations have been subject to constitutional review by the Constitutional Court, which has assessed the positive obligation of the competent authorities to ensure, also in the case under examination by the NCPDP, the protection of the IDNP of data subjects who practice independent activity in an efficient and similar way.

As a result, the NCPDP has attested to the existence of a defective legal framework governing the legal regime of the tax records of self-employed individuals, namely, the fact of recording the IDNP in the tax receipt issued by the licence holder to each client, interferes with the privacy of the person, being a disproportionate measure in relation to the intended purpose.

Subsidiarily, it was recommended to the Ministry of Finance/State Tax Service to establish technical and organizational measures to ensure the protection of personal data of self-employed persons, by identifying and implementing appropriate and efficient mechanisms for keeping tax records, without prejudice to the right to protection of personal data, for example: by depersonalizing the IDNP of the self-employed individual recorded in the tax voucher or by assigning a new tax code separate from the IDNP, in the context of the circumstances highlighted in para. II of the finding part of this Decision, informing the NCPDP of the action taken in this respect.

IV. Surveillance activity

During the reporting period, the NCPDP continued to organise training courses for persons designated by the controller or the processor as Data Protection Officer. This obligation is stipulated by the provisions of Law no. 133/2011 on the protection of personal data, which establishes the duty of the controller and the processor to designate a Personal Data Protection Officer in the cases provided for in Article 25 of the aforementioned law.

The aim of the training course, which took place on 21 December, was to develop theoretical knowledge in the field of personal data protection and practical skills on the application of regulations and legislative requirements in the field. During the event, important topics were discussed, such as: definition of general notions related to the field of personal data protection; rights of personal data subjects; processing of special categories of personal data; principles and legal grounds for processing personal data; ensuring security and confidentiality of personal data processed; issues related to the Data Protection Officer (DPO); issues related to Data Protection Impact Assessment, etc. About 10 DPOs from both the public and private sectors were trained during the event.

At the same time, in order to provide methodological and advisory support to personal data controllers and/or processors, more than 50 telephone consultations and 15 responses via e-mail were provided, with recommendations being proposed to remove discrepancies identified by personal data controllers.

V. International and European news 

On 17 October 2023, NCPDP’s representatives participated in the “GDPR4BUSINESS” Conference, organized by the National Association of ICT Companies within the ABA Rule of Law Initiative Project “Personal Data Protection – Rights and Obligations in the Republic of Moldova” in partnership with the European Business Association (EBA Moldova). The NCPDP’s expert addressed the topic “Data Protection Officer” (DPO), highlighting the most new and important issues required by the provisions of Law 133/2011 on the protection of personal data: appointment of DPO; DPO function; DPO tasks.

At the same time, the conference presented practices with applicable content for business and representatives of public authorities, such as:

– Key aspects of the draft law on Personal Data Protection;

– international and regional experience in applying the GDPR;

– solutions and responses to situations, cases and challenges faced by business and public authorities in implementing the harmonised legal framework.

The event was attended by state officials, national and international experts as speakers.

On 18-19 October 2023, representatives of the NCPDP carried out a study visit “Reconciling the right of access to information and personal data protection“. The event was hosted by the French National Commission for Information Technology and Liberties (CNIL) (Commission Nationale de l’Informatique et des Libertés).

The aim of the event was to take stock of the best legal and operational practices of the CNIL on mechanisms for reconciling the right of access to information and the protection of personal data.

During the study visit, moderated by experts in the field of personal data protection from the CNIL and CADA – Commission for Access to Administrative Documents, topics of importance such as: protection of personal data in the exercise of the right of access to information; reconciling the right of access to information and the right to protection of personal data; request for access to administrative documents or exercise of the right of access by the data subject, how to distinguish them and what is the impact; publication and re-use of data of public interest; re-use of data of public interest for scientific research purposes, etc.

The study visit was organised with the support of the EU TAIEX project – Technical Assistance and Information Exchange Instrument, managed and funded by the Directorate-General for European Neighbourhood Policy and Enlargement Negotiations (DG NEAR) of the European Commission.

From 1 to 3 November 2023, the NCPDP’s representative participated in the Internet Freedom Summit 2023, which took place in Ohrid, North Macedonia.

The event included interactive sessions, workshops, roundtables and training sessions, focusing on topical issues in the field of personal data protection and privacy, such as:

– Privacy in a connected world: Navigating and Challenges of Data Protection in the Digital Age;

– International data protection standards and the importance of harmonisation for efficient cross-border data transfers;

– Balancing privacy and technological innovation;

– The role of regulators in promoting a privacy-sensitive innovation culture;

– Strategies for monitoring and enforcing data protection regulations on online platforms;

– The role of data protection authorities in ensuring compliance and addressing detected breaches;

– The future of privacy: emerging technologies and trends, etc.

At the event, the NCPDP’s representative addressed the topic – “Balancing privacy and data protection from a South-East European perspective“. Participants also shared their views on strategies for monitoring and enforcing data protection regulations on online platforms, in particular, on the future of privacy in an era of artificial intelligence, blockchain and other new technologies impacting privacy.

The event, organised by ABA ROLI, brought together civil society representatives, academics, lawyers, journalists from North Macedonia, Romania, Moldova and Serbia.

From 8 to 9 November, the NCPDP’s representatives  participated in the European Case Management Workshop 2023, held in Bern, Switzerland, an annual event that provides a forum for participatory dialogue between Data Protection Authorities on the challenges they face and the solutions they apply in their daily practice.

The aim of the event was to focus on topical issues in the field of personal data protection and privacy, in particular such as:

– Handling unfounded or excessive requests in an overt manner – as per Article 57 (4) of the GDPR;

– Essential personal data protection safeguards for law enforcement cooperation between data protection authorities in the EEA;

– GPS tracking in employment relationships;

– Facial recognition and detection through the lens of personal data protection;

– The concept of harm related to the protection of personal data of data subjects, etc.

The European Case Management Workshop 2023 was attended by 82 representatives from 29 countries and 37 Data Protection Authorities.

On 15-17 November, representatives of the NCPDP attended the 45th plenary meeting of the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) in Strasbourg, France.

The meeting discussed important topics including:

– Convention 108+, ratifications and current accessions;

– Contractual clauses in the context of cross-border data flows;

– Interpretation of Article 11 of the modernised Convention 108;

– Protection of personal data in the electoral process;

– Cooperation with other Council of Europe bodies and entities;

– Major developments and activities in the field of data protection, etc.

The CNPDCP delegation reported on the status of ratification of the Protocol amending ETS 223 to Convention 108, indicating that the draft law on the ratification of the Protocol amending Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and related documents have been submitted to the Ministry of Justice for the necessary procedures to ensure its submission to the Government of the Republic of Moldova for approval, after which it will be submitted to Parliament for ratification. Regarding the legislative review in the field of personal data protection, at the moment, the Republic of Moldova is in the process of ensuring the transposition of Regulation (EU) 2016/679 and Directive (EU) 2016/680 into national legislation.

The delegation of the NCPDP reported on the status of ratification of the Protocol amending CETS 223 to Convention 108, indicating that the draft law on the ratification of the Protocol amending Convention No. 108.  

At the same time, the Moldovan delegation also mentioned developments and activities in the field of data protection at national level.

VI. Other data protection authorities

 On 05 October, the Croatian Data Protection Authority decision was issued on the imposition of an administrative fine in the amount of €5,470,000 on the debt collection agency EOS Matrix for violation of Articles 5, 6, 9, 12, 13 and 32 of the GDPR.

The investigation was initiated following an anonymous petition alleging that there was unauthorised processing of a large amount of personal data of individuals (debtors) by EOS Matrix (data controller). The petition was accompanied by a USB stick containing 181641 personal data of individuals such as: name, surname, date of birth and personal identification number who had outstanding debts to credit institutions. In addition, the petition mentioned that 294 individuals included in the database were minors at the time of its compilation.

The investigation found that:

EOS Matrix Debt Collection Agency has not implemented sufficient technical measures in the processing system – the main database where personal data of approximately 370,000 data subjects are processed, contrary to the provisions stipulated in Article 32 of the GDPR.

The data controller also processed personal data of natural persons who are neither debtors nor legal representatives of heirs in debtor-creditor relationships, contrary to the provisions of Article 6(1) of the GDPR.

With regard to the processing of health data, it was established that the data controller actively recorded comments related to the debtor’s state of health contrary to the provisions stipulated in Article 9(2) of the GDPR. Examining the first three privacy policies (which were in force between May 2018 and October 2020), it was established that the data controller specified that it does not and will not process health data. Therefore, the processing of personal data was non-transparent, which is not in line with Articles 12(1) and 13(1) and (2) of the GDPR.

In addition, between May 2018 and January 2019, the data controller processed data relating to 49 850 data subjects by recording telephone conversations without having established the legal basis referred to in Article 6(1) of the GDPR, which also led to a breach of Article 5(2) of the GDPR.

On 12 October, the French Data Protection Authority (CNIL) issued a decision imposing an administrative fine of €600,000 on the controller GROUPE CANAL+ for violating the legal provisions stipulated in the GDPR.

The CNIL has received numerous complaints about difficulties encountered by individuals in having their rights taken into account by GROUPE CANAL+, which produces media channels and distributes pay-TV offers.

Based on the findings of the investigation, the CNIL considered that the controller did not comply with several obligations under the GDPR and the French Post and Electronic Communications Code (CPCE), such as:

• Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Articles L. 34-5 of the CPCE and 7 of the GDPR);

•  Failure to comply with the obligation to provide information (Articles 13 and 14 GDPR) and failure to exercise the rights of data subjects (Articles 12 and 15 GDPR);

•  Failure to provide a contractual framework for processing operations carried out by a processor (Article 28.3 GDPR);

•  Failure to comply with the obligation to ensure the security of personal data (Article 32 GDPR);

•  Failure to comply with the obligation to notify the CNIL of a data breach (Article 33 of the GDPR).

• The amount of this fine was decided on the basis of the breaches identified, as well as taking into account the cooperation of the data controller and all the measures the data controller has taken to comply with the legal provisions.

On 11 December, the final decision of the Norwegian Supervisory Authority (Datatilsynet) of 6 February 2023 was announced regarding the imposition of an administrative fine of NOK 10 million (approximately 850 thousand euros) on SATS for violation of Art. 5 Principles relating to the processing of personal data, Art. 6 Lawfulness of processing, Art. 12 Transparency of information, communications and the means of exercising the data subject’s rights, Art. 13 Information to be provided where personal data are collected from the data subject, Art. 15 Right of access of the data subject, Art. 17 Right to erasure of data (“right to be forgotten”) of the GDPR.

Datatilsynet has received several complaints regarding the company SATS during the period 2018-2021. These related to alleged breaches of complainants’ rights under the General Data Protection Regulation as customers of the Fitness Network, as well as the company’s failure to comply with access and deletion requests.

SATS is the largest fitness chain in the Scandinavian countries, with gyms in Norway, Sweden, Denmark and Finland. The company is headquartered in Norway and therefore Datatilsynet handled the case in cooperation with several supervisory authorities using the One Stop Shop mechanism. As the lead supervisory authority, Datatilsynet was primarily responsible for investigating, analysing and taking a decision in this case, being the lead supervisory authority.

1. Information and training activities carried out by the NCPDP

During the first semester of 2023, the National Centre for Personal Data Protection (NCPDP) has achieved major progress in information and awareness activities for the general public in the field of personal data protection.

On 25 January 2023, the executives of the NCPDP and the General Police Inspectorate (GPI) approved and signed the training plan for the GPI subdivisions, therefore, several training courses were organised. The purpose of these courses was to increase the awareness of GPI subdivision employees about the principles of personal data protection and to ensure the accurate application of the relevant legal provisions in their work.

The important topics were discussed during the training courses, such as:

–   general notions of the personal data protection field;

–   the legal way of processing personal data in the activity carried out by the employees of the GPI subdivisions;

–   the requirements of personal data protection used during the execution of their duties;

–   the obligations of the police as a data controller in regard to the data subject;

–   the correct procedure of accessing the personal data through the state information systems, as well as keeping accurate audit records of such kind of accesses,

–    ensuring the security and confidentiality of processed personal data etc.

Thus, training courses were organised for the following subdivisions:

–    On 1st February – Anenii Noi Police Inspectorate of the GPI;

–    On 6th March – National Inspectorate of Investigation (NII) of the GPI;

–    On 24th March – National Centre for Combating Trafficking in Human Beings of the NII;

–   On 7th April – National Public Security Inspectorate, Regional Directorate “Centre” of the GPI;

–    On 25th April – Buiucani Police Inspectorate of the Chișinău Police Department;

–    On 5th May – Ciocana Police Inspectorate of the Chișinău Police Department;

–    On 22nd May – Râșcani Police Inspectorate of the Chișinău Police Department;

–    On 5th June – General Directorate for Criminal Prosecution of the GPI;

–    On 23rd June – Police Department of ATU Gagauzia.

Also, the training courses were organized for a number of medical institutions on topic “Legal provisions in the field of personal data protection”. The aim of the training courses was the strengthening the capacities of medical staff through familiarising, raising awareness and informing them about personal data protection. The courses included topics such as: definition of personal data concerning health; processing of common categories of personal data; processing of special categories of personal data; legal grounds for processing personal data concerning health; principles of processing personal data; patients’ rights; obligation of personal data privacy; confidentiality and professional privacy; disclosure of personal data concerning health; obligation to ensure confidentiality and protection of personal data; minimization of data and limitation of storage, etc. Thus, the trainings took place:

–    On 9th June at Public Health Institution ”Family Medics’ Centre”, Bălți municipality

–   On 21st June at Public Health Institution ”Territorial Medical Association” district Centre

–    On 28th June at University Primary Health Care Clinic public health institution of Nicolae Testemițanu SUMPh

During the reporting period, the information and awareness campaign for school communities, titled as “Personal data protection and children’s safety in the online environment” was continued. The campaign aimed to inform and raise awareness of the school community with the field of personal data protection and children’s safety in the online environment at local and national level by promoting empowerment and best practices for intervention and support.

The topics covered in the trainings included: general concepts on personal data; adequate use of pictures/videos online; online risks and threats; communication on social networks etc. Three training sessions were organised within the school community:

–    On 27th January – Public Institution “Gheorghe Asachi Theoretical Lyceum”;

–    On 17th May – Public Institution “Mircea Eliade Theoretical Lyceum”;

–   On 18th May – Public Institution “Ion Creangă Theoretical Lyceum”.

