1. Information and training activities carried out by the NCPDP
   

   On 10 July 2022, the National Centre for Personal Data Protection (NCPDP) celebrated 14 years of activity. On this occasion, the NCPDP organized several activities related to data protection field. Amongst the activities was the street information activity organised on 11 July under the title: “14 years since the founding of the NCPDP”. The aim of the action was to disseminate useful information on the field of personal data protection to passers-by, to inform and encourage Moldovan citizens to pay more attention to this field.

   At the same time, during the reporting period, the NCPDP continued the training process for the representatives of local public authorities (LPAs) and central public authorities (CPAs) in the field of personal data protection. The aim of the training courses was to familiarise, raise awareness and inform the representatives of the authorities with the latest data protection issues. The main topics covered referred to: general notions of personal data, legal grounds for personal data processing, processing of special categories of personal data, filming and online transmission of local council meetings, depersonalisation of data in the State Register of Local Acts, designation of the personal data officer, specifics of the function and tasks of the data protection officer. Thus, training courses were organised for the following authorities:

   –         On 15 July – Nisporeni District Council;

   –         On 20 July – Directorate-General for Education, Youth and Sport (DGEYS)

   –         On 4 August – Strășeni District Council;

   –         On 19 August – Hîncești District Council;

   –         On 2 September – Anenii Noi District Council;

   –         On 22 September – Leova District Council.

   In this regard, in the third quarter of this year, the trainers of the NCPDP trained about 197 representatives from the above-mentioned LPAs and 64 representatives from DGEYS.

   Also, during the same period, the NCPDP has developed a list of Recommendations for video surveillance installation service providers to provide advice to end-users when installing video surveillance systems. The recommendations are available on the official website of the institution and can be consulted at the Data Controller section, sub-component CNPDCP Recommendations.

2. Control activity 

   In the period July-September of this year, the NCPDP initiated compliance checks on the processing of personal data in 53 cases and 54 decisions were issued, of which 33 cases were found to be in breach of the law. At the same time, during the same period, the NCPDP concluded 30 minutes of infringement proceedings, which were subsequently submitted to the court for resolution. 

3. Findings of the National Centre for Personal Data Protection
   

   I. The NCPDP examined the complaint of a personal data subject who alleged that personal data stored in the Real Estate Register were processed in a non-compliant manner by a local public administration.

      As a result of the complaint’s resolution, the NCPDP found that the local public administration did not take appropriate action regarding the organisational and technical measures necessary for the protection of personal data, contrary to the provisions of Article 4 para. (1) letter a), Art. 29 para. (1), Art. 30 para. (1) of Law no. 133/2011, not ensuring the confidentiality and security of personal data in relation to the risks presented by the processing and the nature/nature of the data processed within the Database of the of the real estate register, without monitoring and implementing compliance with the provisions of the agreement for the provision of information access services.

   Consequently, it should be revealed that the local public authority mentioned above was ordered by Decision:

   ·      – Review the access rights of the users to the Real Estate Cadastre Database, after the change of status of the user/s (resignation, dismissal, detachment, etc.) by updating the list of users with access rights to the information, according to the agreement for providing information access services;

   ·      – Informing the P.I. “Public Services Agency” about the change of users, in order to revoke the identification/authentication codes of the authorized user within the public authority, as well as to block access to the information in the Real Estate Cadastre Database;

   ·       Establishment of a mechanism for authorised users to keep manual and/or electronic records of access/consultation of personal data through the Real Estate Cadastre Database, by recording the exact date and time of processing of personal data, justification of the purpose, basis and necessity of the operation performed, specification of the record system from which they were processed, categories of data processed;

   ·      – Informing/instructing the staff of the subordinate subdivision that unauthorised access/use of information from the Real Estate Cadastre Database and other information systems is not allowed.

   II. The NCPDP has examined the complaint of two personal data subjects concerning the alleged non-compliant processing of personal data by a local public administration stored in the Real Estate Register.  

   During the investigation it was found that the operations of accessing the real estate, which belonged by right of ownership to the data subjects, was carried out from the user account created in the name of a former employee of the local public administration, who had not worked in the entity for 3 years, and the account was used by an undetermined number of employees of the local public administration concerned.

             In this context, the decision of the NCPDP found that the operation of accessing the personal data of the data subjects was carried out in violation of Article 4 para. (1) (a), (b) and Art. 5, Art. 29 para. (1), Art. 30 para. (1) of Law 133/2011 on the protection of personal data, by the local public administration, in the absence of a determined, explicit and legitimate purpose, exclusively in the conditions that the access took place on a day officially declared not working.

   III. The other case, following the checks carried out, the NCPDP found a violation of a data subject’s right of access to personal data by a public authority.

   In fact, the circumstances that served as a reason for initiating the verification of the conformity of personal data processing operations was the complaint filed by a data subject who expressed his disagreement with the response provided by a subdivision of the Ministry of Internal Affairs (MAI), by not providing comprehensive information on the personal data concerning him, processed within the Automated Information System “Register of Forensic and Criminological Information”, an action that the complainant considered to be contrary to the provisions of Article 13 para. (1) of Law 133/2011 on the protection of personal data.

      As a result of the examination of the complaint, the NCPDP found a violation of Article 13 para. (1) of Law 133/2011 on the protection of personal data, ordering, by decision, that the Ministry of Internal Affairs shall take the actions required to ensure the realization of the right of access to personal data for data subjects, including the data processed in the Automated Information System “Register of forensic and criminological information”, without admitting confusion regarding the free nature in the realization of the right of access of any data subject, recognized and guaranteed by Art. 13 para. (1) of Law No 133/2011 on the protection of personal data.

4. Supervisory activity
   

   In accordance with the provisions of Law No. 175/2021 on the amendment of certain normative acts, which entered into force on 10 January 2022, the obligation to designate the personal data officer has been established. Thus, during the reference period, the NCPDP received 49 letters, through which it is informed about the designation of the personal data officer from the entities concerned, mainly from private entities.

   In order to provide methodological and advisory support to personal data controllers and/or processors, more than 195 telephone consultations and 26 responses via e-mail were provided and recommendations were proposed to address discrepancies identified by the data controller.

5. International and European news
   

   –      During the reporting period, a Cooperation Agreement in the field of personal data protection was signed between the National Centre for Personal Data Protection (NCPDP) and the Data Protection Office of the Republic of Poland.

   –      On 12 July, the 67th plenary meeting of the European Data Protection Board (EDPB) took place online.

   •  During the plenary session, EDPB and the European Data Protection Supervisor (EDPS) have adopted their Joint Opinion on the European Commission’s Proposal for the European Health Data Space (EHDS). The Proposal aims to facilitate the creation of a European Health Union and to enable the EU to make full use of the potential offered by a safe and secure exchange, use and reuse of health data. The EDPB and EDPS acknowledge that the infrastructure for the exchange of electronic health data foreseen in this EHDS Proposal aims at facilitating the exchange of health data. However, due to the large quantity of electronic health data that would be processed, their highly sensitive nature, the risk of unlawful access and the necessity to fully ensure effective supervision by independent data protection authorities, the EDPB and the EDPS call on the European Parliament and, on the Council, to add to the Proposal a requirement to store the electronic health data in the EEA, without prejudice to further transfers in compliance with Chapter V of the GDPR.

   –      On 28 July, the 68th plenary meeting of the European Data Protection Board took place online. During the meeting a number of documents were discussed and adopted, which will be a recommendation for data protection authorities, namely:

   • EDPB and EDPS adopted a Joint Opinion on the Proposal for a Regulation to prevent and combat child sexual abuse. The Proposal aims to impose obligations related to detecting, reporting, removing and blocking known and new online child sexual abuse material, as well as the solicitation of children, on providers of hosting services, interpersonal communication services, software application stores, internet access services and other relevant services. The EDPB and EDPS consider child sexual abuse as a particularly serious and heinous crime. Limitations to the rights to private life and data protection must, however, respect the essence of these fundamental rights and remain limited to what is strictly necessary and proportionate

   • Two letters in response to Access Now and BEUC concerning TikTok. In these letters, the EDPB highlights the swift action taken by the Irish, Italian and Spanish Supervisory Authorities (SAs) following TikTok’s announcement that it would no longer seek users’ consent to send personalised advertisements, but that the legal basis for this would be the legitimate interest of TikTok and its partners.

