1.      Information activities performed by NCPDP

On January 28, the National Center for Personal Data Protection (NCPDP) in collaboration with TAIEX project experts organized the National Conference “Challenges of international data transfers from the perspective of the Convention 108+ and GDPR”. The aim of the Conference was to present information, examples of good practices and innovative solutions on raising awareness and informing the public sector about the challenges of cross-border data transfer. The workshop was conducted by personal data protection experts from Italy, Germany, Austria and the representatives of European Commission. Amongst the topics addressed by the experts were: cross-border transfers of personal data from the perspective of Convention 108+ and global trends, overview of the grounds for the cross-border transfers of personal data under the GDPR and the type of safeguards needed, challenges of cross-border data transfers from the perspective of the EU supervisory authorities, cross-border data transfers in the area of law enforcement cooperation, general information on the concept of adequacy and substantive and procedural aspects of adequacy decisions. The event was attended by about 70 representatives of the public sector.

Furthermore, on January 26, the Street Action – “Protect personal data”, organized by the representatives of the NCPDP in the context of the European Data Protection Day, was held. In this context, a few employees of the NCPDP distributed to passers-by, near the Cathedral Square, information materials, raising awareness among citizens about the concept of personal data, the rights of personal data subjects, security and confidentiality measures when processing data. At the same time, they were informed about the possible situations in which personal data are not processed in accordance with the provisions of national legislation in this field, providing them with practical guidance and recommendations that should be undertaken in such situations.

In the reference period, NCPDP registered a remarkable evolution in terms of training and awareness activities. The series of trainings organized for the representatives of the local public authorities (LPA) from the districts of the Republic of Moldova was continued, with the aim of strengthening the capacities of LPA representatives throw familiarizing, raising awareness and informing them with the field of personal data protection. The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; approval of security policy and personal data filling systems instructions, etc. Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry. The events, moderated by national experts in the field of personal data protection within NCPDP, were organized for about 50 mayors, district councilors and secretaries of local councils from each district center based on the protection measures imposed in the context of the COVID pandemic – 19. The training courses were conducted:

·        On 27 January –Ialoveni District Council;

·        On 04 February Telenești District Council;

·        On 11 February –Edineț District Council;

·        On 25 February – Drochia District Council;

·        On 11 March –Dondușeni District Council;

·        On 25 March –Soroca District Council.

2.      Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 53 investigations. Of the 53 investigations: 47 finalized cases, in 27 cases the violation of the legal provisions was found. Furthermore, 18 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3.      Findings of the NCPDP

I.                   Violation of personal data subject’s rights, the right of access to personal data, the right of intervention upon the personal data and the right to object.

The NCPDP, in the context of the examination of a complaint filed by a data subject, issued a decision finding a violation of Article 13 para. (1) and art. 14 of the Law no. 133/2011 on personal data protection by an economic agent, in the processing of the complainant’s personal data, manifested by ignoring the request of the data subject, whereby the latter requested, including a response demonstrating that the data controller had deleted the personal data concerning him, thus realizing his right of intervention upon the personal data.

Thus, the personal data subject has realized his or her right of access and right of intervention upon the personal data concerning him or her by submitting a request to the personal data controller, asking for information on how to ensure the protection of customers’ personal data, what are the purposes for which these data are used, what are the guarantees that personal data are not used for personal purposes.

Following the examination of the case, it was determined that personal data controller ignored the request of the data subject, failing to grant him the right of access and the right of intervention upon the personal data concerning the data subject, provided for in Article 13 para. (1) and art. 14 of the Law on personal data protection.

In this respect, the economic agent was issued with a report on the infringement under Article 741 para. (3) of the Contravention Code.

II.               Violation of the processing and storage of personal data rules by means of a video surveillance system

NCPDP, in the framework of the examination of a complaint filed by a data subject, issued a decision finding a violation of the provisions of Article 4 para. (1) (a), (b), (c), Art. 5 para. (1) of the Law no. 133/2011, to the processing of complainant’s personal data, in connection with the collection/recording of the voice of the data subject, without his consent, by means of the video surveillance camera, installed on an electric pole, which included both the property of the video surveillance system manager and a portion of the space not belonging to the latter, without identifying the determined, explicit and legitimate purpose, the causal link between the purpose and the processed personal data of the complainant, the proportionality, fairness and consistency with the legal rules in the field of personal data protection.