Simultaneously, NCPDP organized training courses for specific categories, at their request:

–    representatives of libraries in the Chișinau municipality and other districts of the Republic;

–    representatives of the National Health Insurance Company;

–    representatives of the Cahul General Directorate of Education;

–    representatives of the State Tax Service;

–   representatives of the Ministry of Internal Affairs and

–    representatives of the National Agency of Road Transport.

In this context, in the first semester of the current year, the trainers of the NCPDP provided trainings for about 650 representatives of the GPI subdivisions, almost 210 representatives of medical institutions, around 120 pupils from educational institutions and approximately 575 representatives of other institutions.

During the same reference period, i.e., on 29th-30th March 2023, the NCPDP in collaboration with TAIEX project experts organized the TAIEX Expert Mission “Personal data processing for statistical purposes” in online format. The objective of the Expert Mission was to present the best European legal and operational practices on the mechanisms of processing and storage of personal data for statistical purposes by the National Bureau of Statistics (NBS), data exchange between the institutions and the NBS, as well as the regulations related to the security of these data. The event was attended by 24 representatives of public sector.

2. Control Activity

In the period of January – June 2023, the NCPDP initiated compliance checks on the processing of personal data in 180 cases. In the reference period, 141 decisions were issued of which 73 cases were found to be in breach of the law, being concluded 34 minutes of infringement proceedings, which were subsequently submitted to the court for resolution.

3.      Findings of the National Centre for Personal Data Protection

I. The NCPDP has examined the complaint of a personal data subject concerning the alleged non-compliant processing of personal data stored in the Real Estate Register (RER) and carried out by a Local Public Authority (LPA) and a Central Public Authority (CPA).

In this context, the decision found that the operations of accessing personal data relating to the data subject’s real estate were carried out by the CPA and LPA in breach of Article 4 para. (1) letters a), b) and art. 5 of Law no. 133 of 08.07.2011 on personal data protection, or these operations took place without a determined, explicit and legitimate purpose.

Thus, the main aspect that led to the finding of violation of the legal provisions by the LPA was the data access for personal purposes (for the research meant for master’s thesis) and the lack of record of personal data access in the automated systems by authorized users within the LPA.

Regarding the reason for the finding of violation of Law No. 133/2011 by the CPA, we note that the CPA did not ensure the information update on authorised users with the access to the state automated information system. Additionally, the CPA did not notify the competent authorities about changes in employment relationships (resignation of a former employee), which resulted in personal data access in the RER even after the resignation.

II. The NCPDP carried out an investigation on the basis of a complaint from a data subject, in which he pointed to alleged unlawful personal data processing operations concerning him, stored in the RER and carried out by a LPA, as well as the non-realization of the right of access to his personal data.

Following the examination of the case, by decision, the NCPDP found that the LPA failed to deny the presumption of illegality of the processing of personal data of the data subject, which led to the violation of Law No. 133/2011, as it was found that all authorized users within the LPA who had access to the central data bank of the RER used the same access account, which was assigned to a former employee of the LPA. This fact made it impossible for the controller to keep strict records of accesses. Regarding to the contribution of the right of access to the data subject’s personal data, it was established that there was no breach of this aspect, as it was established that the LPA had examined the request and had sent a reply to the data subject.

III. The NCPDP has examined the complaint of a personal data subject concerning the alleged unlawful personal data processing operations stored in the RER, which was carried out by the controller without data subject’s consent.

Following the examination, it was carried out that the operations of accessing the real estate data, which belong solely to the data subject by law, were made to create and register a co-owners’ association.

Also, during the examination of this case, the controller, in order to justify his actions of access/consulting the personal data through the RER, which belong solely to the data subject, made the reference to the contract for the provision of consulting services and collaboration, as well as to the provisions of the art. 5 of Law No. 133/2011 on personal data protection.

In this case, NCPDP has stated that the allegations invoked by the controller does not justify and does not demonstrate the necessity of processing the subject’s personal data, which was manifested through accessing the central data bank of RER, as well as processing of personal data is to be carried out with the conditions based on the provisions of the art. 5 of Law No. 133/2011 on personal data protection.

In this context, the decision found that the operations of accessing personal data regarding the immovable property of the data subject was carried out in violation of Article 4 para. (1) letters a), b) and art. 5 of Law no. 133 of 08.07.2011 by the data controller – legal person, in the absence of a specific, explicit and legitimate purpose.

IV. The NCPDP has examined the complaint of a personal data subject concerning allegedly inappropriate processing of personal data stored in the State Register of Population (SRP) by a public authority employee.

During the investigation, although a request was indicated as the cause for the processing operation of personal data, it was established that the request was made in the name of another person.

In this regard, the NCPDP has not identified any purpose and legal basis that would have allowed the authorised user within the public authority to process (by data retrieval) the personal data of the data subject without his/her consent and without having a file/request taken into consideration.

In this context, by decision it was found that, the personal data processing operation concerning the data subject, was carried out by the authorized user in violation of the provisions of Article 4 para. (1) letters a), b) and art. 5 of Law No. 133/2011 on personal data protection, in the absence of a specific, explicit and legitimate purpose and without the consent of the data subject.

V. The NCPDP examined the request received from the State Tax Service (STS) informing that, as a result of the exercise of tax administration duties, an economic agent was found to be collecting and using personal data contrary to the provision of Article 5 para. (1) of the Law no. 133/2011 on personal data protection, which served as a reason for initiating the confirmation/investigation the compliance of personal data processing operations.

In fact, according to the materials attached to the STS request, it was found that the economic agent processed the personal data of 35 natural persons without their personal consent or the successors of deceased persons, as well as in the absence of any other legal basis provided by Article 5 para. (5) of the Law no. 133/2011 on personal data protection.

Following the investigations carried out by the NCPDP, in accordance with the provisions of Article 27 of Law no. 133/2011 on personal data protection, the NCPDP decision confirms the violation of the provisions of Article 4 para. (1) letter a), art. 5 para. (1), (4) and art. 12 of Law no. 133/2011 on personal data protection by the economic agent in the matter of the processing of personal data of the data subjects mentioned in the STS request.

At the same time, the NCPDP also ordered to stop of the processing operations of personal data of the data subjects concerned in the SFS and the destruction of the copies of the identity cards unlawfully used/obtained by the economic agent.

Consequently, in accordance with the provisions of Article 20 para. (1) letter m) of Law No. 133/2011  on personal data protection, the NCPDP has stated an order to the criminal prosecution body of the STS concerning the existence of reasonable indications of falsification of documents for the goods purchase, an act in accordance with the provisions of Article 3351 of the Criminal Code.

Moreover, following the finding of the violations mentioned above, the NCPDP interfered in the order of the contravention against the economic agent by initiating the minute on the contravention in accordance with the provisions of Article 741 para. (1) and (3) of the Contravention Code.

VI. The NCPDP was notified of the lawfulness of the activity of the website www.numar.md, where certain personal data of several natural persons were published by a representative of mass-media.

Following the analysis of the website www.numar.md, it was found that, any person could leave a comment, which is visible to everyone, about the owner of any mobile phone number in the Republic of Moldova. The comments on the web page contained various types of biographical information such as: name, surname, education, workplace, age, locality, home address, type of activity etc., as well as defamatory and insulting information. Disclosure of such information online for unrestricted viewing could seriously harm the constitutional rights and freedoms of citizens.

As a result of the control, the NCPDP has determined that the means provided for processing personal data are inappropriate by publishing on the website www.numar.md information containing personal data, such as: name, surname, education, workplace, age, locality, home address, type of activity etc., as it was not established the existence of a specific, explicit and legitimate purpose, nor the existence of a legal basis for processing personal data concerning the holders of mobile phone numbers in the Republic of Moldova. These actions are committed in conflict to the provisions of Article 4 para. (1) (a), (b), (c) and Art. 5 (1) (a), (b), (c) and Art. 5 (1) (b). (1) of Law no. 133/2011 on personal data protection.

In this context, taking into account the provisions of Art. 27 para. (3) and par. (5) of Law no. 133/2011  on personal data protection, the NCPDP issued a decision which states that the finding of violation of the provisions of Law no. 133/2011  on personal data protection in rem through the website www.numar.md, the outcome of unavailability on the Internet of the page www.numar.md, as well as the referral to the Public Institution “Information Technology Service and Cyber Security” in order to examine the possibility of intervening in the light of the competences set out in para. 33 p. 7) of the Regulation on Management of Top-Level Domain .md, approved by ANRCETI Decision no. 42/2020.

Finally, it is noted that the purpose of the Supervisory Authority’s self-reporting, manifested by the desire to counteract the non-compliant of personal data processing, was achieved with the unavailability/becoming inactive of the website www.numar.md, which was a source of abusive disclosure of personal information of a large number of data subjects.

4. Supervisory activity

On 10 January 2022, in accordance with the provisions of the Law no.175/2021 on the amendment of some normative acts, the obligation of the controller and the processor to designate a data protection officer was established, in the cases provided by of Art. 25 para. (6) of the Law no. 133/2011 on personal data protection.

In this regard, the NCPDP has launched a cycle of training courses for data protection officers. The main purpose of the trainings is to develop theoretical knowledge’s in the field of personal data protection and practical skills on the application of normative acts and legal requirements in this field. Thus, during the reference period, 28 persons were trained.

In accordance with the provisions of Art. 25 para. (6) of the Law no. 133/2011  on personal data protection, the controller or processor is obliged to publish the contact details of the data protection officer and communicate them to the NCPDP. Thus, during the reference period, the NCPDP received 21 letters, through which it was informed about the fact of the designation of the data protection officer from the respective entities, mainly from private entities.

At the same time, the following guidelines were developed and published on the official website of the NCPDP under the section “Data controller/NCPDP recommendations”: “Guidelines on personal data protection impact assessment (DPIA)” and “Guidelines on the processing of personal data through video devices”, in accordance with the provisions of the Law no. 187 of 14th July 2022 on the condominium.

In order to provide methodological and advisory support to personal data controllers and/or processors, more than 220 telephone consultations and 15 responses via e-mail were provided and recommendations were proposed to resolve discrepancies identified by the data controller.

5. International and European news

–     As part of the collaboration between SIGMA and the GiZ Regional Fund for the Eastern Partnership, the first Academy, known as “Service design and delivery in a digital age”, was held in Paris on 6th-10th February 2023. The aim of the Academy was to create the opportunity for intensive networking and exchange on public service redesign:

a) at national level – between the key public institutions, such as public service development agencies and personal data protection institutions;

b) at regional level – between countries of Eastern Partnership; and

c) at international level – between Eastern Partnership countries and EU Member States.

Thus, in order to achieve the best practices within the Academy, a study visit to the French Ministry of Transformation and Public Service was also carried out, and the NCPDP representative was introduced to the current situation of public service transformation in France, as well as the public services improvement (human-centred digital public services), monitoring and transparency of the implementation of government reforms etc.

–      In the first semester of 2023, the representatives of the NCPDP attended 3 plenary sessions of the European Data Protection Board (EDPB) and 3 online meetings. Several documents were discussed and adopted in their final version during these plenary meetings, including:

–    Guidelines 05/2021 on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR;

–      Guidelines 07/2022 on certification as a tool for transfers;

–     Procedure for the adoption of EDPB Opinions on national criteria for certification and European Data Protection Seals;

–      Guidelines 01/2022 on data subject rights – Right of access;

–      Guidelines 04/2022 on the calculation of administrative fines under the GDPR;

–     Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement.

On 25th May, The EDPB has elected Anu Talus (FI DPA) as the new Chair of the European Data Protection Board (EDPB) and Irene Loizidou Nikolaidou (CY DPA) as new Deputy Chair. The European Data Protection Board (EDPB) is an independent European body, which contributes to the consistent application of data protection rules throughout the European Union, and promotes cooperation between the EU’s data protection authorities.

–      On 10th-12th May 2023, the representatives of NCPDP participated in the 31st Spring Conference of the European Data Protection Authorities (EDPA) in Budapest, Hungary. This year the event was hosted by the Hungarian Data Protection Authority.

During the working sessions, topical data protection issues were presented, such as:

–          New technologies – assessing the social impact of the use of new technologies in different areas;

–          Interaction between data protection and competition law;

–          Court decisions: resolutions and amendments to the Rules of Procedure;

–          Best practices/case studies in enforcement cooperation between EEA and non-EEA countries.

For the first time at a Spring Conference of the EDPA, an Open Day was organised. This practice gave the opportunity to several institutions, NGOs or other organisations that expressed interest in the topics covered during the event to participate online.

The event was attended by the representatives of Central and Eastern European Data Protection Authorities, the Council of Europe, the European Data Protection Board, the European Data Protection Supervisor, where they had the opportunity to exchange experience and best practices in the field of personal data protection, including the role of the Data Protection Officer within a public or private entity.

–      On 14th-16th June, the 44th plenary meeting of the Consultative Committee of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) took place in Strasbourg, France. Several topics were discussed during the meeting, including:

–          Convention 108+, ratifications and current accessions;

–          data protection for the processing of personal data for anti-money     laundering/countering financing of terrorism purposes;

–          model contractual clauses for transborder data flows of personal data;

–          interpretation of Article 11 of the modernised Convention 108;

–          protection of personal data, including biometric data in the electoral process;

–          cooperation with other Council of Europe bodies and entities;

–          main developments and activities in the field of data protection etc.

At the same time, the NCPDP delegation reported on the status of ratification of the Protocol amending CETS no. 223 to Convention 108. It should be noted that on 9 February 2023, on the basis of Presidential Decree No. 757/2002, the Republic of Moldova signed the Protocol amending Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, and the Action Plan of the Government of the Republic of Moldova for the current year includes the promotion of measures to ratify the Protocol.

6. Other data protection authorities

–      On 22nd May, Following the EDPB’s binding dispute resolution decision of 13 April 2023, Meta Platforms Ireland Limited (Meta IE) was issued a €1.2 billion fine following an inquiry into its Facebook service, by the Irish Data Protection Authority (IE DPA), for serious breach of the legal provisions, stipulated in Regulation (EU) 2016/679 (GDPR). This fine, which is the largest GDPR fine to date, was imposed for personal data transfers made by Meta IE to the US under standard contractual clauses (SCCs) since 16 July 2020.