   • A dispute resolution decision on the basis of Art. 65 GDPR. The binding decision seeks to address the lack of consensus on certain aspects of a draft decision issued by the Irish SA as lead supervisory authority regarding Instagram (Meta Platforms Ireland Limited (Meta IE)) and the subsequent objections expressed by some of the concerned supervisory authorities.

   –  On 12-13 September, the 69th Plenary Session of the European Data Protection Board took place in Brussels, Belgium. During the Plenary, the EDPS adopted several documents, including:

   • A Statement on the European Commission’s proposal for an EU Police Cooperation Code. This proposal aims to enhance law enforcement cooperation across Member States, in particular the information exchange between the competent authorities. The code is comprised of three main measures: proposal for a Prüm II Regulation, proposal for a Police Information Exchange Directive and the proposal for a Council Recommendation on operational police cooperation.

   • EDPB decided upon the topic for its second coordinated enforcement action, which will concern the designation and position of the data protection officer. In a coordinated action, the EDPB prioritises a certain topic for data protection authorities to work on at the national level. The results of these national actions are then bundled and analysed, generating deeper insight into the topic and allowing for targeted follow-up on both the national and the EU level.

6. Other data protection authorities
   

   –   On 7 July, the French Data Protection Authority (DPA) issued a fine of 175 000 euros to UBEEQO International for illegally processing of personal data. This case is part of the priority control theme in 2020 relating to the new uses of geolocation data in the context of mobility. In this context, the French DPA controlled the company UBEEQO International, whose activity is the rental of vehicles for a short period. The investigations focused in particular on the data collected, the defined retention periods, the information provided to individuals and the security measures implemented. Following the investigations, French DPA found several violations, such as:

   ·  Failure to comply with the obligation to ensure data minimisation (Article 5.1.c of the GDPR).

   ·  Failure to define and respect a proportionate data retention period (Article 5.1.e of the GDPR).

   ·  Failure to inform individuals (Article 12 of the GDPR).

   –   On 19 July, the Hellenic Data Protection Authority (DPA) issued a fine of 20 000 euros to the Debt Management Company for unlawful processing of personal data and failure to consider the rights of objection and erasure. Following the investigation, the Hellenic DPA found that in this particular case, the respondent company unjustifiably prevented the exercise of the complainant’s rights in violation of the provisions stipulated in Article 12(2) of the GDPR and that the processing in question took place without a lawful basis, given that there was already a judicial relief from the complainant’s debts in violation of the provisions of Articles 5(1)(a), 5(2) and (6) of GDPR.

   –   On 8 September, the French Data Protection Authority (CNIL) issued a fine of 250 000 euros to INFOGREFFE for the infringement of Article 5.1.e and Article 32 of the GDPR. Following a complaint, CNIL, carried out an online investigation of the infogreffe.fr website, which allows users to consult legal information on companies and order documents certified by the commercial court registries. The investigations focused in particular on the data retention periods defined and the security measures implemented by the economic interest group INFOGREFFE, which provides the legal information publishing service on companies via the website. Following the investigation was found:

   ·  Failure to comply with the obligation to keep data for a period of time proportionate to the purpose of the processing (Article 5.1.e of the GDPR);

   ·  Failure to comply with the obligation to ensure the security of personal data (Article 32 of the GDPR).

    

1.    Information and training activities carried out by the NCPDP

      During the second quarter of 2022, the National Center for Personal Data Protection (NCPDP), has made progress in the part related to training activities for representatives of local public authorities (LPAs) and central public authorities (CPAs). Thus, the training courses aimed at strengthening the capacities of representatives by familiarizing, raising awareness and informing them with the field of personal data protection. The most important topics covered were, as appropriate: general notions of personal data; processing of categories of personal data; legal grounds for personal data processing; filming and online transmission of local council meetings; depersonalisation of data in the State Register of Local Acts; the personal data protection officer; data protection impact assessment and prior consultation; designation of the function and tasks of the data protection officer. Training courses were conducted for the following institutions/authorities:

– 8 April – Balti Municipal Council;

– 19 April – Rezina District Council;

– 06 May –  Floresti District Council;

– 20 May – Sîngerei District Council;

– June 3 – Ungheni District Council;

– 17 June – Calarasi District Council.

   In this regard, the NCPDP has trained about 215 LPA representatives from the above-mentioned regions.

      Regarding training for representatives of LPAs, the NCPDP organised trainings for about 1310 representatives of: Customs Service; State Tax Service; National Agency for Food Safety and Secretariat of the Parliament of the Republic of Moldova.

     On 15 April this year, the NCPDP launched an information and awareness campaign for school communities entitled: “Personal data protection and children’s safety online”. The first training course was organized at Lyceum “Onisifor Ghibu” in Chisinau, the target audience being 4th grade pupils. The aim of the campaign is to provide the school community with high visibility on personal data protection and child safety online at local and national level by promoting empowerment and best practices for intervention and support.  Subsequently, two more training sessions were held within the school community on 6 May.

  The topics covered in the trainings were: general notions on personal data; correct use of photos/videos online; risks and threats online; communication on social networks.

       Also, during the same period, the NCPDP signed two Collaboration Agreements with the “Academy of Public Administration” and the “National Association of ICT Companies”.

2. Control activity

     In the period April-June 2022, the NCPDP stared the verification of compliance of personal data processing operations on 76 cases and 50 decisions were issued, of which 32 cases were found to be in breach of legal provisions. At the same time, 34 infringement reports were concluded and subsequently submitted to the court for resolution. Similarly, during the same period, 37 contraventions were found.

3.    Findings of the National Centre for Personal Data Protection

I.     Processing of personal data without legal basis, manifested by accessing data through the Real Estate Register and violation of the personal data subject’s right of access to personal data.

       The NCPDP, in the context of the examination of a petition filed by a data subject, issued a decision finding a violation of Article 4 para. (1) (a) and (b), Art. 5 para. (1) and Art. 13 para. (1) of the Law no. 133/2011 on personal data protection by a real estate company, in the processing of personal data of the petitioner, manifested both by accessing the personal data of the data subject, stored in the Teal Estate Register, and ignoring the request of the data subject, whereby the latter requested information on the reasons, the purpose for processing personal data concerning him, realizing his right of access to personal data.

       Thus, following the examination of the case, it was determined that the personal data controller processed the personal data of the data subject, stored in the Real Estate Register, without a legal basis and without the consent of the personal data subject, and it was found that the real estate company violated the provisions of Article 4 para. (1) (a) and (b) and Art. 5 para. (1) of Law no. 133 of 08.07.2011 on the protection of personal data.

       Moreover, the real estate company ignored the data subject’s request, failing to grant him the right of access to personal data concerning the data subject provided for by Article 13 para. (1) of the personal data protection Law.

II.   Breach of the rules on processing and storage of personal data.

       The NCPDP was notified by a personal data subject that a data controller, without the consent of the data subject, makes payments on behalf of the data subject to the bank account of the legal entity, thus processing personal data – name, surname, state identification number.

       Throughout the investigation it was found that an employee of a bank, during the year 2021, used a template of a cash collection order in favor of a legal entity, but with a member of the cooperative as the payer. In the mentioned orders the employee only changed the amount and the corresponding date, but omitted to change the data/information of the payer, although at the conclusion of the transaction the latter verified the identity of the administrator of the cooperative without him providing a copy of the identity card of the data subject.

       We note that, according to Art. 4 para. (1) of Law no. 133 of 08.07.2011 on the personal data protection, personal data subject to processing must be: a) processed fairly and lawfully; b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. […]. According to Art. 5 of the same normative act, the processing of personal data is carried out with the consent of the subject of the personal data, except in the cases exhaustively stated in para. (5) of the same article. According to Article 9 of the aforementioned normative act, the processing of the State identification number (IDNP) of the natural person, […] or other personal data having an identification function of general applicability may be carried out under the following conditions: a) the subject of the personal data has given his consent; b) the processing is expressly provided for by law.

        In this context, the decision found that the bank employee, during 2021, violated the provisions of Art. (1) (a) and (b), Art. 5 para. (1) and art. 9 of Law no. 133 of 08.07.2011 on the personal data protection.

       Moreover, the NCPDP has ordered by the decision of the banking institution to initiate training of employees/staff involved in the processing of personal data, in order to train them to perform their functional duties in accordance with the legislation in the field of personal data protection, as well as internal documents/regulations approved in this regard.

4. Supervisory activity

      In accordance with the provisions of Law No. 175/2021 on the amendment of certain normative acts, which entered into force on 10 January 2022, the obligation to designate the personal data officer has been established. Thus, during the reference period, the NCPDP received 24 letters, through which it is informed about the designation of the personal data officer from the entities concerned, mainly from private entities.