Therefore, in the view of the above, the NCPDP has held that, before installing a video surveillance system, the data controller must always critically examine whether this measure is, firstly, appropriate for the achievement of the desired objective and, secondly, proportionate and necessary for its purposes, in relation to the interests or fundamental rights and freedoms of the data subject. Therefore, the audiovisual recording by the data controller in question, by means of the video surveillance camera, without the consent of the data subject, constituted an excessive and disproportionate measure in relation to the stated purpose, in this case, ensuring the security of property.

In this respect, the personal data controller was issued with a report on the infringement under Article 741 para. (1) of the Contravention Code.

4.      Surveillance activity

In accordance with the provisions of the Law No 175 of 11 November 2021 on the amendment of certain regulatory acts, which entered into force on 10 January 2022, the obligation to designate the data protection officer has been established.

In this regard, the NCPDP has received more than twenty letters informing it about the designation of data protection officer from the entities concerned. At the same time, the NCPDP has intervened, where appropriate, with recommendations in order to remove the discrepancies identified.

At the same time, a number of communications were drafted and posted on the NCPDP website concerning: changes in the legislation in the field of personal data protection; the need to designate the data protection officer; the obligation for data controllers to post this information on the website and the obligation for data controllers to carry out a data protection impact assessment, etc.

During the reporting period, the NCPDP has prepared and published in the Official Gazette and on the NCPDP website the List of States ensuring an adequate level of personal data protection, in the context of the amendments to Article 32 of the Law No. 133 on personal data protection.

Furthermore, a list of the types of processing operations subject to the requirement to carry out a data protection impact assessment has been drawn up and will be published on the NCCDP website.

In addition, the NCPDP intends to publish guidance on personal data protection impact assessment for recommendation purposes.

In order to provide methodological and advisory support to personal data controllers and/or processors, more than 391 telephone consultations and 34 responses via e-mail were provided.

5.      International and European news

–       On January 18, took place the 59th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on the Right of Access. The Guidelines aim to analyse the various aspects of the right of access and to provide more precise guidance on how the right of access has to be implemented in different situations.

·        A letter in reply to letters calling for a consistent interpretation of cookie consent.

·        The updated Guidelines on consent. The guidelines aim to ensure a harmonized approach on the conditionality of consent and on the unambiguous indication of wishes.

–       On February 22, took place the 61st Plenary Session of the European Data Protection Board, which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·        The EDPB adopted a letter in reply to the European Parliament’s Civil Liberties, Justice and Home Affairs Committee (LIBE) regarding the Second Additional Protocol to the Cybercrime Convention, and in view of the two European Commission Proposals for Council Decisions authorising Member States to sign and ratify the Protocol.

·        Following public consultation, the EDPB adopted a final version of the Guidelines on Codes of Conduct as a tool for transfers, taking into consideration the feedback received from stakeholders. The main purpose of the guidelines is to clarify the application of articles 40 (3) and 46 (2) (e) GDPR.

·        The EDPB adopted a letter on Artificial Intelligence liability.

–       On March 14, took place the 62nd Plenary Session of the European Data Protection Board, which was held on-line. During the Plenary, the EDPB adopted several documents, among which:During the Plenary, the EDPB adopted several documents, among which:

·        Guidelines on Art. 60 GDPR. The drafting of such guidance is part of the EDPB Strategy and Work Programme 2021-2022 to support effective enforcement and efficient cooperation between national supervisory authorities.

·        Guidelines on dark patterns in social media platform interfaces. The guidelines offer practical recommendations to designers and users of social media platforms on how to assess and avoid so-called “dark patterns” in social media interfaces that infringe on GDPR requirements.

·        A toolbox on essential data protection safeguards for enforcement cooperation between EEA and third country SAs. This contributes to one of the key actions of the EDPB Strategy and Work Programme 2021-2022 and aims to facilitate the engagement between EDPB members and the SAs of third countries. The toolbox covers key topics, such as enforceable rights of data subjects, compliance with data protection principles and judicial redress.

·        A joint EDPB-EDPS opinion on the proposals to extend the Digital COVID Certificate by up to 12 months. The subject will continue to be discussed at the next Plenary Session.

–       On March 23-25, took place the 55th meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online. During the Meeting, several topics were discussed, among which:

·        Convention 108+ State of play, ratifications and accessions;

·        Evaluation and follow up mechanism under Convention 108+;

·        Digital identity;

·        Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·        Contractual clauses in the context of transborder data flows;

·        Cooperation with other bodies and entities of the Council of Europe.