In its binding decision of 13 April 2023, the EDPB instructed the IE DPA to amend its draft decision and to impose a fine on Meta IE. Given the seriousness of the infringement, the EDPB found that the starting point for calculation of the fine should be between 20% and 100% of the applicable legal maximum. The EDPB also instructed the IE DPA to order Meta IE to bring processing operations into compliance with Chapter V GDPR, by ceasing the unlawful processing, including storage, in the U.S. of personal data of European users transferred in violation of the GDPR, within 6 months after notification of the IE SA’s final decision.

The IE DPA’s final decision incorporates the legal assessment expressed by the EDPB in its binding decision, adopted on the basis of Art. 65(1) (a) GDPR after the IE DPA, as lead supervisory authority (LSA), had triggered a dispute resolution procedure concerning the objections raised by several concerned supervisory authorities (CSAs). Among others, CSAs issued objections aiming to include an administrative fine and/or an additional order to bring processing into compliance.

–      On 16th May, the final decision of the Croatian SA of 2nd May 2023 was announced regarding the imposition of the administrative fine on the data controller, the Debt Collection Agency B2 Kapital d.o.o., in the amount of 2,265,000.00 EUR due to violations of Articles 13, 28 and 32 of the GDPR

In December of 2022, the Croatian SA received an anonymous complaint in which it was stated that there was unauthorized processing of a large number of personal data of debtors, by the Debt Collection Agency B2 Kapital d.o.o. Together with the complaint, the B2 Kapital received the attached USB stick containing personal data for a total of 77 317 natural persons who had outstanding debts in credit institutions, and which were purchased by the Debt Collection Agency based on the cession agreement. The same personal data were delivered on a USB stick to a Croatian media outlet.

It was established that the violation has been going on since at least 2019 and that it has not been remedied to date, all because of not applying appropriate protective measures.

–      On 21st March, the final decision of the Finnish SA of 17th February 2023 was announced regarding the imposition of the administrative fine in the amount of 440,000 EUR on the data controller, Suomen Asiakastieto Oy, for failing to erase inaccurate payment default entries saved into the credit information register due to inadequate practices. The SA pointed out that a payment default entry has a significant impact on the rights and freedoms of an individual.

In 2021, the Finnish SA ordered the controller to rectify its practices in registering payment default entries based on final decisions and to erase all inaccurate payment default entries which had resulted from such practices. The controller did not appeal the decision. The Finnish SA contacted the controller in January 2023 for sanction assessment. The controller stated that it had interpreted the SA’s order incorrectly and had now erased all payment default entries based on final decisions from its register. The SA finds that the controller has consciously decided not to comply with the SA’s order. The inaccurate payment default entries could have been erased because the Legal Register Centre discloses payment default information based on final decisions to the controller in the format in which they are saved in the register of court decisions. Decisions can be retrieved from the register for 10 years from their date of issue.

–      The French Data Protection Authority (CNIL) imposed an administrative fine in the amount of 5,2 million euros on the data controller CLEARVIEW AI for illegal data procession via facial recognition technology.

CLEARVIEW AI collected photographs from a wide range of websites, including social networks, and sells access to its database of images of people through a search engine in which an individual can be searched using a photograph. The company offered this service to law enforcement authorities. Facial recognition technology is used to query the search engine and find an individual based on its photograph.

1.      Information and training activities carried out by the NCPDP

During the fourth quarter of 2022, the National Center for Personal Data Protection (NCPDP) organized 8 training courses for local public authorities (LPAs) attended by about 226 persons and 5 training courses for central public authorities (CPAs) and other entities where about 425 representatives were trained, as well as 125 participants from the Academy of Public Administration and Mobiasbanca (OTP Bank).

For LPAs the training was conducted as follows:

– On 11 October – Cimișlia District Council;

– On 27 October – Șoldănești District Council;

– On 04 November – Cantemir District Council;

– On 25 November – Ștefan Vodă District Council;

– On 18 November – Ocnița District Council;

– On 2 December – Basarabeasca District Council;

– On 9 December – Criuleni and Dubăsari District Councils;

– On 20 December – Taraclia District Council.

As for other entities, the NCPDP has organized trainings for:

– representatives of the National Bank of Moldova on 10 and 17 October;

– Academy of Public Administration – on 18 October;

– Mobiasbanca (OTP Bank) – on 22 and 24 November;

– Customs Service – on 17 October, as well as on 19-21 December.

Thus, during this period, the NCPDP managed to train a significant number of people across the country.

Moreover, it is worth mentioning that during 2022 training of all LPAs in the Republic of Moldova was ensured.

Also, during the same period, in order to disseminate the field of personal data protection, the NCPDP organized a Workshop for pupils of the 5th-6th grades of IPLT “Gheorghe Asachi” mun. Chișinău. The workshop aimed to inform and raise awareness of pupils with the field of personal data protection and children’s safety in the online environment by promoting empowerment of best practices for intervention and support.

2.      Control Activity

In the period October – December 2022, the NCPDP initiated compliance checks on the processing of personal data in 53 cases. In the reference period, 57 decisions were issued of which 17 cases were found to be in breach of the law, being concluded 31 minutes of infringement proceedings, which were subsequently submitted to the court for resolution.

3.      Findings of the National Centre for Personal Data Protection

I. The NCPDP has examined the complaint of a personal data subject concerning the alleged non-compliant processing of personal data stored in the Real Estate Register and carried out by a natural person.

During the investigation, it was found that the operations to access the real estate, which belongs to the data subject by right of ownership, was carried out with the purpose of purchasing a real estate located in the same area, but no evidence confirming the allegations was presented by the controller.

Furthermore, the NCPDP found that in the mentioned case, the personal data controller did not provide statements that would justify, in particular, the necessity of the access carried out in relation to the personal data of the data subject and the demonstration of the causal link between the personal data of the owner of the property and the purpose of the access.

In this context, by decision it was found that the operation of accessing personal data relating to the data subject’s real estate was carried out in breach of Article 4 para. (1) letters a), b) and art. 5 of Law no. 133 of 08.07.2011 on personal data protection, by a natural person, without a determined, explicit and legitimate purpose.

II. The NCPDP received a complaint from a personal data subject, who requested verification of the lawfulness of personal data processing operations concerning him, carried out by 8 (eight) entities (hereafter – data controllers), manifested by accessing personal data stored in several automated record systems (RSP, RST, RBI, etc.), being more than 400 accesses, as well as the failure to exercise the right of access to personal data concerning the complainant.

In these circumstances, the NCPDP ordered the examination of the lawfulness of the processing operations of the data subject’s personal data carried out by each controller.

Thus, as a result of the investigations, with regard to three data controllers, the NCPDP found that the data controllers processed the personal data of the data subject in compliance with the requirements of Law No. 133 /2011, while in the case of five data controllers, the NCPDP found a violation of the provisions of the aforementioned Law, as the data controllers could not justify the purpose and legal basis of the processing operations of the data subject’s personal data, or could not identify the data of the users who carried out certain consultation/viewing operations of the data subject’s personal data and, respectively, it was not possible to identify the purpose of the processing.

Furthermore, with regard to a data controller-legal entity, the NCPDP established that, although the complainant exercised his right of access to his personal data processed by the entity, by sending a request pursuant to Article 13 of Law 13/2011 to the controller, the latter did not provide him with a response to what he had requested, contrary to the aforementioned legal provisions.

III. The NCPDP has examined the complaint received from the Effective Inspection Department of the General Inspectorate of Police complaining about alleged unlawful acts admitted in the processing of personal data of a data subject by police employees of a territorial Police Inspectorate.

In the context, the NCPDP determined that the characterization and criminal record on behalf of the data subject, documents reflecting personal data – year of birth, state identification number (IDNP), data from the registration certificate, family status, home/residence address, behavior (characterizes the person), personal data relating to the imposed traffic offences were issued and released by the person in charge within the public authority, without a legal basis and the consent of the data subject, without an address/request from the data subject, the lawyer in his/her interests, including without a request by the court to release these documents, actions which are contrary to the legal conditions provided for in Art. 4 para. (1) (a), art. 5, art. 8 and art. 9 of Law no. 133 of 8 July 2011 on personal data protection.

4.      Supervisory activity

In accordance with the provisions of Art. 25 para. (6) of the Law no. 133/2011 on personal data protection, the controller or processor is obliged to publish the contact details of the data protection officer and communicate them to the NCPDP. Thus, during the reference period, the NCPDP received 11 letters, through which it was informed about the fact of the designation of the data protection officer from the respective entities, mainly from private entities.

At the same time, the following guidelines were developed and published on the official website of the NCPDP under the section “Data controller/NCPDP recommendations”: “Guidelines on personal data protection impact assessment (DPIA)” and “Guidelines on the processing of personal data through video devices”.

In order to provide methodological and advisory support to personal data controllers and/or processors, more than 204 telephone consultations and 21 responses via e-mail were provided and recommendations were proposed to resolve discrepancies identified by the data controller.

5.      International and European news

  On 10 October, the 70th Plenary Session of the European Data Protection Board (EDPB) took place in Brussels, Belgium.

During the Plenary, the EDPB adopted several documents, including:

·         One of the main topics concerned the adoption by the EDPB of a list of aspects in national procedural law that it wishes to see harmonised at EU level to facilitate GDPR enforcement. This “wish list” is one of the key actions set out in the EDPB’s Vienna statement on enforcement cooperation.

·         An Opinion on the approval by the Board of the Europrivacy certification criteria submitted by the Luxembourg data protection authority. This Opinion marks the approval of the very first European Data Protection Seal by the EDPB pursuant to Art. 42 (5) GDPR. The Europrivacy certification mechanism is a general scheme that targets a large range of different processing operations performed by both controllers and processors from various sectors. The scheme includes specific criteria that make it scalable and applicable to specific processing operations or sectors of activity.

·         A statement on the digital euro. In its statement, the EDPB reiterates the importance of ensuring privacy and data protection by design and by default in this project, recommending that the digital euro is made available both online and offline, along a threshold below which no tracing is possible, to allow full anonymity of daily transactions.

 On 19-20 October, the meeting of the Moldova-EU Subcommittee on Freedom, Security and Justice (LSJ Subcommittee) took place in Brussels, Belgium.

During the meeting, topics discussed included developments in the field of personal data protection, justice sector reform, preventing and combating organised crime, corruption and other illegal activities, money laundering and terrorist financing.

The meeting also presented the progress made in the above-mentioned areas since the last meeting held on 12-13 October 2021, online. The meeting included representatives of several authorities of the Republic of Moldova, such as: the National Anti-Corruption Centre; the General Prosecutor’s Office; the National Integrity Authority; the Ministry of Internal Affairs; the National Institute of Justice; the Office for Prevention and Combating of Money Laundering.

 On 9 – 11 November, the OSCE Mission to Moldova, in cooperation with the OSCE Mission for Conflict Prevention in Vienna, continued the project entitled “Joint Expert Working Group” started last year. The event took place in Vienna, Austria and aimed at capacity building for female leaders. The objective of the project was to enable women co-chairs and women in key positions to participate more effectively in the work of the Joint Expert Working Group in the Transnistrian settlement process by improving technical skills and strengthening personal relationships between the representatives of the parties. The event addressed a number of topics, including: gender dynamics; gender analysis of conflicts; negotiation behaviour; enlarging the space for maneuver in negotiation processes; etc.

 On 14 November, the 71st Plenary Session of the European Data Protection Board took place online. During the plenary session, the EDPB adopted the Recommendations on the application for approval and on the elements and principles to be found in Controller Binding Corporate Rules (BCR-C). BCR-Cs are a transfer tool that can be used by a group of undertakings or enterprises, engaged in a joint economic activity, to transfer personal data outside the European Economic Area to controllers or processors within the same group. BCRs create enforceable rights and set out commitments to establish a level of data protection essentially equivalent to the one provided by the GDPR. The aim of these recommendations is to:

·         provide an updated standard application form for the approval of BCR-Cs;

·         clarify the necessary content of BCR-Cs and provide further explanation;

·         make a distinction between what must be included in a BCR-C and what must be presented to the BCR lead data protection authority in the BCR application;

A second set of recommendations for BCR-processors is currently being developed.

The 43rd Plenary Meeting of the Consultative Committee of Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data took place on 16-18 November, in Strasbourg, France. The event, held in person after three years of online/hybrid meetings, brought together around 80 participants from all regions of the world for three days to work and exchange views on various topical issues in the field of personal data protection and to contribute to the development of common policies.

Among the topics discussed during this session were:

·         Digital identity;

·         Model contractual clause for the transfer of personal data;

·         Cooperation with other Council of Europe bodies and entities;

·         The Committee organised elections and elected the new Bureau;

·         Observers – The Committee examined and approved two requests to attend the Committee’s meetings respectively introduced by the Organisation of American States and the Burkina Faso Data Protection Authority;

·         Upcoming 2022 and 2023 meetings – the Committee reported on the dates of the next plenary meetings, to be held on 14-16 June 2023 and 15-17 November 2023, as well as the next Bureau meetings on 15-16 December 2022, 22-24 March 2023, 27-29 September 2023 and 12-14 December 2023;

·         Stefano Rodotà Award – The two winners of the 2022 Rodotà Award presented their work to the Committee and received their awards.

  On 18-19 November 2022, the representatives of the NCPDP participated in the European Case Handling Workshop 2022, held in Tbilisi, Georgia.

The event focused on actual issues in the field of personal data protection and privacy, in particular such as:

·         The steps taken by employees of the authorities in investigations;

·         Social data protection, guidelines and exceptions in national legislation;

·         International transfers of personal data;

·         Personal data and artificial intelligence;

·         Main challenges faced by data supervisory authorities, etc.

Attending the event, the representatives of the NCPDP addressed the topic – “The experience of the Republic of Moldova and the methodology of examining the complaints having children as data subjects”. The invitation to participate in the Workshop came from the Personal Data Protection Service of Georgia, which has been carrying out the control of the lawfulness of personal data processing since 2013. The event brought together around 50 participants from 26 European countries.

    On 12-14 December, the Cyber East project meeting took place: Action on Cybercrime for Resilience in the Eastern Partnership Region and included two major events, namely, the 6th EU-CoE CyberEast Project Steering Committee Meeting and the Regional Cyber Reporting and Data Sharing Session which aims to support Eastern Partnership countries in building and maintaining partnerships with private sector entities, mainly Internet Service Providers (ISP), to strengthen cooperation and trust mechanisms between the private sector, citizens and criminal justice authorities, in Tbilisi, Georgia. The meeting addressed several topics, including:

·         Cybercrime/Cybersecurity Reporting. Reporting challenges;

·         Classification of cyber incidents/cybercrimes. Use of taxonomies and their necessity;

·         Examples of reporting systems: ideas for improvement for national systems;

·         National SOPs and segregation of duties;

·         Public-private cooperation in Ukraine: focus on new procedural legislation and use of procedures/models;

·         Which types of data and how they can be shared by CSIRTs.