      At the same time, the following recommendations/opinions have been developed and posted on the official website of the NCPDP: Considerations in relation to the increasing use of video surveillance systems with audio recording functions; Practical and legal aspects in relation to the installation and management of video surveillance means.

In order to provide methodological and advisory support to personal data controllers and/or processors, more than 315 telephone consultations and 20 responses via e-mail were provided and recommendations were proposed to address discrepancies identified by the data controller.

   At the same time, the NCPDP has informed 34 public authorities and institutions about the need to designate the personal data officer.

5.      International and European news

–          The 63rd plenary meeting of the European Data Protection Board (EDPB) was held online on 6 April. During the session, several topics were discussed, including a Statement on the announcement of a new Trans-Atlantic Data Privacy Framework. The EDPB welcomes the commitments made by the U.S. to take ‘unprecedented’ measures to protect the privacy and personal data of individuals in the European Economic Area when their data are transferred to the U.S.

–          The 64th plenary meeting of the European Data Protection Board was held online on 4 May, at which was discussed the adoption of the EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act).

–          The 65th plenary meeting of the European Data Protection Board took place online on 12 May. The plenary session focused on two topics, namely:

·         They were adopted new Guidelines on the calculation of administrative fines, harmonising the methodology data protection authorities (DPAs) use. The guidelines also include harmonised ‘starting points’ for the calculation of a fine. Hereby, three elements are considered: the categorisation of infringements by nature, the seriousness of the infringement and the turnover of a business.

·         The EDPB also adopted Guidelines on the use of facial recognition technology in the area of law enforcement. The guidelines provide guidance to EU and national law makers, as well as to law enforcement authorities, on implementing and using facial recognition technology systems.

–    On May 18-20, the 30th edition of the Spring Conference of European Data Protection Supervisors took place in Cavtat, Croatia. The event was hosted by the Croatian Agency for the Protection of Personal Data, thus encouraging the participation of about 40 countries. The agenda of the event included topical issues in the field of personal data protection, such as Convention 108+, mutual assistance and global convergence, data protection in ECHR case law: latest developments. Member authorities adopted a Resolution on the need for a prompt ratification of the “Convention 108+”, the modernised version of Convention 108. The Resolution calls upon the governments of the member states of the Council of Europe, the governments of third countries to the Council of Europe, the European Union and International Organisations to speed up the signature and ratification of Convention 108+.

–          The 66th plenary meeting of the European Data Protection Board took place on 14-15 June in Brussels, Belgium. During the Plenary, the EDPB adopted several documents, among which: Guidelines on certification as a tool for transfers. The main purpose of these guidelines is to provide further clarification on the practical use of this transfer tool and will be subject to public consultation until the end of September.

6. Other data protection authorities

·         On 4 April, the Danish Supervisory Authority has reported Danske Bank to the Danish police and proposed a fine of 1.3 million EUR for the infringement of Article 5 (2) of the GDPR. During the Danish SA’s investigation, it has become clear that the bank in more than 400 systems has not been able to document whether rules have been laid down for deletion and storage of personal data, or whether manual deletion of personal data has been carried out. These systems process personal data of millions of people. 

·         On April 15, the administrative fine in the amount of 1,5 million euros applied by the French Lead Supervisory Authority (CNIL) to Dedalus Biologie for the infringement of articles 28, 29 and 32 of GDPR. Based on the elements collected during the investigations, CNIL identified three breaches. First, in the context of the migration of a software package to another tool, requested by two laboratories using the services of Dedalus Biologie, the latter extracted a larger volume of data than required. The company therefore processed data beyond the instructions given by the data controller and had failed to comply with Article 29 GDPR. Second, the company had not ensured security of personal data within the meaning of Article 32 GDPR.  Furthermore, were also established that the general conditions of sale proposed by the company Dedalus Biologie and the contracts of maintenance transmitted to the CNIL did not contain the mentions provided for in Article 28 (3) GDPR.

·         On 3 May, the Icelandic Supervisory Authority imposed a fine of € 35,000 on the municipality of Reykjavík for using the Seesaw education system, which is an American cloud-based service. Following the investigation, it was found that: the processing agreement between Reykjavík and Seesaw was insufficient, that the municipality could not demonstrate a specified, explicit and legitimate purpose for the processing in question, which was therefore considered unlawful, that the processing was neither fair nor transparent, that the principles of data minimisation and storage limitations were not implemented nor data protection by design and by default, taking into consideration the amount of data collected, the extent of their processing, the period of their storage and their accessibility, that the data protection impact assessment did not meet the minimum requirements, that the municipality did not demonstrate that it had ensured appropriate security of the personal data in question and that the data was being transferred to the United States without appropriate safeguards. The Icelandic SA furthermore concluded that all processing in the Seesaw educational system should be seized and students’ data deleted.

1.      Information activities performed by NCPDP

On January 28, the National Center for Personal Data Protection (NCPDP) in collaboration with TAIEX project experts organized the National Conference “Challenges of international data transfers from the perspective of the Convention 108+ and GDPR”. The aim of the Conference was to present information, examples of good practices and innovative solutions on raising awareness and informing the public sector about the challenges of cross-border data transfer. The workshop was conducted by personal data protection experts from Italy, Germany, Austria and the representatives of European Commission. Amongst the topics addressed by the experts were: cross-border transfers of personal data from the perspective of Convention 108+ and global trends, overview of the grounds for the cross-border transfers of personal data under the GDPR and the type of safeguards needed, challenges of cross-border data transfers from the perspective of the EU supervisory authorities, cross-border data transfers in the area of law enforcement cooperation, general information on the concept of adequacy and substantive and procedural aspects of adequacy decisions. The event was attended by about 70 representatives of the public sector.

Furthermore, on January 26, the Street Action – “Protect personal data”, organized by the representatives of the NCPDP in the context of the European Data Protection Day, was held. In this context, a few employees of the NCPDP distributed to passers-by, near the Cathedral Square, information materials, raising awareness among citizens about the concept of personal data, the rights of personal data subjects, security and confidentiality measures when processing data. At the same time, they were informed about the possible situations in which personal data are not processed in accordance with the provisions of national legislation in this field, providing them with practical guidance and recommendations that should be undertaken in such situations.

In the reference period, NCPDP registered a remarkable evolution in terms of training and awareness activities. The series of trainings organized for the representatives of the local public authorities (LPA) from the districts of the Republic of Moldova was continued, with the aim of strengthening the capacities of LPA representatives throw familiarizing, raising awareness and informing them with the field of personal data protection. The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; approval of security policy and personal data filling systems instructions, etc. Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry. The events, moderated by national experts in the field of personal data protection within NCPDP, were organized for about 50 mayors, district councilors and secretaries of local councils from each district center based on the protection measures imposed in the context of the COVID pandemic – 19. The training courses were conducted:

·        On 27 January –Ialoveni District Council;

·        On 04 February Telenești District Council;

·        On 11 February –Edineț District Council;

·        On 25 February – Drochia District Council;

·        On 11 March –Dondușeni District Council;

·        On 25 March –Soroca District Council.

2.      Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 53 investigations. Of the 53 investigations: 47 finalized cases, in 27 cases the violation of the legal provisions was found. Furthermore, 18 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3.      Findings of the NCPDP

I.                   Violation of personal data subject’s rights, the right of access to personal data, the right of intervention upon the personal data and the right to object.

The NCPDP, in the context of the examination of a complaint filed by a data subject, issued a decision finding a violation of Article 13 para. (1) and art. 14 of the Law no. 133/2011 on personal data protection by an economic agent, in the processing of the complainant’s personal data, manifested by ignoring the request of the data subject, whereby the latter requested, including a response demonstrating that the data controller had deleted the personal data concerning him, thus realizing his right of intervention upon the personal data.

Thus, the personal data subject has realized his or her right of access and right of intervention upon the personal data concerning him or her by submitting a request to the personal data controller, asking for information on how to ensure the protection of customers’ personal data, what are the purposes for which these data are used, what are the guarantees that personal data are not used for personal purposes.

Following the examination of the case, it was determined that personal data controller ignored the request of the data subject, failing to grant him the right of access and the right of intervention upon the personal data concerning the data subject, provided for in Article 13 para. (1) and art. 14 of the Law on personal data protection.

In this respect, the economic agent was issued with a report on the infringement under Article 741 para. (3) of the Contravention Code.