6.      Other data protection authorities

·        On January 28, Hellenic Data Protection Authority (DPA) applied a total fine in the amount of EUR 9 250 000 to telecommunications companies COSMOTE and OTE S.A. due to personal data breach and illegal data processing. The investigation of the case revealed that COSMOTE had infringed the principles of legality and transparency due to the provision of unclear and insufficient information to subscribers. The company was also found responsible for poor data protection impact assessment, poor anonymisation, inadequate security measures taken, and failure to allocate the roles of the two companies (COSMOTE / OTE) in relation to the processing in question. In addition, ΟΤΕ S.A. was found to have infringed Article 32 of the GDPR due to inadequate security measures taken in relation to the infrastructure used in the context of the breach. The Hellenic DPA, on the one hand, fined COSMOTE a total of EUR 6 000 000, and imposed the sanction of stopping the processing and destroying the data, and, on the other, fined OTE S.A. a total of EUR 3 250 000.

·        On February 10, the Italian Data Protection Authority (SA) applied a fine in the amount of EUR 20 million to Clearview AI for illegal personal data processing. Following the investigation, launched an own volition proceeding, the Italian SA found that the personal data held by the company, including biometric and geolocation information, were processed unlawfully without an appropriate legal basis. Furthermore, the company infringed several fundamental principles of the GDPR, such as transparency, purpose limitation, and storage limitation. In this context, Italian SA imposed a ban on any further collection, by way of web scraping techniques, of images and the relevant metadata concerning persons in the Italian territory and on its further processing and ordered erasure of the data, including biometric data, processed by its facial recognition system.

·        On March 15, the Irish Data Protection Authority (SA) applied a fine in the amount EUR 17 million to Meta Platforms (formerly Facebook) for the infringement of the Articles 5(2) and 24(1) GDPR.  Following the investigations, Irish SA found that Meta Platforms failed to have in place appropriate technical and organisational measures such as would enable it to readily demonstrate the security measures that it implemented in practice to protect EU users’ data, in the context of the twelve personal data breaches.

1. Information activities performed by NCPDP

In the reference period, NCPDP registered a remarkable evolution in terms of training and awareness activities. The series of trainings organized for the representatives of the local public authorities (LPA) from the districts of the Republic of Moldova was continued, with the aim of strengthening the capacities of LPA representatives throw familiarizing, raising awareness and informing them with the field of personal data protection. The topics addressed in the training were: general notions on personal data protection; legal grounds for personal data processing; recording and live streaming of local councils’ meetings; approval of security policy and personal data filling systems instructions, etc. Separately, the issues related to the correct depersonalization of personal data contained in the administrative acts of local public authorities published in the State Local Documents Registry. The events, moderated by national experts in the field of personal data protection within NCPDP, were organized for about 50 mayors, district councilors and secretaries of local councils from each district center based on the protection measures imposed in the context of the COVID pandemic – 19. The training courses were conducted:

·         On October 7 – within Căușeni District Council;

·         On November 5 – within Râșcani District Council;

·         On November 11 – within Fălești District Council;

·         On November 19 – within Briceni District Council;

·         On November 26 – within Glodeni District Council;

·         On December 3 – within Cahul District Council.

Furthermore, on November 19, was held the Public Action – “Protect personal data”, organized by NCPDP representatives. The target audience – the inhabitants of Ialoveni district, were informed about the importance of personal data protection. The action took place near Ialoveni District Council and the citizens were informed about the notion of personal data, the rights of data subjects, data security and confidentiality measures, as well as the principles of personal data protection. The purpose of this action was to educate, motivate and encourage the citizens of the Republic of Moldova to pay more attention to the protection of their personal data.

2.  Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 55 investigations. Of the 55 investigations: 5 investigation procedures were initiated following the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data; from 41 finalized cases, in 19 cases the violation of the legal provisions was found. Furthermore, 22 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. Findings of the NCPDP

3.1 The NCPDP received the complaint of a personal data subject, regarding the alleged violation of his right of opposition, by an economic agent, manifested by ignoring the request of the data subject, submitted on the bases of art. 16 paragraph (1) of the Law on personal data protection, by which the latter requested the deletion of personal data concerning him, stored in the company’s database and the cessation of sending commercial messages on his telephone number. Following the examination of the case, it was determined that the economic agent, ignoring the request of the data subject, did not exercise his right of opposition, a fact recognized by the personal data controller as an omission.

In this case, the NCPDP found a violation of the provisions of art. 16 para. (1) of the Law on personal data protection no. 133/2011, being started a contravention process regarding the economic agent provided by art. 74 1 para. (3) Contravention Code.