   The 73rd Plenary Session of the European Data Protection Board took place on 13-14 December, in Brussels, Belgium. During the meeting, the EDPB adopted a statement on the recent judgment C-817/19 of the Court of Justice of the European Union (CJEU) on the use of passenger name record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, under the PNR Directive 2016/681. In its statement, the EDPB calls on EU Member States to take all necessary steps at legislative and/or administrative level to ensure that their respective national transposition and implementation of the PNR Directive are in line with the Charter as interpreted by the CJEU. In this regard, the EDPB notes that Data Protection Authorities are fully competent to investigate compliance with EU data protection requirements at national level.

    The 57th Meeting of the Bureau of the Consultative Committee of Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, took place on 15-16 December. Several topics were discussed during the meeting, including:

·         Convention 108+, state of play;

·         Digital identity;

·         Data protection for the processing of personal data for Anti-Money Laundering /

Countering Financing of Terrorism purposes;

·         Model contractual clauses for the transfer of personal data;

·         Interpretation of Article 11 of the modernised Convention 108;

·         Major developments and activities in the field of data protection;

·         Cooperation with other Council of Europe bodies and entities.

6.      Other data protection authorities

   On 19 October, the French Data Protection Authority (CNIL) issued an administrative fine in the amount of 20 million euros to Clearview AI for the infringement of Articles 6, 12, 15, 17 and 31 of GDPR.

The CNIL has received numerous complaints from individuals about Clearview AI facial recognition software and has launched an investigation.

As a result of the investigation, the CNIL found several violations, such as:

·         Unlawful processing of personal data (breach of article 6 of the GDPR)

·         Individuals’ rights not respected (articles 12, 15 and 17 of the GDPR)

·         Lack of cooperation with the CNIL (Article 31 of the RGPD)

On the basis of the information brought to its attention, CNIL decided to impose a maximum financial penalty of 20 million euros, according to article 83 of the GDPR.

Regarding the very serious risks to the fundamental rights of the data subjects resulting from the processing carried out by the company, CNIL decided to order Clearview AI to stop collecting and processing data of individuals residing in France without a legal basis and to delete the data of these persons that it has already collected, within a period of two months, adding to this injunction a penalty of 100,000 euros per day of delay beyond these two months.

  On 24 November, the French Data Protection Authority (CNIL) issued an administrative fine in the amount of 600,000 euros to Electricité de France (EDF) for r the infringement of articles 7, 13, 14, 32 of GDPR and of the Postal and Electronic Communications Code.

The CNIL, has received many complaints regarding difficulties encountered by individuals in having their rights considered by the company EDF, which is the first electric utility in France.

Following the investigations, CNIL found several violations, such as:

·         Failure to collect consent of individuals to receive commercial prospecting by e-mail (Articles L. 34-5 of the French Postal and Electronic Communications Code and 7 of the GDPR)

·         Failures to inform (Articles 13 and 14 of the GDPR) and to respect the exercise of rights (Articles 13 and 14 of the GDPR)

·         Failure to ensure security of personal data (Article 32 of the GDPR).

The amount of the fine was decided considering the breaches observed and the cooperation by the company and all the measures it has taken during the proceedings to reach compliance with all alleged breaches.

    On 2 November, the Portuguese Data Protection Authority (CNPD) issued a fine in the amount of 4.3 million euros to Portuguese National Statistics Institute (INI) for the infringement of article 9(1); article 12; article 13; article 28(1), (6) and (7); article 35(1), (2) and (3)(b); article 44; article 46; article 83 of GDPR.

The CNPD received several complaints about the national census survey that was still undergoing at that moment. For the performance of the census, INE used the CDN (a content delivery network) services of a US company, Cloudflare, Inc., with over 200 data centres spread over 100 countries. In light of the complaints received, the CNPD opened an inquiry. At that point, circa 2.5 million forms, containing the personal data of over six million citizens residing in Portugal, had already been submitted to the INE.

As a result of the subsequent investigation, the CNPD identified five infringements of the GDPR in the context of the Census 2021 data processing, regarding the following issues:

·         Lack of lawfulness for the processing of special categories of personal data (article 9(1) GDPR).

·         Lack of compliance with transparency obligations (articles 12 and 13 GDPR), in particular regarding the provision of any information concerning the processing operations, e.g. through the display of a privacy notice on the INE institutional website.

·         Lack of a Data Protection Impact Assessment (article 35(1),(2) and (3)(b) GDPR).

·         Lack of due diligence concerning the choice of the processor (article 28(1),(6) and (7)), namely by accepting a standard contract, that was not assessed in substance in what regards the requirements of  article 28(3) GDPR.

·         Lack of compliance with the legal requirements for international data transfers (articles 44 and 46(2)), as interpreted by the CJEU in the Schrems II judgement.

In this context, as a result of the facts and the legal reasoning, the CNPD determined that the controller infringed different GDPR provisions in the context of the 2021 Census data processing and therefore decided, pursuant to article 58(2)(i) and article 83 GDPR and some national provisions, to apply one single fine of 4.3 million euros to the controller. This decision is final, but can be challenged in the national courts.

1. Information and training activities carried out by the NCPDP
   

   On 10 July 2022, the National Centre for Personal Data Protection (NCPDP) celebrated 14 years of activity. On this occasion, the NCPDP organized several activities related to data protection field. Amongst the activities was the street information activity organised on 11 July under the title: “14 years since the founding of the NCPDP”. The aim of the action was to disseminate useful information on the field of personal data protection to passers-by, to inform and encourage Moldovan citizens to pay more attention to this field.

   At the same time, during the reporting period, the NCPDP continued the training process for the representatives of local public authorities (LPAs) and central public authorities (CPAs) in the field of personal data protection. The aim of the training courses was to familiarise, raise awareness and inform the representatives of the authorities with the latest data protection issues. The main topics covered referred to: general notions of personal data, legal grounds for personal data processing, processing of special categories of personal data, filming and online transmission of local council meetings, depersonalisation of data in the State Register of Local Acts, designation of the personal data officer, specifics of the function and tasks of the data protection officer. Thus, training courses were organised for the following authorities:

   –         On 15 July – Nisporeni District Council;

   –         On 20 July – Directorate-General for Education, Youth and Sport (DGEYS)

   –         On 4 August – Strășeni District Council;

   –         On 19 August – Hîncești District Council;

   –         On 2 September – Anenii Noi District Council;

   –         On 22 September – Leova District Council.

   In this regard, in the third quarter of this year, the trainers of the NCPDP trained about 197 representatives from the above-mentioned LPAs and 64 representatives from DGEYS.

   Also, during the same period, the NCPDP has developed a list of Recommendations for video surveillance installation service providers to provide advice to end-users when installing video surveillance systems. The recommendations are available on the official website of the institution and can be consulted at the Data Controller section, sub-component CNPDCP Recommendations.

2. Control activity 

   In the period July-September of this year, the NCPDP initiated compliance checks on the processing of personal data in 53 cases and 54 decisions were issued, of which 33 cases were found to be in breach of the law. At the same time, during the same period, the NCPDP concluded 30 minutes of infringement proceedings, which were subsequently submitted to the court for resolution. 

3. Findings of the National Centre for Personal Data Protection
   

   I. The NCPDP examined the complaint of a personal data subject who alleged that personal data stored in the Real Estate Register were processed in a non-compliant manner by a local public administration.

      As a result of the complaint’s resolution, the NCPDP found that the local public administration did not take appropriate action regarding the organisational and technical measures necessary for the protection of personal data, contrary to the provisions of Article 4 para. (1) letter a), Art. 29 para. (1), Art. 30 para. (1) of Law no. 133/2011, not ensuring the confidentiality and security of personal data in relation to the risks presented by the processing and the nature/nature of the data processed within the Database of the of the real estate register, without monitoring and implementing compliance with the provisions of the agreement for the provision of information access services.

   Consequently, it should be revealed that the local public authority mentioned above was ordered by Decision:

   ·      – Review the access rights of the users to the Real Estate Cadastre Database, after the change of status of the user/s (resignation, dismissal, detachment, etc.) by updating the list of users with access rights to the information, according to the agreement for providing information access services;

   ·      – Informing the P.I. “Public Services Agency” about the change of users, in order to revoke the identification/authentication codes of the authorized user within the public authority, as well as to block access to the information in the Real Estate Cadastre Database;

   ·       Establishment of a mechanism for authorised users to keep manual and/or electronic records of access/consultation of personal data through the Real Estate Cadastre Database, by recording the exact date and time of processing of personal data, justification of the purpose, basis and necessity of the operation performed, specification of the record system from which they were processed, categories of data processed;

   ·      – Informing/instructing the staff of the subordinate subdivision that unauthorised access/use of information from the Real Estate Cadastre Database and other information systems is not allowed.

   II. The NCPDP has examined the complaint of two personal data subjects concerning the alleged non-compliant processing of personal data by a local public administration stored in the Real Estate Register.  

   During the investigation it was found that the operations of accessing the real estate, which belonged by right of ownership to the data subjects, was carried out from the user account created in the name of a former employee of the local public administration, who had not worked in the entity for 3 years, and the account was used by an undetermined number of employees of the local public administration concerned.

             In this context, the decision of the NCPDP found that the operation of accessing the personal data of the data subjects was carried out in violation of Article 4 para. (1) (a), (b) and Art. 5, Art. 29 para. (1), Art. 30 para. (1) of Law 133/2011 on the protection of personal data, by the local public administration, in the absence of a determined, explicit and legitimate purpose, exclusively in the conditions that the access took place on a day officially declared not working.

   III. The other case, following the checks carried out, the NCPDP found a violation of a data subject’s right of access to personal data by a public authority.

   In fact, the circumstances that served as a reason for initiating the verification of the conformity of personal data processing operations was the complaint filed by a data subject who expressed his disagreement with the response provided by a subdivision of the Ministry of Internal Affairs (MAI), by not providing comprehensive information on the personal data concerning him, processed within the Automated Information System “Register of Forensic and Criminological Information”, an action that the complainant considered to be contrary to the provisions of Article 13 para. (1) of Law 133/2011 on the protection of personal data.

      As a result of the examination of the complaint, the NCPDP found a violation of Article 13 para. (1) of Law 133/2011 on the protection of personal data, ordering, by decision, that the Ministry of Internal Affairs shall take the actions required to ensure the realization of the right of access to personal data for data subjects, including the data processed in the Automated Information System “Register of forensic and criminological information”, without admitting confusion regarding the free nature in the realization of the right of access of any data subject, recognized and guaranteed by Art. 13 para. (1) of Law No 133/2011 on the protection of personal data.

4. Supervisory activity
   

   In accordance with the provisions of Law No. 175/2021 on the amendment of certain normative acts, which entered into force on 10 January 2022, the obligation to designate the personal data officer has been established. Thus, during the reference period, the NCPDP received 49 letters, through which it is informed about the designation of the personal data officer from the entities concerned, mainly from private entities.

   In order to provide methodological and advisory support to personal data controllers and/or processors, more than 195 telephone consultations and 26 responses via e-mail were provided and recommendations were proposed to address discrepancies identified by the data controller.

5. International and European news
   

   –      During the reporting period, a Cooperation Agreement in the field of personal data protection was signed between the National Centre for Personal Data Protection (NCPDP) and the Data Protection Office of the Republic of Poland.

   –      On 12 July, the 67th plenary meeting of the European Data Protection Board (EDPB) took place online.

   •  During the plenary session, EDPB and the European Data Protection Supervisor (EDPS) have adopted their Joint Opinion on the European Commission’s Proposal for the European Health Data Space (EHDS). The Proposal aims to facilitate the creation of a European Health Union and to enable the EU to make full use of the potential offered by a safe and secure exchange, use and reuse of health data. The EDPB and EDPS acknowledge that the infrastructure for the exchange of electronic health data foreseen in this EHDS Proposal aims at facilitating the exchange of health data. However, due to the large quantity of electronic health data that would be processed, their highly sensitive nature, the risk of unlawful access and the necessity to fully ensure effective supervision by independent data protection authorities, the EDPB and the EDPS call on the European Parliament and, on the Council, to add to the Proposal a requirement to store the electronic health data in the EEA, without prejudice to further transfers in compliance with Chapter V of the GDPR.

   –      On 28 July, the 68th plenary meeting of the European Data Protection Board took place online. During the meeting a number of documents were discussed and adopted, which will be a recommendation for data protection authorities, namely:

   • EDPB and EDPS adopted a Joint Opinion on the Proposal for a Regulation to prevent and combat child sexual abuse. The Proposal aims to impose obligations related to detecting, reporting, removing and blocking known and new online child sexual abuse material, as well as the solicitation of children, on providers of hosting services, interpersonal communication services, software application stores, internet access services and other relevant services. The EDPB and EDPS consider child sexual abuse as a particularly serious and heinous crime. Limitations to the rights to private life and data protection must, however, respect the essence of these fundamental rights and remain limited to what is strictly necessary and proportionate

   • Two letters in response to Access Now and BEUC concerning TikTok. In these letters, the EDPB highlights the swift action taken by the Irish, Italian and Spanish Supervisory Authorities (SAs) following TikTok’s announcement that it would no longer seek users’ consent to send personalised advertisements, but that the legal basis for this would be the legitimate interest of TikTok and its partners.

   • A dispute resolution decision on the basis of Art. 65 GDPR. The binding decision seeks to address the lack of consensus on certain aspects of a draft decision issued by the Irish SA as lead supervisory authority regarding Instagram (Meta Platforms Ireland Limited (Meta IE)) and the subsequent objections expressed by some of the concerned supervisory authorities.

   –  On 12-13 September, the 69th Plenary Session of the European Data Protection Board took place in Brussels, Belgium. During the Plenary, the EDPS adopted several documents, including:

   • A Statement on the European Commission’s proposal for an EU Police Cooperation Code. This proposal aims to enhance law enforcement cooperation across Member States, in particular the information exchange between the competent authorities. The code is comprised of three main measures: proposal for a Prüm II Regulation, proposal for a Police Information Exchange Directive and the proposal for a Council Recommendation on operational police cooperation.

   • EDPB decided upon the topic for its second coordinated enforcement action, which will concern the designation and position of the data protection officer. In a coordinated action, the EDPB prioritises a certain topic for data protection authorities to work on at the national level. The results of these national actions are then bundled and analysed, generating deeper insight into the topic and allowing for targeted follow-up on both the national and the EU level.