II.               Violation of the processing and storage of personal data rules by means of a video surveillance system

NCPDP, in the framework of the examination of a complaint filed by a data subject, issued a decision finding a violation of the provisions of Article 4 para. (1) (a), (b), (c), Art. 5 para. (1) of the Law no. 133/2011, to the processing of complainant’s personal data, in connection with the collection/recording of the voice of the data subject, without his consent, by means of the video surveillance camera, installed on an electric pole, which included both the property of the video surveillance system manager and a portion of the space not belonging to the latter, without identifying the determined, explicit and legitimate purpose, the causal link between the purpose and the processed personal data of the complainant, the proportionality, fairness and consistency with the legal rules in the field of personal data protection.

Therefore, in the view of the above, the NCPDP has held that, before installing a video surveillance system, the data controller must always critically examine whether this measure is, firstly, appropriate for the achievement of the desired objective and, secondly, proportionate and necessary for its purposes, in relation to the interests or fundamental rights and freedoms of the data subject. Therefore, the audiovisual recording by the data controller in question, by means of the video surveillance camera, without the consent of the data subject, constituted an excessive and disproportionate measure in relation to the stated purpose, in this case, ensuring the security of property.

In this respect, the personal data controller was issued with a report on the infringement under Article 741 para. (1) of the Contravention Code.

4.      Surveillance activity

In accordance with the provisions of the Law No 175 of 11 November 2021 on the amendment of certain regulatory acts, which entered into force on 10 January 2022, the obligation to designate the data protection officer has been established.

In this regard, the NCPDP has received more than twenty letters informing it about the designation of data protection officer from the entities concerned. At the same time, the NCPDP has intervened, where appropriate, with recommendations in order to remove the discrepancies identified.

At the same time, a number of communications were drafted and posted on the NCPDP website concerning: changes in the legislation in the field of personal data protection; the need to designate the data protection officer; the obligation for data controllers to post this information on the website and the obligation for data controllers to carry out a data protection impact assessment, etc.

During the reporting period, the NCPDP has prepared and published in the Official Gazette and on the NCPDP website the List of States ensuring an adequate level of personal data protection, in the context of the amendments to Article 32 of the Law No. 133 on personal data protection.

Furthermore, a list of the types of processing operations subject to the requirement to carry out a data protection impact assessment has been drawn up and will be published on the NCCDP website.

In addition, the NCPDP intends to publish guidance on personal data protection impact assessment for recommendation purposes.

In order to provide methodological and advisory support to personal data controllers and/or processors, more than 391 telephone consultations and 34 responses via e-mail were provided.

5.      International and European news

–       On January 18, took place the 59th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on the Right of Access. The Guidelines aim to analyse the various aspects of the right of access and to provide more precise guidance on how the right of access has to be implemented in different situations.

·        A letter in reply to letters calling for a consistent interpretation of cookie consent.

·        The updated Guidelines on consent. The guidelines aim to ensure a harmonized approach on the conditionality of consent and on the unambiguous indication of wishes.

–       On February 22, took place the 61st Plenary Session of the European Data Protection Board, which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·        The EDPB adopted a letter in reply to the European Parliament’s Civil Liberties, Justice and Home Affairs Committee (LIBE) regarding the Second Additional Protocol to the Cybercrime Convention, and in view of the two European Commission Proposals for Council Decisions authorising Member States to sign and ratify the Protocol.

·        Following public consultation, the EDPB adopted a final version of the Guidelines on Codes of Conduct as a tool for transfers, taking into consideration the feedback received from stakeholders. The main purpose of the guidelines is to clarify the application of articles 40 (3) and 46 (2) (e) GDPR.

·        The EDPB adopted a letter on Artificial Intelligence liability.

–       On March 14, took place the 62nd Plenary Session of the European Data Protection Board, which was held on-line. During the Plenary, the EDPB adopted several documents, among which:During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Art. 60 GDPR. The drafting of such guidance is part of the EDPB Strategy and Work Programme 2021-2022 to support effective enforcement and efficient cooperation between national supervisory authorities.

·        Guidelines on dark patterns in social media platform interfaces. The guidelines offer practical recommendations to designers and users of social media platforms on how to assess and avoid so-called “dark patterns” in social media interfaces that infringe on GDPR requirements.

·        A toolbox on essential data protection safeguards for enforcement cooperation between EEA and third country SAs. This contributes to one of the key actions of the EDPB Strategy and Work Programme 2021-2022 and aims to facilitate the engagement between EDPB members and the SAs of third countries. The toolbox covers key topics, such as enforceable rights of data subjects, compliance with data protection principles and judicial redress.

·        A joint EDPB-EDPS opinion on the proposals to extend the Digital COVID Certificate by up to 12 months. The subject will continue to be discussed at the next Plenary Session.

–       On March 23-25, took place the 55th meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online. During the Meeting, several topics were discussed, among which:

·        Convention 108+ State of play, ratifications and accessions;

·        Evaluation and follow up mechanism under Convention 108+;

·        Digital identity;

·        Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·        Contractual clauses in the context of transborder data flows;

·        Cooperation with other bodies and entities of the Council of Europe.

6.      Other data protection authorities

·        On January 28, Hellenic Data Protection Authority (DPA) applied a total fine in the amount of EUR 9 250 000 to telecommunications companies COSMOTE and OTE S.A. due to personal data breach and illegal data processing. The investigation of the case revealed that COSMOTE had infringed the principles of legality and transparency due to the provision of unclear and insufficient information to subscribers. The company was also found responsible for poor data protection impact assessment, poor anonymisation, inadequate security measures taken, and failure to allocate the roles of the two companies (COSMOTE / OTE) in relation to the processing in question. In addition, ΟΤΕ S.A. was found to have infringed Article 32 of the GDPR due to inadequate security measures taken in relation to the infrastructure used in the context of the breach. The Hellenic DPA, on the one hand, fined COSMOTE a total of EUR 6 000 000, and imposed the sanction of stopping the processing and destroying the data, and, on the other, fined OTE S.A. a total of EUR 3 250 000.

·        On February 10, the Italian Data Protection Authority (SA) applied a fine in the amount of EUR 20 million to Clearview AI for illegal personal data processing. Following the investigation, launched an own volition proceeding, the Italian SA found that the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis. Furthermore, the company infringed several fundamental principles of the GDPR, such as transparency, purpose limitation, and storage limitation. In this context, Italian SA imposed a ban on any further collection, by way of web scraping techniques, of images and the relevant metadata concerning persons in the Italian territory and on its further processing and ordered erasure of the data, including biometric data, processed by its facial recognition system.

·        On March 15, the Irish Data Protection Authority (SA) applied a fine in the amount EUR 17 million to Meta Platforms (formerly Facebook) for the infringement of the Articles 5(2) and 24(1) GDPR.  Following the investigations, Irish SA found that Meta Platforms failed to have in place appropriate technical and organisational measures such as would enable it to readily demonstrate the security measures that it implemented in practice to protect EU users’ data, in the context of the twelve personal data breaches.

1. Information activities performed by NCPDP

In the reference period, NCPDP registered a remarkable evolution in terms of training and awareness activities. The series of trainings organized for the representatives of the local public authorities (LPA) from the districts of the Republic of Moldova was continued, with the aim of strengthening the capacities of LPA representatives throw familiarizing, raising awareness and informing them with the field of personal data protection. The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; approval of security policy and personal data filling systems instructions, etc. Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry. The events, moderated by national experts in the field of personal data protection within NCPDP, were organized for about 50 mayors, district councilors and secretaries of local councils from each district center based on the protection measures imposed in the context of the COVID pandemic – 19. The training courses were conducted:

·         On October 7 – within Căușeni District Council;

·         On November 5 – within Râșcani District Council;

·         On November 11 – within Fălești District Council;

·         On November 19 – within Briceni District Council;

·         On November 26 – within Glodeni District Council;

·         On December 3 – within Cahul District Council.

Furthermore, on November 19, was held the Public Action – “Protect personal data”, organized by NCPDP representatives. The target audience – the inhabitants of Ialoveni district, were informed about the importance of personal data protection. The action took place near Ialoveni District Council and the citizens were informed about the notion of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. The purpose of this action was to educate, motivate and encourage the citizens of the Republic of Moldova to pay more attention to the protection of their personal data.