3.2 Furthermore, NCPDP issued a decision regarding the establishment of the non-compliant processing of personal data by the mayor of a locality. The non-compliant processing of personal data of the data subject who notified the National Authority for personal data protection, was materialized by multiple accesses by the mayor of the locality, the data contained in the Real Estate Register, without having a purpose and legal basis, as well as in the absence of the data subject’s consent.

At the same time, during the examination of the audit of personal data accesses by the mayor, NCPDP found that the mayor made 134 personal data accesses, from 10 different IP addresses, of which multiple accesses were made outside the work schedule and on weekends.

Thus, following the control of those notified, was found the violation of art. 4, art. 5 and art. 29 of the Law 133/2011 on personal data protection.

Therefore, from the content of the related circumstances, it results the fact of the existence in the actions / inactions of the mayor of the contravention provided by art. 741 para. (4) Contravention Code.

3.3 On December 22, the Supreme Court of Justice rejected the appeal of the Ministry of Internal Affairs and upheld the decision of the NCPDP of November 16, 2018, which found the processing of personal data through the Automated Information System “Register of forensic and criminological information” inconsistent with the requirements of legislation in the field of personal data protection.

The NCPDP decision addresses the need to delete information that was collected / obtained from unrecognized authorities / institutions in the Transnistrian region during the years 1991-2005. It should be emphasized that the automatic processing of personal data of the Republic of Moldova’s citizens based on information received from unconstitutional structures, which in fact cannot be considered authentic / truthful, as well as its use to the detriment of the data subject concerned, is a serious violation of human rights and freedoms. In this sense, the Decision of the Superior Council of Magistracy (SCM) no. 209/14 of April 10, 2012 “on the approach of Mr. Oleg Efrim, Minister of Justice, regarding the opinion on the address f Mr. Eugen Carpov, Deputy Prime Minister, on approaching some legal issues”, by which the SCM found: “that any act issued by the self-proclaimed authorities of the Republic of Moldova contravenes the Constitution and are considered illegal. This fact refers equally to any decisions, sentences handed down by the courts established in the region. Thus, the Council considers as unacceptable any collaborations, legal cooperation and proposals for legal solutions with the structures from the Transnistrian region “.

Consequently, in the jurisprudence concerning the Republic of Moldova, the European Court of Human Rights in numerous cases (Ilascu and others vs. Moldova and Russia; Eriomenco against Republic of Moldova and the Russian Federation; Mozer against Republic of Moldova and Russian Federation; Catan and others against Republic of Moldova and Russia) found acts adopted by unrecognized and unconstitutional entities on the left bank of the Dniester as illegal. It should be specified that, according to the Declarations submitted together with the instrument of ratification of Convention no. 108 for the protection of individuals with regard to the automated processing of personal data, the Republic of Moldova has not declared reservations on the provisions of the Convention, regarding its application on the territory of the Transnistrian region. Thus, the Republic of Moldova has the obligation to ensure the protection of the fundamental rights and freedoms of its citizens with regard to the processing of personal data, especially the right to inviolability of privacy, family and private life, throughout its territory.

4. Surveillance activity

During the reference period, arising from the impossibility, for technical reasons to issue and sign automated decisions through the Register of evidence of personal data controllers, NCPDP sent 204 information letters in order to comply with the provisions of Art. 23-25 ​​of Law no. 133 on personal data protection.

At the same time, in accordance with the provisions of Law no. 175 of November 11, 2021 for the amendment of some normative acts, which will enter into force on January 10, 2022, it is excluded the obligation of personal data controllers to notify the National Center for Personal Data Protection and it is repealed art. 28 of Law no. 133 of 08.07.2011 on personal data protection, which determines the liquidation of Register of evidence of personal data controllers, by the irreversible destruction of documents and information stored on paper records and those stored in electronic form, under the conditions provided by law.

Furthermore, in order to provide methodological and advisory support to personal data controllers and / or processors, over 405 telephone consultations and 178 responses via e-mail were provided.

5.  International and European news

–        On October 13, took place the 56th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·         Consistency mechanism and Guidelines;

·         Guidelines on Restrictions under Art. 23 GDPR (following public consultation);

·         Guidelines on children’s data – request for mandate.

–        On November 18, took place the 57th Plenary Session of the European Data Protection Board, which was held at Brussels, Belgium.

During the Plenary, the EDPB adopted several documents, among which:

·         Guidelines on the interplay between Art. 3 and Chapter V GDPR. The Guidelines will be subject to public consultation until the end of January.

·         Statement on the European Commission’s Digital Services Package and Data Strategy.