6. Other data protection authorities
   

   –   On 7 July, the French Data Protection Authority (DPA) issued a fine of 175 000 euros to UBEEQO International for illegally processing of personal data. This case is part of the priority control theme in 2020 relating to the new uses of geolocation data in the context of mobility. In this context, the French DPA controlled the company UBEEQO International, whose activity is the rental of vehicles for a short period. The investigations focused in particular on the data collected, the defined retention periods, the information provided to individuals and the security measures implemented. Following the investigations, French DPA found several violations, such as:

   ·  Failure to comply with the obligation to ensure data minimisation (Article 5.1.c of the GDPR).

   ·  Failure to define and respect a proportionate data retention period (Article 5.1.e of the GDPR).

   ·  Failure to inform individuals (Article 12 of the GDPR).

   –   On 19 July, the Hellenic Data Protection Authority (DPA) issued a fine of 20 000 euros to the Debt Management Company for unlawful processing of personal data and failure to consider the rights of objection and erasure. Following the investigation, the Hellenic DPA found that in this particular case, the respondent company unjustifiably prevented the exercise of the complainant’s rights in violation of the provisions stipulated in Article 12(2) of the GDPR and that the processing in question took place without a lawful basis, given that there was already a judicial relief from the complainant’s debts in violation of the provisions of Articles 5(1)(a), 5(2) and (6) of GDPR.

   –   On 8 September, the French Data Protection Authority (CNIL) issued a fine of 250 000 euros to INFOGREFFE for the infringement of Article 5.1.e and Article 32 of the GDPR. Following a complaint, CNIL, carried out an online investigation of the infogreffe.fr website, which allows users to consult legal information on companies and order documents certified by the commercial court registries. The investigations focused in particular on the data retention periods defined and the security measures implemented by the economic interest group INFOGREFFE, which provides the legal information publishing service on companies via the website. Following the investigation was found:

   ·  Failure to comply with the obligation to keep data for a period of time proportionate to the purpose of the processing (Article 5.1.e of the GDPR);

   ·  Failure to comply with the obligation to ensure the security of personal data (Article 32 of the GDPR).

    

1.    Information and training activities carried out by the NCPDP

      During the second quarter of 2022, the National Center for Personal Data Protection (NCPDP), has made progress in the part related to training activities for representatives of local public authorities (LPAs) and central public authorities (CPAs). Thus, the training courses aimed at strengthening the capacities of representatives by familiarizing, raising awareness and informing them with the field of personal data protection. The most important topics covered were, as appropriate: general notions of personal data; processing of categories of personal data; legal grounds for personal data processing; filming and online transmission of local council meetings; depersonalisation of data in the State Register of Local Acts; the personal data protection officer; data protection impact assessment and prior consultation; designation of the function and tasks of the data protection officer. Training courses were conducted for the following institutions/authorities:

– 8 April – Balti Municipal Council;

– 19 April – Rezina District Council;

– 06 May –  Floresti District Council;

– 20 May – Sîngerei District Council;

– June 3 – Ungheni District Council;

– 17 June – Calarasi District Council.

   In this regard, the NCPDP has trained about 215 LPA representatives from the above-mentioned regions.

      Regarding training for representatives of LPAs, the NCPDP organised trainings for about 1310 representatives of: Customs Service; State Tax Service; National Agency for Food Safety and Secretariat of the Parliament of the Republic of Moldova.

     On 15 April this year, the NCPDP launched an information and awareness campaign for school communities entitled: “Personal data protection and children’s safety online”. The first training course was organized at Lyceum “Onisifor Ghibu” in Chisinau, the target audience being 4th grade pupils. The aim of the campaign is to provide the school community with high visibility on personal data protection and child safety online at local and national level by promoting empowerment and best practices for intervention and support.  Subsequently, two more training sessions were held within the school community on 6 May.

  The topics covered in the trainings were: general notions on personal data; correct use of photos/videos online; risks and threats online; communication on social networks.

       Also, during the same period, the NCPDP signed two Collaboration Agreements with the “Academy of Public Administration” and the “National Association of ICT Companies”.

2. Control activity

     In the period April-June 2022, the NCPDP stared the verification of compliance of personal data processing operations on 76 cases and 50 decisions were issued, of which 32 cases were found to be in breach of legal provisions. At the same time, 34 infringement reports were concluded and subsequently submitted to the court for resolution. Similarly, during the same period, 37 contraventions were found.

3.    Findings of the National Centre for Personal Data Protection

I.     Processing of personal data without legal basis, manifested by accessing data through the Real Estate Register and violation of the personal data subject’s right of access to personal data.

       The NCPDP, in the context of the examination of a petition filed by a data subject, issued a decision finding a violation of Article 4 para. (1) (a) and (b), Art. 5 para. (1) and Art. 13 para. (1) of the Law no. 133/2011 on personal data protection by a real estate company, in the processing of personal data of the petitioner, manifested both by accessing the personal data of the data subject, stored in the Teal Estate Register, and ignoring the request of the data subject, whereby the latter requested information on the reasons, the purpose for processing personal data concerning him, realizing his right of access to personal data.

       Thus, following the examination of the case, it was determined that the personal data controller processed the personal data of the data subject, stored in the Real Estate Register, without a legal basis and without the consent of the personal data subject, and it was found that the real estate company violated the provisions of Article 4 para. (1) (a) and (b) and Art. 5 para. (1) of Law no. 133 of 08.07.2011 on the protection of personal data.

       Moreover, the real estate company ignored the data subject’s request, failing to grant him the right of access to personal data concerning the data subject provided for by Article 13 para. (1) of the personal data protection Law.

II.   Breach of the rules on processing and storage of personal data.

       The NCPDP was notified by a personal data subject that a data controller, without the consent of the data subject, makes payments on behalf of the data subject to the bank account of the legal entity, thus processing personal data – name, surname, state identification number.

       Throughout the investigation it was found that an employee of a bank, during the year 2021, used a template of a cash collection order in favor of a legal entity, but with a member of the cooperative as the payer. In the mentioned orders the employee only changed the amount and the corresponding date, but omitted to change the data/information of the payer, although at the conclusion of the transaction the latter verified the identity of the administrator of the cooperative without him providing a copy of the identity card of the data subject.

       We note that, according to Art. 4 para. (1) of Law no. 133 of 08.07.2011 on the personal data protection, personal data subject to processing must be: a) processed fairly and lawfully; b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. […]. According to Art. 5 of the same normative act, the processing of personal data is carried out with the consent of the subject of the personal data, except in the cases exhaustively stated in para. (5) of the same article. According to Article 9 of the aforementioned normative act, the processing of the State identification number (IDNP) of the natural person, […] or other personal data having an identification function of general applicability may be carried out under the following conditions: a) the subject of the personal data has given his consent; b) the processing is expressly provided for by law.

        In this context, the decision found that the bank employee, during 2021, violated the provisions of Art. (1) (a) and (b), Art. 5 para. (1) and art. 9 of Law no. 133 of 08.07.2011 on the personal data protection.

       Moreover, the NCPDP has ordered by the decision of the banking institution to initiate training of employees/staff involved in the processing of personal data, in order to train them to perform their functional duties in accordance with the legislation in the field of personal data protection, as well as internal documents/regulations approved in this regard.

4. Supervisory activity

      In accordance with the provisions of Law No. 175/2021 on the amendment of certain normative acts, which entered into force on 10 January 2022, the obligation to designate the personal data officer has been established. Thus, during the reference period, the NCPDP received 24 letters, through which it is informed about the designation of the personal data officer from the entities concerned, mainly from private entities.

      At the same time, the following recommendations/opinions have been developed and posted on the official website of the NCPDP: Considerations in relation to the increasing use of video surveillance systems with audio recording functions; Practical and legal aspects in relation to the installation and management of video surveillance means.

In order to provide methodological and advisory support to personal data controllers and/or processors, more than 315 telephone consultations and 20 responses via e-mail were provided and recommendations were proposed to address discrepancies identified by the data controller.

   At the same time, the NCPDP has informed 34 public authorities and institutions about the need to designate the personal data officer.

5.      International and European news

–          The 63rd plenary meeting of the European Data Protection Board (EDPB) was held online on 6 April. During the session, several topics were discussed, including a Statement on the announcement of a new Trans-Atlantic Data Privacy Framework. The EDPB welcomes the commitments made by the U.S. to take ‘unprecedented’ measures to protect the privacy and personal data of individuals in the European Economic Area when their data are transferred to the U.S.

–          The 64th plenary meeting of the European Data Protection Board was held online on 4 May, at which was discussed the adoption of the EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act).

–          The 65th plenary meeting of the European Data Protection Board took place online on 12 May. The plenary session focused on two topics, namely:

·         They were adopted new Guidelines on the calculation of administrative fines, harmonising the methodology data protection authorities (DPAs) use. The guidelines also include harmonised ‘starting points’ for the calculation of a fine. Hereby, three elements are considered: the categorisation of infringements by nature, the seriousness of the infringement and the turnover of a business.

·         The EDPB also adopted Guidelines on the use of facial recognition technology in the area of law enforcement. The guidelines provide guidance to EU and national law makers, as well as to law enforcement authorities, on implementing and using facial recognition technology systems.

–    On May 18-20, the 30th edition of the Spring Conference of European Data Protection Supervisors took place in Cavtat, Croatia. The event was hosted by the Croatian Agency for the Protection of Personal Data, thus encouraging the participation of about 40 countries. The agenda of the event included topical issues in the field of personal data protection, such as Convention 108+, mutual assistance and global convergence, data protection in ECHR case law: latest developments. Member authorities adopted a Resolution on the need for a prompt ratification of the “Convention 108+”, the modernised version of Convention 108. The Resolution calls upon the governments of the member states of the Council of Europe, the governments of third countries to the Council of Europe, the European Union and International Organisations to speed up the signature and ratification of Convention 108+.

–          The 66th plenary meeting of the European Data Protection Board took place on 14-15 June in Brussels, Belgium. During the Plenary, the EDPB adopted several documents, among which: Guidelines on certification as a tool for transfers. The main purpose of these guidelines is to provide further clarification on the practical use of this transfer tool and will be subject to public consultation until the end of September.

6. Other data protection authorities

·         On 4 April, the Danish Supervisory Authority has reported Danske Bank to the Danish police and proposed a fine of 1.3 million EUR for the infringement of Article 5 (2) of the GDPR. During the Danish SA’s investigation, it has become clear that the bank in more than 400 systems has not been able to document whether rules have been laid down for deletion and storage of personal data, or whether manual deletion of personal data has been carried out. These systems process personal data of millions of people. 

·         On April 15, the administrative fine in the amount of 1,5 million euros applied by the French Lead Supervisory Authority (CNIL) to Dedalus Biologie for the infringement of articles 28, 29 and 32 of GDPR. Based on the elements collected during the investigations, CNIL identified three breaches. First, in the context of the migration of a software package to another tool, requested by two laboratories using the services of Dedalus Biologie, the latter extracted a larger volume of data than required. The company therefore processed data beyond the instructions given by the data controller and had failed to comply with Article 29 GDPR. Second, the company had not ensured security of personal data within the meaning of Article 32 GDPR.  Furthermore, were also established that the general conditions of sale proposed by the company Dedalus Biologie and the contracts of maintenance transmitted to the CNIL did not contain the mentions provided for in Article 28 (3) GDPR.

·         On 3 May, the Icelandic Supervisory Authority imposed a fine of € 35,000 on the municipality of Reykjavík for using the Seesaw education system, which is an American cloud-based service. Following the investigation, it was found that: the processing agreement between Reykjavík and Seesaw was insufficient, that the municipality could not demonstrate a specified, explicit and legitimate purpose for the processing in question, which was therefore considered unlawful, that the processing was neither fair nor transparent, that the principles of data minimisation and storage limitations were not implemented nor data protection by design and by default, taking into consideration the amount of data collected, the extent of their processing, the period of their storage and their accessibility, that the data protection impact assessment did not meet the minimum requirements, that the municipality did not demonstrate that it had ensured appropriate security of the personal data in question and that the data was being transferred to the United States without appropriate safeguards. The Icelandic SA furthermore concluded that all processing in the Seesaw educational system should be seized and students’ data deleted.

1.      Information activities performed by NCPDP

On January 28, the National Center for Personal Data Protection (NCPDP) in collaboration with TAIEX project experts organized the National Conference “Challenges of international data transfers from the perspective of the Convention 108+ and GDPR”. The aim of the Conference was to present information, examples of good practices and innovative solutions on raising awareness and informing the public sector about the challenges of cross-border data transfer. The workshop was conducted by personal data protection experts from Italy, Germany, Austria and the representatives of European Commission. Amongst the topics addressed by the experts were: cross-border transfers of personal data from the perspective of Convention 108+ and global trends, overview of the grounds for the cross-border transfers of personal data under the GDPR and the type of safeguards needed, challenges of cross-border data transfers from the perspective of the EU supervisory authorities, cross-border data transfers in the area of law enforcement cooperation, general information on the concept of adequacy and substantive and procedural aspects of adequacy decisions. The event was attended by about 70 representatives of the public sector.

Furthermore, on January 26, the Street Action – “Protect personal data”, organized by the representatives of the NCPDP in the context of the European Data Protection Day, was held. In this context, a few employees of the NCPDP distributed to passers-by, near the Cathedral Square, information materials, raising awareness among citizens about the concept of personal data, the rights of personal data subjects, security and confidentiality measures when processing data. At the same time, they were informed about the possible situations in which personal data are not processed in accordance with the provisions of national legislation in this field, providing them with practical guidance and recommendations that should be undertaken in such situations.

In the reference period, NCPDP registered a remarkable evolution in terms of training and awareness activities. The series of trainings organized for the representatives of the local public authorities (LPA) from the districts of the Republic of Moldova was continued, with the aim of strengthening the capacities of LPA representatives throw familiarizing, raising awareness and informing them with the field of personal data protection. The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; approval of security policy and personal data filling systems instructions, etc. Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry. The events, moderated by national experts in the field of personal data protection within NCPDP, were organized for about 50 mayors, district councilors and secretaries of local councils from each district center based on the protection measures imposed in the context of the COVID pandemic – 19. The training courses were conducted:

·        On 27 January –Ialoveni District Council;

·        On 04 February Telenești District Council;

·        On 11 February –Edineț District Council;

·        On 25 February – Drochia District Council;

·        On 11 March –Dondușeni District Council;

·        On 25 March –Soroca District Council.