2.  Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 55 investigations. Of the 55 investigations: 5 investigation procedures were initiated following the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data; from 41 finalized cases, in 19 cases the violation of the legal provisions was found. Furthermore, 22 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. Findings of the NCPDP

3.1 The NCPDP received the complaint of a personal data subject, regarding the alleged violation of his right of opposition, by an economic agent, manifested by ignoring the request of the data subject, submitted on the bases of art. 16 paragraph (1) of the Law on personal data protection, by which the latter requested the deletion of personal data concerning him, stored in the company’s database and the cessation of sending commercial messages on his telephone number. Following the examination of the case, it was determined that the economic agent, ignoring the request of the data subject, did not exercise his right of opposition, a fact recognized by the personal data controller as an omission.

In this case, the NCPDP found a violation of the provisions of art. 16 para. (1) of the Law on personal data protection no. 133/2011, being started a contravention process regarding the economic agent provided by art. 74 1 para. (3) Contravention Code.

3.2 Furthermore, NCPDP issued a decision regarding the establishment of the non-compliant processing of personal data by the mayor of a locality. The non-compliant processing of personal data of the data subject who notified the National Authority for personal data protection, was materialized by multiple accesses by the mayor of the locality, the data contained in the Real Estate Register, without having a purpose and legal basis, as well as in the absence of the data subject’s consent.

At the same time, during the examination of the audit of personal data accesses by the mayor, NCPDP found that the mayor made 134 personal data accesses, from 10 different IP addresses, of which multiple accesses were made outside the work schedule and on weekends.

Thus, following the control of those notified, was found the violation of art. 4, art. 5 and art. 29 of the Law 133/2011 on personal data protection.

Therefore, from the content of the related circumstances, it results the fact of the existence in the actions / inactions of the mayor of the contravention provided by art. 741 para. (4) Contravention Code.

3.3 On December 22, the Supreme Court of Justice rejected the appeal of the Ministry of Internal Affairs and upheld the decision of the NCPDP of November 16, 2018, which found the processing of personal data through the Automated Information System “Register of forensic and criminological information” inconsistent with the requirements of legislation in the field of personal data protection.

The NCPDP decision addresses the need to delete information that was collected / obtained from unrecognized authorities / institutions in the Transnistrian region during the years 1991-2005. It should be emphasized that the automatic processing of personal data of the Republic of Moldova’s citizens based on information received from unconstitutional structures, which in fact cannot be considered authentic / truthful, as well as its use to the detriment of the data subject concerned, is a serious violation of human rights and freedoms. In this sense, the Decision of the Superior Council of Magistracy (SCM) no. 209/14 of April 10, 2012 “on the approach of Mr. Oleg Efrim, Minister of Justice, regarding the opinion on the address f Mr. Eugen Carpov, Deputy Prime Minister, on approaching some legal issues”, by which the SCM found: “that any act issued by the self-proclaimed authorities of the Republic of Moldova contravenes the Constitution and are considered illegal. This fact refers equally to any decisions, sentences handed down by the courts established in the region. Thus, the Council considers as unacceptable any collaborations, legal cooperation and proposals for legal solutions with the structures from the Transnistrian region “.

Consequently, in the jurisprudence concerning the Republic of Moldova, the European Court of Human Rights in numerous cases (Ilascu and others vs. Moldova and Russia; Eriomenco against Republic of Moldova and the Russian Federation; Mozer against Republic of Moldova and Russian Federation; Catan and others against Republic of Moldova and Russia) found acts adopted by unrecognized and unconstitutional entities on the left bank of the Dniester as illegal. It should be specified that, according to the Declarations submitted together with the instrument of ratification of Convention no. 108 for the protection of individuals with regard to the automated processing of personal data, the Republic of Moldova has not declared reservations on the provisions of the Convention, regarding its application on the territory of the Transnistrian region. Thus, the Republic of Moldova has the obligation to ensure the protection of the fundamental rights and freedoms of its citizens with regard to the processing of personal data, especially the right to inviolability of privacy, family and private life, throughout its territory.

4. Surveillance activity

During the reference period, arising from the impossibility, for technical reasons to issue and sign automated decisions through the Register of evidence of personal data controllers, NCPDP sent 204 information letters in order to comply with the provisions of Art. 23-25 ​​of Law no. 133 on personal data protection.

At the same time, in accordance with the provisions of Law no. 175 of November 11, 2021 for the amendment of some normative acts, which will enter into force on January 10, 2022, it is excluded the obligation of personal data controllers to notify the National Center for Personal Data Protection and it is repealed art. 28 of Law no. 133 of 08.07.2011 on personal data protection, which determines the liquidation of Register of evidence of personal data controllers, by the irreversible destruction of documents and information stored on paper records and those stored in electronic form, under the conditions provided by law.

Furthermore, in order to provide methodological and advisory support to personal data controllers and / or processors, over 405 telephone consultations and 178 responses via e-mail were provided.

5.  International and European news

–        On October 13, took place the 56th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·         Consistency mechanism and Guidelines;

·         Guidelines on Restrictions under Art. 23 GDPR (following public consultation);

·         Guidelines on children’s data – request for mandate.

–        On November 18, took place the 57th Plenary Session of the European Data Protection Board, which was held at Brussels, Belgium.

During the Plenary, the EDPB adopted several documents, among which:

·         Guidelines on the interplay between Art. 3 and Chapter V GDPR. The Guidelines will be subject to public consultation until the end of January.

·         Statement on the European Commission’s Digital Services Package and Data Strategy.

·         Finally, the EDPB nominated two representatives from the Belgian and Hessen (DE) SA to take part in the 6th Joint Review of the EU-US Terrorist Finance Tracking Program (TFTP) Agreement.

–        On December 14, took place the 58th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·         The EDPB and the individual Supervisory Authorities (SAs) contributed to the evaluation and review of the Data Protection Law Enforcement Directive (LED), carried out by the European Commission in accordance with Art. 62 LED. The LED aims to provide a harmonised level of data protection for individuals in the area of law enforcement across the EU;

·         As part of the implementation of the EDPB 2021-2023 strategy and following the establishment of a Support Pool of Experts (SPE), the EDPB has now agreed on the SPE’s project plan;

·         The EDPB adopted a reply to MEP Ujhelyi on hacking spyware Pegasus;

·         The EDPB adopted a final version of the Guidelines on examples regarding data breach notifications. They aim to help data controllers in deciding how to handle data breaches and what factors to consider during risk assessment.

–        On December 20-21, took place the 54th meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online. During the Meeting, several topics were discussed, among which:

·         Convention 108+ State of play, ratifications and accessions;

·         Evaluation and follow up mechanism under Convention 108+;

·          Digital identity;

·         Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·         Interpretation of Article 11 of the modernised Convention 108;

·         Contractual clauses in the context of transborder data flows.

In the context of NCPDP collaboration with the European Data Protection Authorities, on November 18, the National Center for Personal Data Protection and the Office of the Information and Data Protection Commissioner of Malta signed a Collaboration Agreement in the field of personal data protection. The Agreement provides for the development of cooperation relations between the two institutions in terms of achieving constant progress in the field of personal data protection and the promotion of good practices that will create favorable conditions for ensuring effective protection of personal data of Malta’s and Moldova’s citizens.

6. Other data protection authorities

–        On October 14, Polish Data Protection Authority (UODO) impose a fine of 80,000 EUR to Bank Millennium S.A, for the infringement of Article 33(1) and Article 34(1) of GDPR. UODO learnt about the personal data breach from a complaint lodged against the bank. The complaint concerned the loss by a courier company of correspondence containing personal data, such as: name, surname, personal identification number (PESEL number), registered address, bank account numbers, identification number assigned to the bank’s customers. In the course of the case, it turned out that the controller did not notify this breach to the Supervisory Authority, and did not fully comply with the obligation to communicate it to the data subjects.

–        On November 26, Icelandic Data Protection Authority fined the Ministry of Industries and Innovation with 7,5 million ISK (approx. 50.800 Euros) and the company YAY ehf. was fined with 4 million ISK (approx. 27.100 Euros) for the infringement of Article 7, 9, 12, 13, 24, 25, 28 (3) and 32 of GDPR. Due to economic difficulties in Iceland caused by COVID-19 the Icelandic government decided, to boost the tourism sector and small businesses by issuing a digital gift certificate of 5000 ISK (approx. 34 euros) to all Icelanders over 18 years old. In the course of the case, the Icelandic DPA found the unlawful and unnecessary collection of considerable amounts of personal data, requirements for consent for processing were not met and the information the data subjects received when signing into the app was inadequate. Additionally, the controller and the processor had not ensured the appropriate security of the personal data.