·         Finally, the EDPB nominated two representatives from the Belgian and Hessen (DE) SA to take part in the 6th Joint Review of the EU-US Terrorist Finance Tracking Program (TFTP) Agreement.

–        On December 14, took place the 58th Plenary Session of the European Data Protection Board (EDPB), which was held on-line. During the Plenary, the EDPB adopted several documents, among which:

·         The EDPB and the individual Supervisory Authorities (SAs) contributed to the evaluation and review of the Data Protection Law Enforcement Directive (LED), carried out by the European Commission in accordance with Art. 62 LED. The LED aims to provide a harmonised level of data protection for individuals in the area of law enforcement across the EU;

·         As part of the implementation of the EDPB 2021-2023 strategy and following the establishment of a Support Pool of Experts (SPE), the EDPB has now agreed on the SPE’s project plan;

·         The EDPB adopted a reply to MEP Ujhelyi on hacking spyware Pegasus;

·         The EDPB adopted a final version of the Guidelines on examples regarding data breach notifications. They aim to help data controllers in deciding how to handle data breaches and what factors to consider during risk assessment.

–        On December 20-21, took place the 54th meeting of the Bureau of the Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online. During the Meeting, several topics were discussed, among which:

·         Convention 108+ State of play, ratifications and accessions;

·         Evaluation and follow up mechanism under Convention 108+;

·          Digital identity;

·         Inter-state exchanges of data for Anti-Money Laundering/Countering Financing of Terrorism, and tax purposes;

·         Interpretation of Article 11 of the modernised Convention 108;

·         Contractual clauses in the context of transborder data flows.

In the context of NCPDP collaboration with the European Data Protection Authorities, on November 18, the National Center for Personal Data Protection and the Office of the Information and Data Protection Commissioner of Malta signed a Collaboration Agreement in the field of personal data protection. The Agreement provides for the development of cooperation relations between the two institutions in terms of achieving constant progress in the field of personal data protection and the promotion of good practices that will create favorable conditions for ensuring effective protection of personal data of Malta’s and Moldova’s citizens.

6. Other data protection authorities

–        On October 14, Polish Data Protection Authority (UODO) impose a fine of 80,000 EUR to Bank Millennium S.A, for the infringement of Article 33(1) and Article 34(1) of GDPR. UODO learnt about the personal data breach from a complaint lodged against the bank. The complaint concerned the loss by a courier company of correspondence containing personal data, such as: name, surname, personal identification number (PESEL number), registered address, bank account numbers, identification number assigned to the bank’s customers. In the course of the case, it turned out that the controller did not notify this breach to the Supervisory Authority, and did not fully comply with the obligation to communicate it to the data subjects.

–        On November 26, Icelandic Data Protection Authority fined the Ministry of Industries and Innovation with 7,5 million ISK (approx. 50.800 Euros) and the company YAY ehf. was fined with 4 million ISK (approx. 27.100 Euros) for the infringement of Article 7, 9, 12, 13, 24, 25, 28 (3) and 32 of GDPR. Due to economic difficulties in Iceland caused by COVID-19 the Icelandic government decided, to boost the tourism sector and small businesses by issuing a digital gift certificate of 5000 ISK (approx. 34 euros) to all Icelanders over 18 years old. In the course of the case, the Icelandic DPA found the unlawful and unnecessary collection of considerable amounts of personal data, requirements for consent for processing were not met and the information the data subjects received when signing into the app was inadequate. Additionally, the controller and the processor had not ensured the appropriate security of the personal data.

–        On December 13, he Norwegian Data Protection Authority has imposed an administrative fine of 6.5 million EUR to Grindr LLC for the infringement of Article 6 and 9 of GDPR. In 2020, the Norwegian Consumer Council filed a complaint against Grindr claiming unlawful sharing of personal data with third parties for marketing purposes. The data shared was GPS location, IP address, Advertising ID, age, gender and the fact that the user in question was on Grindr. The Norwegian Data Protection Authority concluded that Grindr has disclosed user data to third parties without a legal basis. Furthermore, the information about the sharing of personal data was not properly communicated to users and this was contrary to the GDPR requirements for valid consent.

1.      Information activities performed by NCPDP

–         On February 17, 18 and 19, the National Center for Personal Data Protection trained the local authorities from the north, center and south of the Republic of Moldova. The training aimed at familiarizing the participants with video surveillance and live streaming of local councils’ meetings. The participants in the training obtained information about: how the meetings of the local councils are to be live streamed, who is responsible for their live streaming and how the information will be provided. The training took place online and was attended by 300 people.