2.      Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 53 investigations. Of the 53 investigations: 47 finalized cases, in 27 cases the violation of the legal provisions was found. Furthermore, 18 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3.      Findings of the NCPDP

I.                   Violation of personal data subject’s rights, the right of access to personal data, the right of intervention upon the personal data and the right to object.

The NCPDP, in the context of the examination of a complaint filed by a data subject, issued a decision finding a violation of Article 13 para. (1) and art. 14 of the Law no. 133/2011 on personal data protection by an economic agent, in the processing of the complainant’s personal data, manifested by ignoring the request of the data subject, whereby the latter requested, including a response demonstrating that the data controller had deleted the personal data concerning him, thus realizing his right of intervention upon the personal data.

Thus, the personal data subject has realized his or her right of access and right of intervention upon the personal data concerning him or her by submitting a request to the personal data controller, asking for information on how to ensure the protection of customers’ personal data, what are the purposes for which these data are used, what are the guarantees that personal data are not used for personal purposes.

Following the examination of the case, it was determined that personal data controller ignored the request of the data subject, failing to grant him the right of access and the right of intervention upon the personal data concerning the data subject, provided for in Article 13 para. (1) and art. 14 of the Law on personal data protection.

In this respect, the economic agent was issued with a report on the infringement under Article 741 para. (3) of the Contravention Code.

II.               Violation of the processing and storage of personal data rules by means of a video surveillance system

NCPDP, in the framework of the examination of a complaint filed by a data subject, issued a decision finding a violation of the provisions of Article 4 para. (1) (a), (b), (c), Art. 5 para. (1) of the Law no. 133/2011, to the processing of complainant’s personal data, in connection with the collection/recording of the voice of the data subject, without his consent, by means of the video surveillance camera, installed on an electric pole, which included both the property of the video surveillance system manager and a portion of the space not belonging to the latter, without identifying the determined, explicit and legitimate purpose, the causal link between the purpose and the processed personal data of the complainant, the proportionality, fairness and consistency with the legal rules in the field of personal data protection.

Therefore, in the view of the above, the NCPDP has held that, before installing a video surveillance system, the data controller must always critically examine whether this measure is, firstly, appropriate for the achievement of the desired objective and, secondly, proportionate and necessary for its purposes, in relation to the interests or fundamental rights and freedoms of the data subject. Therefore, the audiovisual recording by the data controller in question, by means of the video surveillance camera, without the consent of the data subject, constituted an excessive and disproportionate measure in relation to the stated purpose, in this case, ensuring the security of property.

In this respect, the personal data controller was issued with a report on the infringement under Article 741 para. (1) of the Contravention Code.

4.      Surveillance activity

In accordance with the provisions of the Law No 175 of 11 November 2021 on the amendment of certain regulatory acts, which entered into force on 10 January 2022, the obligation to designate the data protection officer has been established.

In this regard, the NCPDP has received more than twenty letters informing it about the designation of data protection officer from the entities concerned. At the same time, the NCPDP has intervened, where appropriate, with recommendations in order to remove the discrepancies identified.

At the same time, a number of communications were drafted and posted on the NCPDP website concerning: changes in the legislation in the field of personal data protection; the need to designate the data protection officer; the obligation for data controllers to post this information on the website and the obligation for data controllers to carry out a data protection impact assessment, etc.

During the reporting period, the NCPDP has prepared and published in the Official Gazette and on the NCPDP website the List of States ensuring an adequate level of personal data protection, in the context of the amendments to Article 32 of the Law No. 133 on personal data protection.

Furthermore, a list of the types of processing operations subject to the requirement to carry out a data protection impact assessment has been drawn up and will be published on the NCCDP website.

In addition, the NCPDP intends to publish guidance on personal data protection impact assessment for recommendation purposes.

In order to provide methodological and advisory support to personal data controllers and/or processors, more than 391 telephone consultations and 34 responses via e-mail were provided.

5.      International and European news

–       On January 18, took place the 59th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on the Right of Access. The Guidelines aim to analyse the various aspects of the right of access and to provide more precise guidance on how the right of access has to be implemented in different situations.

·        A letter in reply to letters calling for a consistent interpretation of cookie consent.

·        The updated Guidelines on consent. The guidelines aim to ensure a harmonized approach on the conditionality of consent and on the unambiguous indication of wishes.

–       On February 22, took place the 61st Plenary Session of the European Data Protection Board, which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·        The EDPB adopted a letter in reply to the European Parliament’s Civil Liberties, Justice and Home Affairs Committee (LIBE) regarding the Second Additional Protocol to the Cybercrime Convention, and in view of the two European Commission Proposals for Council Decisions authorising Member States to sign and ratify the Protocol.

·        Following public consultation, the EDPB adopted a final version of the Guidelines on Codes of Conduct as a tool for transfers, taking into consideration the feedback received from stakeholders. The main purpose of the guidelines is to clarify the application of articles 40 (3) and 46 (2) (e) GDPR.

·        The EDPB adopted a letter on Artificial Intelligence liability.

–       On March 14, took place the 62nd Plenary Session of the European Data Protection Board, which was held on-line. During the Plenary, the EDPB adopted several documents, among which:During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Art. 60 GDPR. The drafting of such guidance is part of the EDPB Strategy and Work Programme 2021-2022 to support effective enforcement and efficient cooperation between national supervisory authorities.

·        Guidelines on dark patterns in social media platform interfaces. The guidelines offer practical recommendations to designers and users of social media platforms on how to assess and avoid so-called “dark patterns” in social media interfaces that infringe on GDPR requirements.

·        A toolbox on essential data protection safeguards for enforcement cooperation between EEA and third country SAs. This contributes to one of the key actions of the EDPB Strategy and Work Programme 2021-2022 and aims to facilitate the engagement between EDPB members and the SAs of third countries. The toolbox covers key topics, such as enforceable rights of data subjects, compliance with data protection principles and judicial redress.

·        A joint EDPB-EDPS opinion on the proposals to extend the Digital COVID Certificate by up to 12 months. The subject will continue to be discussed at the next Plenary Session.

–       On March 23-25, took place the 55th meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online. During the Meeting, several topics were discussed, among which:

·        Convention 108+ State of play, ratifications and accessions;

·        Evaluation and follow up mechanism under Convention 108+;

·        Digital identity;

·        Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·        Contractual clauses in the context of transborder data flows;

·        Cooperation with other bodies and entities of the Council of Europe.

6.      Other data protection authorities

·        On January 28, Hellenic Data Protection Authority (DPA) applied a total fine in the amount of EUR 9 250 000 to telecommunications companies COSMOTE and OTE S.A. due to personal data breach and illegal data processing. The investigation of the case revealed that COSMOTE had infringed the principles of legality and transparency due to the provision of unclear and insufficient information to subscribers. The company was also found responsible for poor data protection impact assessment, poor anonymisation, inadequate security measures taken, and failure to allocate the roles of the two companies (COSMOTE / OTE) in relation to the processing in question. In addition, ΟΤΕ S.A. was found to have infringed Article 32 of the GDPR due to inadequate security measures taken in relation to the infrastructure used in the context of the breach. The Hellenic DPA, on the one hand, fined COSMOTE a total of EUR 6 000 000, and imposed the sanction of stopping the processing and destroying the data, and, on the other, fined OTE S.A. a total of EUR 3 250 000.

·        On February 10, the Italian Data Protection Authority (SA) applied a fine in the amount of EUR 20 million to Clearview AI for illegal personal data processing. Following the investigation, launched an own volition proceeding, the Italian SA found that the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis. Furthermore, the company infringed several fundamental principles of the GDPR, such as transparency, purpose limitation, and storage limitation. In this context, Italian SA imposed a ban on any further collection, by way of web scraping techniques, of images and the relevant metadata concerning persons in the Italian territory and on its further processing and ordered erasure of the data, including biometric data, processed by its facial recognition system.

·        On March 15, the Irish Data Protection Authority (SA) applied a fine in the amount EUR 17 million to Meta Platforms (formerly Facebook) for the infringement of the Articles 5(2) and 24(1) GDPR.  Following the investigations, Irish SA found that Meta Platforms failed to have in place appropriate technical and organisational measures such as would enable it to readily demonstrate the security measures that it implemented in practice to protect EU users’ data, in the context of the twelve personal data breaches.

1. Information activities performed by NCPDP

In the reference period, NCPDP registered a remarkable evolution in terms of training and awareness activities. The series of trainings organized for the representatives of the local public authorities (LPA) from the districts of the Republic of Moldova was continued, with the aim of strengthening the capacities of LPA representatives throw familiarizing, raising awareness and informing them with the field of personal data protection. The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; approval of security policy and personal data filling systems instructions, etc. Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry. The events, moderated by national experts in the field of personal data protection within NCPDP, were organized for about 50 mayors, district councilors and secretaries of local councils from each district center based on the protection measures imposed in the context of the COVID pandemic – 19. The training courses were conducted:

·         On October 7 – within Căușeni District Council;

·         On November 5 – within Râșcani District Council;

·         On November 11 – within Fălești District Council;

·         On November 19 – within Briceni District Council;

·         On November 26 – within Glodeni District Council;

·         On December 3 – within Cahul District Council.

Furthermore, on November 19, was held the Public Action – “Protect personal data”, organized by NCPDP representatives. The target audience – the inhabitants of Ialoveni district, were informed about the importance of personal data protection. The action took place near Ialoveni District Council and the citizens were informed about the notion of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. The purpose of this action was to educate, motivate and encourage the citizens of the Republic of Moldova to pay more attention to the protection of their personal data.

2.  Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 55 investigations. Of the 55 investigations: 5 investigation procedures were initiated following the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data; from 41 finalized cases, in 19 cases the violation of the legal provisions was found. Furthermore, 22 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. Findings of the NCPDP

3.1 The NCPDP received the complaint of a personal data subject, regarding the alleged violation of his right of opposition, by an economic agent, manifested by ignoring the request of the data subject, submitted on the bases of art. 16 paragraph (1) of the Law on personal data protection, by which the latter requested the deletion of personal data concerning him, stored in the company’s database and the cessation of sending commercial messages on his telephone number. Following the examination of the case, it was determined that the economic agent, ignoring the request of the data subject, did not exercise his right of opposition, a fact recognized by the personal data controller as an omission.

In this case, the NCPDP found a violation of the provisions of art. 16 para. (1) of the Law on personal data protection no. 133/2011, being started a contravention process regarding the economic agent provided by art. 74 1 para. (3) Contravention Code.

3.2 Furthermore, NCPDP issued a decision regarding the establishment of the non-compliant processing of personal data by the mayor of a locality. The non-compliant processing of personal data of the data subject who notified the National Authority for personal data protection, was materialized by multiple accesses by the mayor of the locality, the data contained in the Real Estate Register, without having a purpose and legal basis, as well as in the absence of the data subject’s consent.

At the same time, during the examination of the audit of personal data accesses by the mayor, NCPDP found that the mayor made 134 personal data accesses, from 10 different IP addresses, of which multiple accesses were made outside the work schedule and on weekends.

Thus, following the control of those notified, was found the violation of art. 4, art. 5 and art. 29 of the Law 133/2011 on personal data protection.

Therefore, from the content of the related circumstances, it results the fact of the existence in the actions / inactions of the mayor of the contravention provided by art. 741 para. (4) Contravention Code.

3.3 On December 22, the Supreme Court of Justice rejected the appeal of the Ministry of Internal Affairs and upheld the decision of the NCPDP of November 16, 2018, which found the processing of personal data through the Automated Information System “Register of forensic and criminological information” inconsistent with the requirements of legislation in the field of personal data protection.

The NCPDP decision addresses the need to delete information that was collected / obtained from unrecognized authorities / institutions in the Transnistrian region during the years 1991-2005. It should be emphasized that the automatic processing of personal data of the Republic of Moldova’s citizens based on information received from unconstitutional structures, which in fact cannot be considered authentic / truthful, as well as its use to the detriment of the data subject concerned, is a serious violation of human rights and freedoms. In this sense, the Decision of the Superior Council of Magistracy (SCM) no. 209/14 of April 10, 2012 “on the approach of Mr. Oleg Efrim, Minister of Justice, regarding the opinion on the address f Mr. Eugen Carpov, Deputy Prime Minister, on approaching some legal issues”, by which the SCM found: “that any act issued by the self-proclaimed authorities of the Republic of Moldova contravenes the Constitution and are considered illegal. This fact refers equally to any decisions, sentences handed down by the courts established in the region. Thus, the Council considers as unacceptable any collaborations, legal cooperation and proposals for legal solutions with the structures from the Transnistrian region “.

Consequently, in the jurisprudence concerning the Republic of Moldova, the European Court of Human Rights in numerous cases (Ilascu and others vs. Moldova and Russia; Eriomenco against Republic of Moldova and the Russian Federation; Mozer against Republic of Moldova and Russian Federation; Catan and others against Republic of Moldova and Russia) found acts adopted by unrecognized and unconstitutional entities on the left bank of the Dniester as illegal. It should be specified that, according to the Declarations submitted together with the instrument of ratification of Convention no. 108 for the protection of individuals with regard to the automated processing of personal data, the Republic of Moldova has not declared reservations on the provisions of the Convention, regarding its application on the territory of the Transnistrian region. Thus, the Republic of Moldova has the obligation to ensure the protection of the fundamental rights and freedoms of its citizens with regard to the processing of personal data, especially the right to inviolability of privacy, family and private life, throughout its territory.

4. Surveillance activity

During the reference period, arising from the impossibility, for technical reasons to issue and sign automated decisions through the Register of evidence of personal data controllers, NCPDP sent 204 information letters in order to comply with the provisions of Art. 23-25 ​​of Law no. 133 on personal data protection.

At the same time, in accordance with the provisions of Law no. 175 of November 11, 2021 for the amendment of some normative acts, which will enter into force on January 10, 2022, it is excluded the obligation of personal data controllers to notify the National Center for Personal Data Protection and it is repealed art. 28 of Law no. 133 of 08.07.2011 on personal data protection, which determines the liquidation of Register of evidence of personal data controllers, by the irreversible destruction of documents and information stored on paper records and those stored in electronic form, under the conditions provided by law.

Furthermore, in order to provide methodological and advisory support to personal data controllers and / or processors, over 405 telephone consultations and 178 responses via e-mail were provided.