–        On December 13, he Norwegian Data Protection Authority has imposed an administrative fine of 6.5 million EUR to Grindr LLC for the infringement of Article 6 and 9 of GDPR. In 2020, the Norwegian Consumer Council filed a complaint against Grindr claiming unlawful sharing of personal data with third parties for marketing purposes. The data shared was GPS location, IP address, Advertising ID, age, gender and the fact that the user in question was on Grindr. The Norwegian Data Protection Authority concluded that Grindr has disclosed user data to third parties without a legal basis. Furthermore, the information about the sharing of personal data was not properly communicated to users and this was contrary to the GDPR requirements for valid consent.

1.      Information activities performed by NCPDP

–         On February 17, 18 and 19, the National Center for Personal Data Protection trained the local authorities from the north, center and south of the Republic of Moldova. The training aimed at familiarizing the participants with video surveillance and live streaming of local councils’ meetings. The participants in the training obtained information about: how the meetings of the local councils are to be live streamed, who is responsible for their live streaming and how the information will be provided. The training took place online and was attended by 300 people.

–         At the beginning of March, the students of the Faculty of Law of Moldova State University were familiarized with the mission of the National Center for Personal Data Protection. The event took place online on the zoom platform where over 50 students were present. NCPDP employees explained to them which are the most frequently used personal data. These are first name, surname, address, telephone number, e-mail address, location data, IP address, marital status, face photo, habits and preferences, online identifiers and any other data related to physical, physiological, economic, cultural or social identity that can be used to identify directly or indirectly a natural person. Furthermore, the representatives of NCPDP spoke to students about the legislation and EU experience regarding personal data protection, ascertained cases of personal data processing, the procedures related to the registration of personal data controller and about contravention cases and the consequences of the non – compliant personal data processing.

–         On March 11, NCPDP provided a training course for 50 lawyers from the Republic of Moldova, in the field of personal data protection. The training course was performed within the Council of Europe’s HELP online meeting. The topics addressed during the event were: personal data protection and the rights of data subjects in the European Union, but also the legislation of the Republic of Moldova on personal data protection. Previously, NCPDP has addressed practical aspects aimed at the protection of personal data by lawyers, including the publishing on the website www.datepersonale.md  “Aspects regarding the practice of submitting to the materials of the files examined by the courts, the documents with personal data of natural persons, which are not covered in the examined case”. These recommendations aim to ensure the application by lawyers of adequacy principle which consists in limiting the volume of personal data relevant to the cases examined, with depersonalization of data that are excessively irrelevant to the case, according to art. 31 of Law no. 133/2011 on personal data protection.

–         On March 16, NCPDP performed a training course in the field of personal data protection for the employees of the National Insurance Company in Medicine (CNAM) at the request of the institution. The event was attended by about 100 persons. The topics addressed in the training were: the principles of personal data protection, the rights of the data subjects, the recommendations on identifying the filing systems in which the processing of personal data takes place, the regulatory framework for data protection and implementation of legal requirements in that area. Any personal data subject has the right to obtain from the controller or processor, upon request and free of charge: the rectification, update, blocking or erasure of personal data, the processing of which does not comply with the law, in particular because of their incomplete or inaccurate nature and the notification of the third parties to whom the personal data have been disclosed, about any operations performed, except where such notification proves to be impossible or involves disproportionate effort towards the legitimate interest that might be violated. The participants in the training obtained information regarding the practical application of the legislation in the field of personal data protection, including the assurance of the legality of personal data processing in the information systems managed by CNAM.

–         On March 30, the NCPDP performed a training course for the employees of the Parliament’s Secretariat of the Republic of Moldova to ensure the compliant implementation of the provisions of the legislation on personal data protection within personal data filling systems. The topics addressed in the training were: general notions on personal data protection, the principles of personal data protection, assurance the security and confidentiality of personal data within the personal data filling systems, general aspects of personal data security, simple and essential security measures and data subjects’ rights. The training course was held online at the request of Parliament’s Secretariat and was attended by 51 employees.

2.  Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 95 investigations. Of the 95 investigations: 16 investigation procedures were initiated following the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data; in 45 finalized cases, the violation of the legal provisions was found, 68 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. Findings of the National Center for Personal Data Protection

3.1. The NCPDP was notified by a data subject regarding the violation of personal data principles of the petitioner by an insurance company from the Republic of Moldova, through the envelope with window (transparent border) used in correspondence.

Following the examination of the case, it was determined that, by the non-compliant practice of entering in the header of complaints / letters an excessive volume of personal data, in relation to the stated purpose, which are subsequently disclosed through the transparent letter box used by the controller, the access of an indeterminate number of foreigners to personal data is favored, which cannot be considered a “compliant” processing within the meaning of Law no. 133/2011 on personal data protection, or the legislation on personal data protection established clear rigors regarding the implementation of appropriate and effective technical and organizational measures for the protection of personal data, to ensure the confidentiality and security of personal data.

In this case, NCPDP found a violation of the provisions of personal data protection legislation and ordered the review / adjustment of information included in the header of complaints to the requirements of Law on personal data protection no. 133/2011, namely the exclusion of excessive volume of personal data, as well as the elaboration / approval / updating of the internal instrument (regulation / instruction), in which to regulate a clear procedure regarding the keeping of secretarial works, with the description of the technical and organizational measures necessary for the protection of personal data.

3.2. Taking into account the repeated / continuous nature of the complaints / notifications addressed to NCPDP during the last period regarding the non-conformity of the publication of individual administrative acts in the State Register of Local Acts, especially the aspects without depersonalization or incorrect depersonalization of these acts, adopted the decision by which find the violation of legal provisions in the field of personal data protection. At the same time, the NCPDP ordered the State Chancellery, jointly with the local public authorities, to take the necessary measures in order to establish a mechanism for depersonalization of local documents to be placed in the Register.

3.3. NCPDP received the complaint from a data subject, regarding the verification of the lawfulness of the processing of his personal data, manifested by sending the criminal record certificate to a third party, without the consent of the data subject.

Following the examination of the case, it was determined that the operation of personal data processing, manifested by the issuance of a criminal record certificate containing personal data, to an unauthorized person, was not legally justified, being made incorrectly and contrary to the provisions of Law on personal data protection no. 133/2011.

On this case, NCPDP found a violation of the provisions of art. 4 para. (1) let. a), art. 5 para. (1), art. 6 para. (1), art. 8 para. (1), art. 29 of the Law on personal data protection no. 133/2011.

3.4. NCPDP, in the context of examining the approach of a subdivision of the Ministry of Internal Affairs of the Republic of Moldova, pursuant to art. 27 para. (4) of the Law on personal data protection no. 133/2011, notified itself in the part related to the non-conformities admitted by a collaborator of the MIA, when processing / accessing personal data, without a purpose and legal basis for accessing a data subject, through the Information System – “EDATA MAI”.

As a result of the examination of the control materials, NCPDP found the violation of the provisions of art. 4 para. (1) let. a) of the Law on personal data protection no. 133/2011, by the MIA collaborator, manifested by accessing / consulting personal data concerning the data subject.

4. Surveillance activity

During the reference period, 717 notifications were submitted for examination at the “One-Stop Shop” of the NCPDP for the registration of personal data controllers and / or managed filing systems. Following the analysis of those notification forms, 262 authorization decisions and 271 refusal decisions were issued. Thus, about 184 data controllers and 262 personal data filing systems were registered in the Register of evidence of personal data controllers.

5. International and European news

The 45th Plenary Session of the European Data Protection Board, held online, took place on February, 2. A wide range of documents were adopted at the meeting:

–     Recommendations on the adequacy referential under the Law Enforcement Directive

–     Opinion on the draft Administrative Arrangement for transfers of personal data between the Haut Conseil du Commissariat aux Comptes (H3C) and the Public Company Accounting Oversight Board (PCAOB)

–     Statement on new draft provisions of the second additional protocol to the Council of Europe Convention on Cybercrime (Budapest Convention)

–     EDPB response to the European Commission questionnaire on processing personal data for scientific research, focusing on health related research

–     Recommendations on Art. 36 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

On 10 March, a series of documents were adopted during the 46th Plenary Session of the European Data Protection Board, held online:

–     EDPB adopted its Work Programme for 2021-2022, according to Article 29 of the EDPB Rules of Procedure.

–     EDPB adopted a Statement on the draft ePrivacy Regulation.

–     EDPB adopted Guidelines 02/2021 on Virtual Voice Assistants (VVAs). These Guidelines aim to identify some of the most relevant compliance challenges for VVAs and to provide recommendations to relevant stakeholders on how to address them. The Guidelines was submitted for public consultation for a period of six weeks.