–         At the beginning of March, the students of the Faculty of Law of Moldova State University were familiarized with the mission of the National Center for Personal Data Protection. The event took place online on the zoom platform where over 50 students were present. NCPDP employees explained to them which are the most frequently used personal data. These are first name, surname, address, telephone number, e-mail address, location data, IP address, marital status, face photo, habits and preferences, online identifiers and any other data related to physical, physiological, economic, cultural or social identity that can be used to identify directly or indirectly a natural person. Furthermore, the representatives of NCPDP spoke to students about the legislation and EU experience regarding personal data protection, ascertained cases of personal data processing, the procedures related to the registration of personal data controller and about contravention cases and the consequences of the non – compliant personal data processing.

–         On March 11, NCPDP provided a training course for 50 lawyers from the Republic of Moldova, in the field of personal data protection. The training course was performed within the Council of Europe’s HELP online meeting. The topics addressed during the event were: personal data protection and the rights of data subjects in the European Union, but also the legislation of the Republic of Moldova on personal data protection. Previously, NCPDP has addressed practical aspects aimed at the protection of personal data by lawyers, including the publishing on the website www.datepersonale.md  “Aspects regarding the practice of submitting to the materials of the files examined by the courts, the documents with personal data of natural persons, which are not covered in the examined case”. These recommendations aim to ensure the application by lawyers of adequacy principle which consists in limiting the volume of personal data relevant to the cases examined, with depersonalization of data that are excessively irrelevant to the case, according to art. 31 of Law no. 133/2011 on personal data protection.

–         On March 16, NCPDP performed a training course in the field of personal data protection for the employees of the National Insurance Company in Medicine (CNAM) at the request of the institution. The event was attended by about 100 persons. The topics addressed in the training were: the principles of personal data protection, the rights of the data subjects, the recommendations on identifying the filing systems in which the processing of personal data takes place, the regulatory framework for data protection and implementation of legal requirements in that area. Any personal data subject has the right to obtain from the controller or processor, upon request and free of charge: the rectification, update, blocking or erasure of personal data, the processing of which does not comply with the law, in particular because of their incomplete or inaccurate nature and the notification of the third parties to whom the personal data have been disclosed, about any operations performed, except where such notification proves to be impossible or involves disproportionate effort towards the legitimate interest that might be violated. The participants in the training obtained information regarding the practical application of the legislation in the field of personal data protection, including the assurance of the legality of personal data processing in the information systems managed by CNAM.

–         On March 30, the NCPDP performed a training course for the employees of the Parliament’s Secretariat of the Republic of Moldova to ensure the compliant implementation of the provisions of the legislation on personal data protection within personal data filling systems. The topics addressed in the training were: general notions on personal data protection, the principles of personal data protection, assurance the security and confidentiality of personal data within the personal data filling systems, general aspects of personal data security, simple and essential security measures and data subjects’ rights. The training course was held online at the request of Parliament’s Secretariat and was attended by 51 employees.

2.  Control activity

During the reference period, the NCPDP initiated the verification of the conformity of the personal data processing operations, thus initiating 95 investigations. Of the 95 investigations: 16 investigation procedures were initiated following the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data; in 45 finalized cases, the violation of the legal provisions was found, 68 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. Findings of the National Center for Personal Data Protection

3.1. The NCPDP was notified by a data subject regarding the violation of personal data principles of the petitioner by an insurance company from the Republic of Moldova, through the envelope with window (transparent border) used in correspondence.

Following the examination of the case, it was determined that, by the non-compliant practice of entering in the header of complaints / letters an excessive volume of personal data, in relation to the stated purpose, which are subsequently disclosed through the transparent letter box used by the controller, the access of an indeterminate number of foreigners to personal data is favored, which cannot be considered a “compliant” processing within the meaning of Law no. 133/2011 on personal data protection, or the legislation on personal data protection established clear rigors regarding the implementation of appropriate and effective technical and organizational measures for the protection of personal data, to ensure the confidentiality and security of personal data.

In this case, NCPDP found a violation of the provisions of personal data protection legislation and ordered the review / adjustment of information included in the header of complaints to the requirements of Law on personal data protection no. 133/2011, namely the exclusion of excessive volume of personal data, as well as the elaboration / approval / updating of the internal instrument (regulation / instruction), in which to regulate a clear procedure regarding the keeping of secretarial works, with the description of the technical and organizational measures necessary for the protection of personal data.