5.  International and European news

–        On October 13, took place the 56th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·         Consistency mechanism and Guidelines;

·         Guidelines on Restrictions under Art. 23 GDPR (following public consultation);

·         Guidelines on children’s data – request for mandate.

–        On November 18, took place the 57th Plenary Session of the European Data Protection Board, which was held at Brussels, Belgium.

During the Plenary, the EDPB adopted several documents, among which:

·         Guidelines on the interplay between Art. 3 and Chapter V GDPR. The Guidelines will be subject to public consultation until the end of January.

·         Statement on the European Commission’s Digital Services Package and Data Strategy.

·         Finally, the EDPB nominated two representatives from the Belgian and Hessen (DE) SA to take part in the 6th Joint Review of the EU-US Terrorist Finance Tracking Program (TFTP) Agreement.

–        On December 14, took place the 58th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·         The EDPB and the individual Supervisory Authorities (SAs) contributed to the evaluation and review of the Data Protection Law Enforcement Directive (LED), carried out by the European Commission in accordance with Art. 62 LED. The LED aims to provide a harmonised level of data protection for individuals in the area of law enforcement across the EU;

·         As part of the implementation of the EDPB 2021-2023 strategy and following the establishment of a Support Pool of Experts (SPE), the EDPB has now agreed on the SPE’s project plan;

·         The EDPB adopted a reply to MEP Ujhelyi on hacking spyware Pegasus;

·         The EDPB adopted a final version of the Guidelines on examples regarding data breach notifications. They aim to help data controllers in deciding how to handle data breaches and what factors to consider during risk assessment.

–        On December 20-21, took place the 54th meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online. During the Meeting, several topics were discussed, among which:

·         Convention 108+ State of play, ratifications and accessions;

·         Evaluation and follow up mechanism under Convention 108+;

·          Digital identity;

·         Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·         Interpretation of Article 11 of the modernised Convention 108;

·         Contractual clauses in the context of transborder data flows.

In the context of NCPDP collaboration with the European Data Protection Authorities, on November 18, the National Center for Personal Data Protection and the Office of the Information and Data Protection Commissioner of Malta signed a Collaboration Agreement in the field of personal data protection. The Agreement provides for the development of cooperation relations between the two institutions in terms of achieving constant progress in the field of personal data protection and the promotion of good practices that will create favorable conditions for ensuring effective protection of personal data of Malta’s and Moldova’s citizens.

6. Other data protection authorities

–        On October 14, Polish Data Protection Authority (UODO) impose a fine of 80,000 EUR to Bank Millennium S.A, for the infringement of Article 33(1) and Article 34(1) of GDPR. UODO learnt about the personal data breach from a complaint lodged against the bank. The complaint concerned the loss by a courier company of correspondence containing personal data, such as: name, surname, personal identification number (PESEL number), registered address, bank account numbers, identification number assigned to the bank’s customers. In the course of the case, it turned out that the controller did not notify this breach to the Supervisory Authority, and did not fully comply with the obligation to communicate it to the data subjects.

–        On November 26, Icelandic Data Protection Authority fined the Ministry of Industries and Innovation with 7,5 million ISK (approx. 50.800 Euros) and the company YAY ehf. was fined with 4 million ISK (approx. 27.100 Euros) for the infringement of Article 7, 9, 12, 13, 24, 25, 28 (3) and 32 of GDPR. Due to economic difficulties in Iceland caused by COVID-19 the Icelandic government decided, to boost the tourism sector and small businesses by issuing a digital gift certificate of 5000 ISK (approx. 34 euros) to all Icelanders over 18 years old. In the course of the case, the Icelandic DPA found the unlawful and unnecessary collection of considerable amounts of personal data, requirements for consent for processing were not met and the information the data subjects received when signing into the app was inadequate. Additionally, the controller and the processor had not ensured the appropriate security of the personal data.

–        On December 13, he Norwegian Data Protection Authority has imposed an administrative fine of 6.5 million EUR to Grindr LLC for the infringement of Article 6 and 9 of GDPR. In 2020, the Norwegian Consumer Council filed a complaint against Grindr claiming unlawful sharing of personal data with third parties for marketing purposes. The data shared was GPS location, IP address, Advertising ID, age, gender and the fact that the user in question was on Grindr. The Norwegian Data Protection Authority concluded that Grindr has disclosed user data to third parties without a legal basis. Furthermore, the information about the sharing of personal data was not properly communicated to users and this was contrary to the GDPR requirements for valid consent.

1.      Information activities performed by NCPDP

–         On February 17, 18 and 19, the National Center for Personal Data Protection trained the local authorities from the north, center and south of the Republic of Moldova. The training aimed at familiarizing the participants with video surveillance and live streaming of local councils’ meetings. The participants in the training obtained information about: how the meetings of the local councils are to be live streamed, who is responsible for their live streaming and how the information will be provided. The training took place online and was attended by 300 people.

–         At the beginning of March, the students of the Faculty of Law of Moldova State University were familiarized with the mission of the National Center for Personal Data Protection. The event took place online on the zoom platform where over 50 students were present. NCPDP employees explained to them which are the most frequently used personal data. These are first name, surname, address, telephone number, e-mail address, location data, IP address, marital status, face photo, habits and preferences, online identifiers and any other data related to physical, physiological, economic, cultural or social identity that can be used to identify directly or indirectly a natural person. Furthermore, the representatives of NCPDP spoke to students about the legislation and EU experience regarding personal data protection, ascertained cases of personal data processing, the procedures related to the registration of personal data controller and about contravention cases and the consequences of the non – compliant personal data processing.

–         On March 11, NCPDP provided a training course for 50 lawyers from the Republic of Moldova, in the field of personal data protection. The training course was performed within the Council of Europe’s HELP online meeting. The topics addressed during the event were: personal data protection and the rights of data subjects in the European Union, but also the legislation of the Republic of Moldova on personal data protection. Previously, NCPDP has addressed practical aspects aimed at the protection of personal data by lawyers, including the publishing on the website www.datepersonale.md  “Aspects regarding the practice of submitting to the materials of the files examined by the courts, the documents with personal data of natural persons, which are not covered in the examined case”. These recommendations aim to ensure the application by lawyers of adequacy principle which consists in limiting the volume of personal data relevant to the cases examined, with depersonalization of data that are excessively irrelevant to the case, according to art. 31 of Law no. 133/2011 on personal data protection.

–         On March 16, NCPDP performed a training course in the field of personal data protection for the employees of the National Insurance Company in Medicine (CNAM) at the request of the institution. The event was attended by about 100 persons. The topics addressed in the training were: the principles of personal data protection, the rights of the data subjects, the recommendations on identifying the filing systems in which the processing of personal data takes place, the regulatory framework for data protection and implementation of legal requirements in that area. Any personal data subject has the right to obtain from the controller or processor, upon request and free of charge: the rectification, update, blocking or erasure of personal data, the processing of which does not comply with the law, in particular because of their incomplete or inaccurate nature and the notification of the third parties to whom the personal data have been disclosed, about any operations performed, except where such notification proves to be impossible or involves disproportionate effort towards the legitimate interest that might be violated. The participants in the training obtained information regarding the practical application of the legislation in the field of personal data protection, including the assurance of the legality of personal data processing in the information systems managed by CNAM.

–         On March 30, the NCPDP performed a training course for the employees of the Parliament’s Secretariat of the Republic of Moldova to ensure the compliant implementation of the provisions of the legislation on personal data protection within personal data filling systems. The topics addressed in the training were: general notions on personal data protection, the principles of personal data protection, assurance the security and confidentiality of personal data within the personal data filling systems, general aspects of personal data security, simple and essential security measures and data subjects’ rights. The training course was held online at the request of Parliament’s Secretariat and was attended by 51 employees.

2.  Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 95 investigations. Of the 95 investigations: 16 investigation procedures were initiated following the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data; in 45 finalized cases, the violation of the legal provisions was found, 68 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. Findings of the National Center for Personal Data Protection

3.1. The NCPDP was notified by a data subject regarding the violation of personal data principles of the petitioner by an insurance company from the Republic of Moldova, through the envelope with window (transparent border) used in correspondence.

Following the examination of the case, it was determined that, by the non-compliant practice of entering in the header of complaints / letters an excessive volume of personal data, in relation to the stated purpose, which are subsequently disclosed through the transparent letter box used by the controller, the access of an indeterminate number of foreigners to personal data is favored, which cannot be considered a “compliant” processing within the meaning of Law no. 133/2011 on personal data protection, or the legislation on personal data protection established clear rigors regarding the implementation of appropriate and effective technical and organizational measures for the protection of personal data, to ensure the confidentiality and security of personal data.

In this case, NCPDP found a violation of the provisions of personal data protection legislation and ordered the review / adjustment of information included in the header of complaints to the requirements of Law on personal data protection no. 133/2011, namely the exclusion of excessive volume of personal data, as well as the elaboration / approval / updating of the internal instrument (regulation / instruction), in which to regulate a clear procedure regarding the keeping of secretarial works, with the description of the technical and organizational measures necessary for the protection of personal data.

3.2. Taking into account the repeated / continuous nature of the complaints / notifications addressed to NCPDP during the last period regarding the non-conformity of the publication of individual administrative acts in the State Register of Local Acts, especially the aspects without depersonalization or incorrect depersonalization of these acts, adopted the decision by which find the violation of legal provisions in the field of personal data protection. At the same time, the NCPDP ordered the State Chancellery, jointly with the local public authorities, to take the necessary measures in order to establish a mechanism for depersonalization of local documents to be placed in the Register.

3.3. NCPDP received the complaint from a data subject, regarding the verification of the lawfulness of the processing of his personal data, manifested by sending the criminal record certificate to a third party, without the consent of the data subject.

Following the examination of the case, it was determined that the operation of personal data processing, manifested by the issuance of a criminal record certificate containing personal data, to an unauthorized person, was not legally justified, being made incorrectly and contrary to the provisions of Law on personal data protection no. 133/2011.

On this case, NCPDP found a violation of the provisions of art. 4 para. (1) let. a), art. 5 para. (1), art. 6 para. (1), art. 8 para. (1), art. 29 of the Law on personal data protection no. 133/2011.

3.4. NCPDP, in the context of examining the approach of a subdivision of the Ministry of Internal Affairs of the Republic of Moldova, pursuant to art. 27 para. (4) of the Law on personal data protection no. 133/2011, notified itself in the part related to the non-conformities admitted by a collaborator of the MIA, when processing / accessing personal data, without a purpose and legal basis for accessing a data subject, through the Information System – “EDATA MAI”.

As a result of the examination of the control materials, NCPDP found the violation of the provisions of art. 4 para. (1) let. a) of the Law on personal data protection no. 133/2011, by the MIA collaborator, manifested by accessing / consulting personal data concerning the data subject.

4. Surveillance activity

During the reference period, 717 notifications were submitted for examination at the “One-Stop Shop” of the NCPDP for the registration of personal data controllers and / or managed filing systems. Following the analysis of those notification forms, 262 authorization decisions and 271 refusal decisions were issued. Thus, about 184 data controllers and 262 personal data filing systems were registered in the Register of evidence of personal data controllers.

5. International and European news

The 45th Plenary Session of the European Data Protection Board, held online, took place on February, 2. A wide range of documents were adopted at the meeting:

–     Recommendations on the adequacy referential under the Law Enforcement Directive

–     Opinion on the draft Administrative Arrangement for transfers of personal data between the Haut Conseil du Commissariat aux Comptes (H3C) and the Public Company Accounting Oversight Board (PCAOB)

–     Statement on new draft provisions of the second additional protocol to the Council of Europe Convention on Cybercrime (Budapest Convention)

–     EDPB response to the European Commission questionnaire on processing personal data for scientific research, focusing on health related research

–     Recommendations on Art. 36 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

On 10 March, a series of documents were adopted during the 46th Plenary Session of the European Data Protection Board, held online:

–     EDPB adopted its Work Programme for 2021-2022, according to Article 29 of the EDPB Rules of Procedure.

–     EDPB adopted a Statement on the draft ePrivacy Regulation.

–     EDPB adopted Guidelines 02/2021 on Virtual Voice Assistants (VVAs). These Guidelines aim to identify some of the most relevant compliance challenges for VVAs and to provide recommendations to relevant stakeholders on how to address them. The Guidelines was submitted for public consultation for a period of six weeks.

–     EDPB adopted a final version of the Guidelines 01/2021 on Connected Vehicles following public consultation. The Guidelines focus on the processing of personal data in relation to the non-professional use of connected vehicles by data subjects.

–     EDPB adopted EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance.

–     EDPB adopted, following public consultation, the Guidelines 09/2020 on relevant and reasoned objection.

–      Furthermore, the EDPB discussed the draft UK adequacy decisions, which were received from the European Commission.

On March, 30 took place the 47th Plenary Session of the European Data Protection Board, which was held online.

During the Session, The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a Joint Opinion on the Proposals for a Digital Green Certificate. The Digital Green Certificate aims to facilitate the exercise of the right to free movement within the EU during the COVID-19 pandemic by establishing a common framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, testing and recovery certificates. With this Joint Opinion, the EDPB and the EDPS invite the co-legislators to ensure that the Digital Green Certificate is in line with EU personal data protection legislation and underline that its use may not, in any way, result in direct or indirect discrimination of individuals, and must be fully in line with the fundamental principles of necessity, proportionality and effectiveness.

On March, 13 during the 48th Plenary Session of the European Data Protection Board (EDPB), which was held online were adopted several documents, among which:

–     two Opinions on the draft UK adequacy decisions (Opinion 14/2021  based on the GDPR and Opinion 15/2021 based on the Law Enforcement Directive). The EDPB notes that there are key areas of strong alignment between the EU and the UK data protection frameworks on certain core provisions such as: grounds for lawful and fair processing for legitimate purposes; purpose limitation; data quality and proportionality; data retention, security and confidentiality; transparency; special categories of data; and on automated decision making and profiling.

–     Guidelines on the application of Article 65(1)(a) GDPR to delineate the main stages of the procedure and clarify the competence of the EDPB when adopting a legally binding decision on the basis of this Article. The guidelines were subjected to public consultation for a period of six weeks.

–     Final version of the Guidelines on the targeting of social media users following public consultation. The aim of the Guidelines is to clarify the roles and responsibilities of social media providers and targeted individuals.

–     Statement on international agreements including transfers. The EDPB invites EU Member States to assess and, where necessary, review their international agreements that involve international transfers of personal data to align them with EU data protection law.