–     EDPB adopted a final version of the Guidelines 01/2021 on Connected Vehicles following public consultation. The Guidelines focus on the processing of personal data in relation to the non-professional use of connected vehicles by data subjects.

–     EDPB adopted EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance.

–     EDPB adopted, following public consultation, the Guidelines 09/2020 on relevant and reasoned objection.

–      Furthermore, the EDPB discussed the draft UK adequacy decisions, which were received from the European Commission.

On March, 30 took place the 47th Plenary Session of the European Data Protection Board, which was held online.

During the Session, The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a Joint Opinion on the Proposals for a Digital Green Certificate. The Digital Green Certificate aims to facilitate the exercise of the right to free movement within the EU during the COVID-19 pandemic by establishing a common framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, testing and recovery certificates. With this Joint Opinion, the EDPB and the EDPS invite the co-legislators to ensure that the Digital Green Certificate is in line with EU personal data protection legislation and underline that its use may not, in any way, result in direct or indirect discrimination of individuals, and must be fully in line with the fundamental principles of necessity, proportionality and effectiveness.

On March, 13 during the 48th Plenary Session of the European Data Protection Board (EDPB), which was held online were adopted several documents, among which:

–     two Opinions on the draft UK adequacy decisions (Opinion 14/2021  based on the GDPR and Opinion 15/2021 based on the Law Enforcement Directive). The EDPB notes that there are key areas of strong alignment between the EU and the UK data protection frameworks on certain core provisions such as: grounds for lawful and fair processing for legitimate purposes; purpose limitation; data quality and proportionality; data retention, security and confidentiality; transparency; special categories of data; and on automated decision making and profiling.

–     Guidelines on the application of Article 65(1)(a) GDPR to delineate the main stages of the procedure and clarify the competence of the EDPB when adopting a legally binding decision on the basis of this Article. The guidelines were subjected to public consultation for a period of six weeks.

–     Final version of the Guidelines on the targeting of social media users following public consultation. The aim of the Guidelines is to clarify the roles and responsibilities of social media providers and targeted individuals.

–     Statement on international agreements including transfers. The EDPB invites EU Member States to assess and, where necessary, review their international agreements that involve international transfers of personal data to align them with EU data protection law.

On May, 19 took place the 49th Plenary Session of the European Data Protection Board, which was held online. During the Plenary, the EDPB adopted several documents, among which:

–     Two Opinions on the first draft decisions on transnational Codes of Conduct presented by the Belgian Supervisory Authority (draft decision concerns the EU CLOUD Code of conduct, addressed to cloud service providers) and French Supervisory Authority (draft decision concerns the CISPE Code of conduct, addressed to cloud infrastructure service providers). These Codes aim to provide practical guidance and define specific requirements (Art. 28 GDPR) for processors in the EU subject to these Codes. They are not to be used in the context of international transfers of personal data. The EDPB is of the opinion that both draft codes comply with the GDPR and fulfil the requirements set forth in Art. 40 and 41 GDPR.

–     Statement on the Data Governance Act (DGA) in light of developments in the legislative process. The EDPB reiterates that, without robust data protection safeguards, there is a risk that the trust in the digital economy would not be sustainable. The statement further highlights the need to ensure consistency of the DGA with the EU data protection acquis and urges the co-legislators to carefully consider certain aspects, such as the interplay between the DGA and the GDPR, and the importance of ensuring that the new definitions and concepts are not incompatible with the GDPR.

–     Recommendations on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions. The recommendations cover situations in which data subjects buy a product or pay for a service via a website or an application and provide their credit card data in order to conclude a unique transaction. As such, consent in accordance with Art. 6 (1) (a) GPDR should be considered the sole appropriate legal basis for storing credit card data after the purchase.

On June, 18 took place the 50th Plenary Session of the European Data Protection Board, which was held online. During the Plenary, the EDPB adopted several documents, among which:

–     A final version of the Recommendations on supplementary measures following public consultation. The Recommendations were first adopted in November 2020 following the CJEU Schrems II ruling. They aim to assist controllers and processors acting as data exporters with their duty to identify and implement appropriate supplementary measures where they are needed to ensure an essentially equivalent level of protection to the data they transfer to third countries.

–     A letter addressed to EU Institutions on the privacy and data protection aspects of a possible digital euro. In the letter, the EDPB stresses that a very high standard of privacy and data protection is crucial to reinforce the trust of end users and should be considered a distinctive element in the offering of a digital euro, representing a key factor of success. The EDPB further indicates that it stands ready to provide advice to the ECB or other EU institutions.

–     Designated three representatives to the European Travel Information and Authorisation System’s (ETIAS) Fundamental Rights Guidance Board, which is tasked to evaluate the impact of the processing of applications and will play an important role in ensuring the system’s compliance with fundamental rights, in particular with regard to privacy and personal data protection.

–     A joint opinion on the European Commission’s Proposal for a Regulation laying down harmonised rules on artificial intelligence (AI).

On 24 -26 March, took place the 52nd meeting of the Bureau of the Consultative Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online.

During the Meeting, several topics were discussed, among which:

–       Convention 108+ State of play, ratifications and accessions;

–       Evaluation and follow up mechanism under Convention 108+;

–       Law enforcement transborder access to data;

–       Digital identity;

–       Personal data processing by and for political campaigns;

–       Automatic Exchange of data;

–       Cooperation with other Council of Europe bodies and entities;

–       Major developments and activities in the field of data protection.

At the same time, during the Meeting, a topic of major importance related to COVID-19 vaccination certificates was addressed. The representatives of the Committee on Bioethics (DH-BIO), as well as the representatives of the Secretariat, made a considerable contribution in this regard. In this context, will be submitted to delegations the draft Statement on “Covid-19 Vaccination, digital attestations and data protection”

6. Other data protection authorities

–     Fine in the amount of 10.4 million euros applied by State Commissioner for Data Protection in Lower Saxony, Barbara Thiel to Notebooksbilliger.de AG for monitoring its employees for at least two years with no legal justification. The video cameras were installed in the workspaces, sales floors, warehouses and staff rooms. According to the company the video cameras had been installed to prevent and investigate criminal offences and to track the flow of goods in warehouses. At the same time, many of the recordings were stored for more than 60 days, contrary to the law. The fine of 10.4 million euros is the highest penalty that has ever been imposed by the State Commissioner for Data Protection in Lower Saxony under the General Data Protection Regulation (GDPR). The GDPR enables supervisory authorities to impose fines of up to 20 million euros – or up to 4% of a company’s total annual turnover worldwide.

–     The administrative fine in the amount of 250 000 euro applied by Swedish Authority for Privacy Protection to Police Authority, for unlawfully use of application Clearview AI for facial recognition in order to identify people. The investigation carried out by Swedish Authority for Privacy Protection concluded that Clearview AI has been used by a few employees without any prior authorisation. The Police Authority has failed to implement sufficient organisational measures to ensure and be able to demonstrate that the processing of personal data in this case has been carried out in compliance with the Criminal Data Act, unlawfully processing biometric data for facial recognition as well as having failed to conduct a data protection impact assessment which this case of processing would require. Furthermore, to the fine mentioned above, Police Authority will conduct further training and education of its employees in order to avoid any future unlawfully processing of personal data.

–     Administrative fine in the amount of EUR 6.000.000 applied by Spanish Data Protection Authority (AEPD) to CAIXABANK, S.A., for unlawfully processing of clients’ personal data (4.000.000 EUR) and not providing sufficient information regarding the processing of personal data (2.000.000 EUR). The Spanish Data Protection Authority considered that CAIXABANK did not provide sufficient information regarding the categories of personal data concerned, the purposes of the processing of personal data and the lawfulness of their processing, especially regarding those processing activities based on the company’s legitimate interest. Consequently, the AEPD found a breach of the provisions of Articles 13 and 14 of GDPR, imposing a fine of EUR 2.000.000. The Spanish Data Protection Authority found that CAIXABANK did not provide any mechanism to collect the data subject’s consent and the processing activities based on the company’s legitimate interest were not sufficiently justified. The AEPD concluded that this constituted an infringement of Article 6 of the GDPR and, in accordance with Article 83 (5) a of the GDPR, an administrative fine of EUR 4.000.000 was imposed. When deciding on the amount of the administrative fine, the AEPD took into account, the nature, gravity and duration of the infringement, the relationship between the company’s activity and the processing of personal data and its turnover. In addition to the administrative fine, the highest ever imposed by the Spanish DPA, the AEPD ordered CAIXABANK to bring its processing operations into compliance with Articles 6, 13 and 14 of the GDPR within the next six months.