3.2. Taking into account the repeated / continuous nature of the complaints / notifications addressed to NCPDP during the last period regarding the non-conformity of the publication of individual administrative acts in the State Register of Local Acts, especially the aspects without depersonalization or incorrect depersonalization of these acts, adopted the decision by which find the violation of legal provisions in the field of personal data protection. At the same time, the NCPDP ordered the State Chancellery, jointly with the local public authorities, to take the necessary measures in order to establish a mechanism for depersonalization of local documents to be placed in the Register.

3.3. NCPDP received the complaint from a data subject, regarding the verification of the lawfulness of the processing of his personal data, manifested by sending the criminal record certificate to a third party, without the consent of the data subject.

Following the examination of the case, it was determined that the operation of personal data processing, manifested by the issuance of a criminal record certificate containing personal data, to an unauthorized person, was not legally justified, being made incorrectly and contrary to the provisions of Law on personal data protection no. 133/2011.

On this case, NCPDP found a violation of the provisions of art. 4 para. (1) let. a), art. 5 para. (1), art. 6 para. (1), art. 8 para. (1), art. 29 of the Law on personal data protection no. 133/2011.

3.4. NCPDP, in the context of examining the approach of a subdivision of the Ministry of Internal Affairs of the Republic of Moldova, pursuant to art. 27 para. (4) of the Law on personal data protection no. 133/2011, notified itself in the part related to the non-conformities admitted by a collaborator of the MIA, when processing / accessing personal data, without a purpose and legal basis for accessing a data subject, through the Information System – “EDATA MAI”.

As a result of the examination of the control materials, NCPDP found the violation of the provisions of art. 4 para. (1) let. a) of the Law on personal data protection no. 133/2011, by the MIA collaborator, manifested by accessing / consulting personal data concerning the data subject.

4. Surveillance activity

During the reference period, 717 notifications were submitted for examination at the “One-Stop Shop” of the NCPDP for the registration of personal data controllers and / or managed filing systems. Following the analysis of those notification forms, 262 authorization decisions and 271 refusal decisions were issued. Thus, about 184 data controllers and 262 personal data filing systems were registered in the Register of evidence of personal data controllers.

5. International and European news

The 45th Plenary Session of the European Data Protection Board, held online, took place on February, 2. A wide range of documents were adopted at the meeting:

–     Recommendations on the adequacy referential under the Law Enforcement Directive

–     Opinion on the draft Administrative Arrangement for transfers of personal data between the Haut Conseil du Commissariat aux Comptes (H3C) and the Public Company Accounting Oversight Board (PCAOB)

–     Statement on new draft provisions of the second additional protocol to the Council of Europe Convention on Cybercrime (Budapest Convention)

–     EDPB response to the European Commission questionnaire on processing personal data for scientific research, focusing on health related research

–     Recommendations on Art. 36 of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

On 10 March, a series of documents were adopted during the 46th Plenary Session of the European Data Protection Board, held online:

–     EDPB adopted its Work Programme for 2021-2022, according to Article 29 of the EDPB Rules of Procedure.

–     EDPB adopted a Statement on the draft ePrivacy Regulation.

–     EDPB adopted Guidelines 02/2021 on Virtual Voice Assistants (VVAs). These Guidelines aim to identify some of the most relevant compliance challenges for VVAs and to provide recommendations to relevant stakeholders on how to address them. The Guidelines was submitted for public consultation for a period of six weeks.

–     EDPB adopted a final version of the Guidelines 01/2021 on Connected Vehicles following public consultation. The Guidelines focus on the processing of personal data in relation to the non-professional use of connected vehicles by data subjects.

–     EDPB adopted EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance.

–     EDPB adopted, following public consultation, the Guidelines 09/2020 on relevant and reasoned objection.

–      Furthermore, the EDPB discussed the draft UK adequacy decisions, which were received from the European Commission.

On March, 30 took place the 47th Plenary Session of the European Data Protection Board, which was held online.

During the Session, The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a Joint Opinion on the Proposals for a Digital Green Certificate. The Digital Green Certificate aims to facilitate the exercise of the right to free movement within the EU during the COVID-19 pandemic by establishing a common framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, testing and recovery certificates. With this Joint Opinion, the EDPB and the EDPS invite the co-legislators to ensure that the Digital Green Certificate is in line with EU personal data protection legislation and underline that its use may not, in any way, result in direct or indirect discrimination of individuals, and must be fully in line with the fundamental principles of necessity, proportionality and effectiveness.