On May, 19 took place the 49th Plenary Session of the European Data Protection Board, which was held online. During the Plenary, the EDPB adopted several documents, among which:

–     Two Opinions on the first draft decisions on transnational Codes of Conduct presented by the Belgian Supervisory Authority (draft decision concerns the EU CLOUD Code of conduct, addressed to cloud service providers) and French Supervisory Authority (draft decision concerns the CISPE Code of conduct, addressed to cloud infrastructure service providers). These Codes aim to provide practical guidance and define specific requirements (Art. 28 GDPR) for processors in the EU subject to these Codes. They are not to be used in the context of international transfers of personal data. The EDPB is of the opinion that both draft codes comply with the GDPR and fulfil the requirements set forth in Art. 40 and 41 GDPR.

–     Statement on the Data Governance Act (DGA) in light of developments in the legislative process. The EDPB reiterates that, without robust data protection safeguards, there is a risk that the trust in the digital economy would not be sustainable. The statement further highlights the need to ensure consistency of the DGA with the EU data protection acquis and urges the co-legislators to carefully consider certain aspects, such as the interplay between the DGA and the GDPR, and the importance of ensuring that the new definitions and concepts are not incompatible with the GDPR.

–     Recommendations on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions. The recommendations cover situations in which data subjects buy a product or pay for a service via a website or an application and provide their credit card data in order to conclude a unique transaction. As such, consent in accordance with Art. 6 (1) (a) GPDR should be considered the sole appropriate legal basis for storing credit card data after the purchase.

On June, 18 took place the 50th Plenary Session of the European Data Protection Board, which was held online. During the Plenary, the EDPB adopted several documents, among which:

–     A final version of the Recommendations on supplementary measures following public consultation. The Recommendations were first adopted in November 2020 following the CJEU Schrems II ruling. They aim to assist controllers and processors acting as data exporters with their duty to identify and implement appropriate supplementary measures where they are needed to ensure an essentially equivalent level of protection to the data they transfer to third countries.

–     A letter addressed to EU Institutions on the privacy and data protection aspects of a possible digital euro. In the letter, the EDPB stresses that a very high standard of privacy and data protection is crucial to reinforce the trust of end users and should be considered a distinctive element in the offering of a digital euro, representing a key factor of success. The EDPB further indicates that it stands ready to provide advice to the ECB or other EU institutions.

–     Designated three representatives to the European Travel Information and Authorisation System’s (ETIAS) Fundamental Rights Guidance Board, which is tasked to evaluate the impact of the processing of applications and will play an important role in ensuring the system’s compliance with fundamental rights, in particular with regard to privacy and personal data protection.

–     A joint opinion on the European Commission’s Proposal for a Regulation laying down harmonised rules on artificial intelligence (AI).

On 24 -26 March, took place the 52nd meeting of the Bureau of the Consultative Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online.

During the Meeting, several topics were discussed, among which:

–       Convention 108+ State of play, ratifications and accessions;

–       Evaluation and follow up mechanism under Convention 108+;

–       Law enforcement transborder access to data;

–       Digital identity;

–       Personal data processing by and for political campaigns;

–       Automatic Exchange of data;

–       Cooperation with other Council of Europe bodies and entities;

–       Major developments and activities in the field of data protection.

At the same time, during the Meeting, a topic of major importance related to COVID-19 vaccination certificates was addressed. The representatives of the Committee on Bioethics (DH-BIO), as well as the representatives of the Secretariat, made a considerable contribution in this regard. In this context, will be submitted to delegations the draft Statement on “Covid-19 Vaccination, digital attestations and data protection”

6. Other data protection authorities

–     Fine in the amount of 10.4 million euros applied by State Commissioner for Data Protection in Lower Saxony, Barbara Thiel to Notebooksbilliger.de AG for monitoring its employees for at least two years with no legal justification. The video cameras were installed in the workspaces, sales floors, warehouses and staff rooms. According to the company the video cameras had been installed to prevent and investigate criminal offences and to track the flow of goods in warehouses. At the same time, many of the recordings were stored for more than 60 days, contrary to the law. The fine of 10.4 million euros is the highest penalty that has ever been imposed by the State Commissioner for Data Protection in Lower Saxony under the General Data Protection Regulation (GDPR). The GDPR enables supervisory authorities to impose fines of up to 20 million euros – or up to 4% of a company’s total annual turnover worldwide.

–     The administrative fine in the amount of 250 000 euro applied by Swedish Authority for Privacy Protection to Police Authority, for unlawfully use of application Clearview AI for facial recognition in order to identify people. The investigation carried out by Swedish Authority for Privacy Protection concluded that Clearview AI has been used by a few employees without any prior authorisation. The Police Authority has failed to implement sufficient organisational measures to ensure and be able to demonstrate that the processing of personal data in this case has been carried out in compliance with the Criminal Data Act, unlawfully processing biometric data for facial recognition as well as having failed to conduct a data protection impact assessment which this case of processing would require. Furthermore, to the fine mentioned above, Police Authority will conduct further training and education of its employees in order to avoid any future unlawfully processing of personal data.

–     Administrative fine in the amount of EUR 6.000.000 applied by Spanish Data Protection Authority (AEPD) to CAIXABANK, S.A., for unlawfully processing of clients’ personal data (4.000.000 EUR) and not providing sufficient information regarding the processing of personal data (2.000.000 EUR). The Spanish Data Protection Authority considered that CAIXABANK did not provide sufficient information regarding the categories of personal data concerned, the purposes of the processing of personal data and the lawfulness of their processing, especially regarding those processing activities based on the company’s legitimate interest. Consequently, the AEPD found a breach of the provisions of Articles 13 and 14 of GDPR, imposing a fine of EUR 2.000.000. The Spanish Data Protection Authority found that CAIXABANK did not provide any mechanism to collect the data subject’s consent and the processing activities based on the company’s legitimate interest were not sufficiently justified. The AEPD concluded that this constituted an infringement of Article 6 of the GDPR and, in accordance with Article 83 (5) a of the GDPR, an administrative fine of EUR 4.000.000 was imposed. When deciding on the amount of the administrative fine, the AEPD took into account, the nature, gravity and duration of the infringement, the relationship between the company’s activity and the processing of personal data and its turnover. In addition to the administrative fine, the highest ever imposed by the Spanish DPA, the AEPD ordered CAIXABANK to bring its processing operations into compliance with Articles 6, 13 and 14 of the GDPR within the next six months.

–     Fine in the amount of EUR 475 000 applied by Dutch Data Protection Authority (DPA) to Booking.com for delay in reporting data breach. In a telephone scam targeting 40 hotels in the United Arab Emirates (UAE) in December 2018, the criminals persuaded hotel staff to reveal the log-in details for their accounts in a Booking.com system. In this way, the criminals gained access to the data of 4 109 people who had booked a hotel room in the UAE. The data included their names, addresses and telephone numbers, as well as details of their booking. Furthermore, the criminals were able to access the credit card information of 283 people. In 97 cases, the credit card security code was obtained as well. The criminals also tried to get hold of the credit card information of other victims, by posing as Booking.com staff in emails or on the telephone. Dutch Data Protection Authority warned it was seeing an explosive increase in the number of hacks aimed at stealing personal data, which in 2020 was 30% higher than in the previous year.

–     Total fine in the amount of EUR 1 258 478 applied by Swedish Authority for Privacy Protection (IMY) to Medhelp and Voice Integrate for the recorded phone calls to the medical consultation service, 1177, which were available and unprotected on the Internet.  The cause of the incident was that a network attached storage unit had been incorrectly configured and was thereby accessible on public internet. In addition, the unit did not use encrypted communication. Consequently, a vast amount of calls became available without password protection or other security protection. The only thing that was necessary in order to get access to the files with the phone calls was to know the IP address of the storage unit. Further to the contraventions that were established, the IMY has issued an administrative sanction of 12 million SEK (1 193 813 €) towards Medhelp and an administrative sanction towards Voice Integrate of 650 000 SEK (64 665 €).

1. Information and training activities performed by NCPDP

In the period May to July 2020, the National Center for Personal Data Protection (NCPDP) organized a series of workshops and participated in several webinars related to the field of personal data protection organized for various public authorities and private entities.

At the same time, it should be mentioned that, pursuant to Decision no. 6 of National Extraordinary Commission of Public Health of the Republic of Moldova from 10.03.2020, following the evolution of the epidemiological situation at national level, in order to ensure the protection of life and health of employees and visitors of the institution, and to prevent the spread of COVID-19 virus, NCPDP, like other state institutions, had in a special work regime, thus limiting itself only to the strictly necessary activities.

·         On May 19, 2020, a working meeting was organized at the NCPDP headquarters with the participation of the high management of the Customs Service of the Republic of Moldova and the National Authority for Personal Data Protection. During the working meeting, some aspects regarding the compliance of the Customs Service of the Republic of Moldova with the provisions of the legislation in the field of personal data protection, including the notification of the video surveillance filling system and other personal data filling systems managed by the entity concerned, in particular the Integrated Customs Information System, were discussed

·          On June 4, 2020, at the invitation of the high management of the Congress of Local Authorities of Moldova (CALM), NCPDP’s representatives gave a speech in a webinar addressed to secretaries of local councils, members of Secretaries Network of CALM, on “Security policy development and the Regulation on the processing of personal data under the LPA”. The webinar was attended by about 85 secretaries of local councils.

·         On June 4, 2020, a working meeting was organized at the NCPDP’s headquarters with the participation of the high management of Î.C.S. Metro Cash & Carry Moldova S.R.L. and the National Authority for the Protection of Personal Data. During the working meeting were discussed some issues regarding the compliance of Î.C.S. Metro Cash & Carry Moldova S.R.L. with the provisions of the legislation in the field of personal data protection, including the notification of the video surveillance filling system.

·          On July 27, 2020, at the request of the Training Center in the Field of Labor Relations, the NCPDP’s representative participated as a trainer, moderating a seminar on personal data protection in which the following topics were addressed:

l) general notions of personal data;

2) registration of the employer (enterprise) as a personal data controller;

3) protection of personal data of employees.

The seminar was attended by about 90 employers and representatives of employers such as accountants, directors, lawyers, heads of departments, as well as specialists in the field of human resources.

• On July 31, 2020, NCPDP’s representatives participated at the invitation of the USAID Moldova Structural Reforms Program in online discussions with institutions in the field of personal data protection, consumer protection and competition protection. The purpose of the thematic discussions and consultations in question was to conduct a complex study of the realities of e-commerce in the Republic of Moldova, at all levels, but also to address specific recommendations for the promotion of e-commerce.

Regarding the courts, during the reference period (May 20, 2020), the Supreme Court of Justice decided irrevocably to maintain in force the decision of the NCPDP of November 16, 2018, which found the processing of personal data inconsistent with the requirements of the legislation in the field of personal data protection by the Ministry of Internal Affairs, in the Automated Information System “Register of forensic and criminological information”, the latter being obliged to destroy information containing personal data relating to the data subject covered by this processing, which were collected / obtained from unrecognized authorities / institutions from the Transnistrian region.

2. The control activity of NCPDP

During the reference period, NCPDP carried out a number of 92 investigations on data controllers, in order to verify the lawfulness conditions of personal data processing performed. Out of the 92 investigations – 12 investigation procedures were initiated as a result of the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data. Out of 92 investigations, on 38 completed cases, the violation of the legal provisions was found, 52 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. The supervision activity of NCPDP

During the reference period, 268 notifications were submitted for examination at the “One-Stop Shop” of the NCPDP for the registration of personal data controllers and / or managed filing systems. Following the analysis of those notification forms, 131 authorization decisions and 137 refusal decisions were issued. Thus, about 98 data controllers and 131 personal data filing systems were registered in the Register of evidence of personal data controllers, which indicates an increased interest of data controllers to comply with the rules established by Law no. 133 of July 8, 2011 on  personal data protection, compared to the previous period.

4. European and international news

 In the period May to July, 2020, several plenary sessions of the European Data Protection Board were held. The meetings took place remotely, each of them addressing one or two topics. Among the most important are: the 25th and 26th plenary sessions, which focused on the EDPS letter on the Polish presidential election by postal vote and the decrees of the Hungarian government on coronavirus during the state of emergency. The 28th plenary session, which discussed topics such as: the letter from Amazon to the President of the EDPB on the COVID-19 project, the processing of personal data for the purpose of reopening EU borders in the context of COVID-19, the website of the EDPB – the publicly available summaries of art. 60.  The 34th meeting, which discussed: Decision SCHREMS II of the European Court of Justice, Decision of the French Council of State on the guidelines on CNIL cookies, Decision of the French Council of State on the sanction of Google. GOOGLE / FITBIT merger, transparency of EDPB minutes.

5. Other data protection authorities

During the above-mentioned period, several European data protection authorities carried out investigations which led to the imposition of administrative fines on data controllers in various sectors of activity. Regarding this aspect, the following should be mentioned:

–          an administrative fine of 120 000 Swedish kronor (approx. 11 000 euro) against the Healthcare Committee in Region Örebro County is imposed by the Swedish Data Protection Authority for wrong publishing on the region’s website sensitive personal data about a patient admitted to a forensic psychiatric clinic.

–          a fine of 50 000 Danish kroner against the Danish recruitment company JobTeam has been proposed by the Danish Data Protection Authority for not metting the basic requirements of the General Data Protection Regulation (GDPR) that personal data must be processed lawfully, fairly and transparently.

–          an administrative fine of 72 000 EUR on Taksi Helsinki is imposed by the Finnish Data Protection Authority for processing the personal data of drivers, staff and the customers of its drivers with a camera surveillance system that records both video and audio, that was not in line with the GDPR’s principle of data minimisation.

–          a fine of 5 000 EUR on a candidate in local elections is imposed by the Litigation Chamber of the Belgian Data Protection Authority for using the staff registry of a municipality to send election propaganda (in the form of a letter) to staff members.

–          a fine of 10 000 EUR on a controller is imposed by the Belgian Data Protection Authority for sending a direct marketing message to the wrong person and for not responding adequately to the data subject’s subsequent request for access to his data.

–          a fine of 800 000 EUR on a Dutch organization is imposed by the Netherlands Data Protection Authority for failing to comply with the right of access of data subject. Specifically, the entity in question charged an annual amount for accessing that data online, and if they wanted to receive that information by mail, applicants could obtain it free of charge, but only once a year.

–          a fine of 600 000 EUR on Google Belgium is imposed by the Belgian Data Protection Authority for not respecting the right to be forgotten of a Belgian citizen, and for lack of transparency in its request form to delist.