–     Fine in the amount of EUR 475 000 applied by Dutch Data Protection Authority (DPA) to Booking.com for delay in reporting data breach. In a telephone scam targeting 40 hotels in the United Arab Emirates (UAE) in December 2018, the criminals persuaded hotel staff to reveal the log-in details for their accounts in a Booking.com system. In this way, the criminals gained access to the data of 4 109 people who had booked a hotel room in the UAE. The data included their names, addresses and telephone numbers, as well as details of their booking. Furthermore, the criminals were able to access the credit card information of 283 people. In 97 cases, the credit card security code was obtained as well. The criminals also tried to get hold of the credit card information of other victims, by posing as Booking.com staff in emails or on the telephone. Dutch Data Protection Authority warned it was seeing an explosive increase in the number of hacks aimed at stealing personal data, which in 2020 was 30% higher than in the previous year.

–     Total fine in the amount of EUR 1 258 478 applied by Swedish Authority for Privacy Protection (IMY) to Medhelp and Voice Integrate for the recorded phone calls to the medical consultation service, 1177, which were available and unprotected on the Internet.  The cause of the incident was that a network attached storage unit had been incorrectly configured and was thereby accessible on public internet. In addition, the unit did not use encrypted communication. Consequently, a vast amount of calls became available without password protection or other security protection. The only thing that was necessary in order to get access to the files with the phone calls was to know the IP address of the storage unit. Further to the contraventions that were established, the IMY has issued an administrative sanction of 12 million SEK (1 193 813 €) towards Medhelp and an administrative sanction towards Voice Integrate of 650 000 SEK (64 665 €).

1. Information and training activities performed by NCPDP

In the period May to July 2020, the National Center for Personal Data Protection (NCPDP) organized a series of workshops and participated in several webinars related to the field of personal data protection organized for various public authorities and private entities.

At the same time, it should be mentioned that, pursuant to Decision no. 6 of National Extraordinary Commission of Public Health of the Republic of Moldova from 10.03.2020, following the evolution of the epidemiological situation at national level, in order to ensure the protection of life and health of employees and visitors of the institution, and to prevent the spread of COVID-19 virus, NCPDP, like other state institutions, had in a special work regime, thus limiting itself only to the strictly necessary activities.

·         On May 19, 2020, a working meeting was organized at the NCPDP headquarters with the participation of the high management of the Customs Service of the Republic of Moldova and the National Authority for Personal Data Protection. During the working meeting, some aspects regarding the compliance of the Customs Service of the Republic of Moldova with the provisions of the legislation in the field of personal data protection, including the notification of the video surveillance filling system and other personal data filling systems managed by the entity concerned, in particular the Integrated Customs Information System, were discussed

·          On June 4, 2020, at the invitation of the high management of the Congress of Local Authorities of Moldova (CALM), NCPDP’s representatives gave a speech in a webinar addressed to secretaries of local councils, members of Secretaries Network of CALM, on “Security policy development and the Regulation on the processing of personal data under the LPA”. The webinar was attended by about 85 secretaries of local councils.

·         On June 4, 2020, a working meeting was organized at the NCPDP’s headquarters with the participation of the high management of Î.C.S. Metro Cash & Carry Moldova S.R.L. and the National Authority for the Protection of Personal Data. During the working meeting were discussed some issues regarding the compliance of Î.C.S. Metro Cash & Carry Moldova S.R.L. with the provisions of the legislation in the field of personal data protection, including the notification of the video surveillance filling system.

·          On July 27, 2020, at the request of the Training Center in the Field of Labor Relations, the NCPDP’s representative participated as a trainer, moderating a seminar on personal data protection in which the following topics were addressed:

l) general notions of personal data;

2) registration of the employer (enterprise) as a personal data controller;

3) protection of personal data of employees.

The seminar was attended by about 90 employers and representatives of employers such as accountants, directors, lawyers, heads of departments, as well as specialists in the field of human resources.

• On July 31, 2020, NCPDP’s representatives participated at the invitation of the USAID Moldova Structural Reforms Program in online discussions with institutions in the field of personal data protection, consumer protection and competition protection. The purpose of the thematic discussions and consultations in question was to conduct a complex study of the realities of e-commerce in the Republic of Moldova, at all levels, but also to address specific recommendations for the promotion of e-commerce.

Regarding the courts, during the reference period (May 20, 2020), the Supreme Court of Justice decided irrevocably to maintain in force the decision of the NCPDP of November 16, 2018, which found the processing of personal data inconsistent with the requirements of the legislation in the field of personal data protection by the Ministry of Internal Affairs, in the Automated Information System “Register of forensic and criminological information”, the latter being obliged to destroy information containing personal data relating to the data subject covered by this processing, which were collected / obtained from unrecognized authorities / institutions from the Transnistrian region.

2. The control activity of NCPDP

During the reference period, NCPDP carried out a number of 92 investigations on data controllers, in order to verify the lawfulness conditions of personal data processing performed. Out of the 92 investigations – 12 investigation procedures were initiated as a result of the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data. Out of 92 investigations, on 38 completed cases, the violation of the legal provisions was found, 52 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. The supervision activity of NCPDP

During the reference period, 268 notifications were submitted for examination at the “One-Stop Shop” of the NCPDP for the registration of personal data controllers and / or managed filing systems. Following the analysis of those notification forms, 131 authorization decisions and 137 refusal decisions were issued. Thus, about 98 data controllers and 131 personal data filing systems were registered in the Register of evidence of personal data controllers, which indicates an increased interest of data controllers to comply with the rules established by Law no. 133 of July 8, 2011 on  personal data protection, compared to the previous period.

4. European and international news

 In the period May to July, 2020, several plenary sessions of the European Data Protection Board were held. The meetings took place remotely, each of them addressing one or two topics. Among the most important are: the 25th and 26th plenary sessions, which focused on the EDPS letter on the Polish presidential election by postal vote and the decrees of the Hungarian government on coronavirus during the state of emergency. The 28th plenary session, which discussed topics such as: the letter from Amazon to the President of the EDPB on the COVID-19 project, the processing of personal data for the purpose of reopening EU borders in the context of COVID-19, the website of the EDPB – the publicly available summaries of art. 60.  The 34th meeting, which discussed: Decision SCHREMS II of the European Court of Justice, Decision of the French Council of State on the guidelines on CNIL cookies, Decision of the French Council of State on the sanction of Google. GOOGLE / FITBIT merger, transparency of EDPB minutes.

5. Other data protection authorities

During the above-mentioned period, several European data protection authorities carried out investigations which led to the imposition of administrative fines on data controllers in various sectors of activity. Regarding this aspect, the following should be mentioned:

–          an administrative fine of 120 000 Swedish kronor (approx. 11 000 euro) against the Healthcare Committee in Region Örebro County is imposed by the Swedish Data Protection Authority for wrong publishing on the region’s website sensitive personal data about a patient admitted to a forensic psychiatric clinic.

–          a fine of 50 000 Danish kroner against the Danish recruitment company JobTeam has been proposed by the Danish Data Protection Authority for not metting the basic requirements of the General Data Protection Regulation (GDPR) that personal data must be processed lawfully, fairly and transparently.

–          an administrative fine of 72 000 EUR on Taksi Helsinki is imposed by the Finnish Data Protection Authority for processing the personal data of drivers, staff and the customers of its drivers with a camera surveillance system that records both video and audio, that was not in line with the GDPR’s principle of data minimisation.

–          a fine of 5 000 EUR on a candidate in local elections is imposed by the Litigation Chamber of the Belgian Data Protection Authority for using the staff registry of a municipality to send election propaganda (in the form of a letter) to staff members.

–          a fine of 10 000 EUR on a controller is imposed by the Belgian Data Protection Authority for sending a direct marketing message to the wrong person and for not responding adequately to the data subject’s subsequent request for access to his data.

–          a fine of 800 000 EUR on a Dutch organization is imposed by the Netherlands Data Protection Authority for failing to comply with the right of access of data subject. Specifically, the entity in question charged an annual amount for accessing that data online, and if they wanted to receive that information by mail, applicants could obtain it free of charge, but only once a year.

–          a fine of 600 000 EUR on Google Belgium is imposed by the Belgian Data Protection Authority for not respecting the right to be forgotten of a Belgian citizen, and for lack of transparency in its request form to delist.