On March, 13 during the 48th Plenary Session of the European Data Protection Board (EDPB), which was held online were adopted several documents, among which:

–     two Opinions on the draft UK adequacy decisions (Opinion 14/2021  based on the GDPR and Opinion 15/2021 based on the Law Enforcement Directive). The EDPB notes that there are key areas of strong alignment between the EU and the UK data protection frameworks on certain core provisions such as: grounds for lawful and fair processing for legitimate purposes; purpose limitation; data quality and proportionality; data retention, security and confidentiality; transparency; special categories of data; and on automated decision making and profiling.

–     Guidelines on the application of Article 65(1)(a) GDPR to delineate the main stages of the procedure and clarify the competence of the EDPB when adopting a legally binding decision on the basis of this Article. The guidelines were subjected to public consultation for a period of six weeks.

–     Final version of the Guidelines on the targeting of social media users following public consultation. The aim of the Guidelines is to clarify the roles and responsibilities of social media providers and targeted individuals.

–     Statement on international agreements including transfers. The EDPB invites EU Member States to assess and, where necessary, review their international agreements that involve international transfers of personal data to align them with EU data protection law.

On May, 19 took place the 49th Plenary Session of the European Data Protection Board, which was held online. During the Plenary, the EDPB adopted several documents, among which:

–     Two Opinions on the first draft decisions on transnational Codes of Conduct presented by the Belgian Supervisory Authority (draft decision concerns the EU CLOUD Code of conduct, addressed to cloud service providers) and French Supervisory Authority (draft decision concerns the CISPE Code of conduct, addressed to cloud infrastructure service providers). These Codes aim to provide practical guidance and define specific requirements (Art. 28 GDPR) for processors in the EU subject to these Codes. They are not to be used in the context of international transfers of personal data. The EDPB is of the opinion that both draft codes comply with the GDPR and fulfil the requirements set forth in Art. 40 and 41 GDPR.

–     Statement on the Data Governance Act (DGA) in light of developments in the legislative process. The EDPB reiterates that, without robust data protection safeguards, there is a risk that the trust in the digital economy would not be sustainable. The statement further highlights the need to ensure consistency of the DGA with the EU data protection acquis and urges the co-legislators to carefully consider certain aspects, such as the interplay between the DGA and the GDPR, and the importance of ensuring that the new definitions and concepts are not incompatible with the GDPR.

–     Recommendations on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions. The recommendations cover situations in which data subjects buy a product or pay for a service via a website or an application and provide their credit card data in order to conclude a unique transaction. As such, consent in accordance with Art. 6 (1) (a) GPDR should be considered the sole appropriate legal basis for storing credit card data after the purchase.

On June, 18 took place the 50th Plenary Session of the European Data Protection Board, which was held online. During the Plenary, the EDPB adopted several documents, among which:

–     A final version of the Recommendations on supplementary measures following public consultation. The Recommendations were first adopted in November 2020 following the CJEU Schrems II ruling. They aim to assist controllers and processors acting as data exporters with their duty to identify and implement appropriate supplementary measures where they are needed to ensure an essentially equivalent level of protection to the data they transfer to third countries.

–     A letter addressed to EU Institutions on the privacy and data protection aspects of a possible digital euro. In the letter, the EDPB stresses that a very high standard of privacy and data protection is crucial to reinforce the trust of end users and should be considered a distinctive element in the offering of a digital euro, representing a key factor of success. The EDPB further indicates that it stands ready to provide advice to the ECB or other EU institutions.

–     Designated three representatives to the European Travel Information and Authorisation System’s (ETIAS) Fundamental Rights Guidance Board, which is tasked to evaluate the impact of the processing of applications and will play an important role in ensuring the system’s compliance with fundamental rights, in particular with regard to privacy and personal data protection.

–     A joint opinion on the European Commission’s Proposal for a Regulation laying down harmonised rules on artificial intelligence (AI).

On 24 -26 March, took place the 52nd meeting of the Bureau of the Consultative Committee of the Convention for the protection of individuals with regard to automating processing of personal data, which was held online.

During the Meeting, several topics were discussed, among which:

–       Convention 108+ State of play, ratifications and accessions;

–       Evaluation and follow up mechanism under Convention 108+;

–       Law enforcement transborder access to data;

–       Digital identity;

–       Personal data processing by and for political campaigns;

–       Automatic Exchange of data;

–       Cooperation with other Council of Europe bodies and entities;

–       Major developments and activities in the field of data protection.

At the same time, during the Meeting, a topic of major importance related to COVID-19 vaccination certificates was addressed. The representatives of the Committee on Bioethics (DH-BIO), as well as the representatives of the Secretariat, made a considerable contribution in this regard. In this context, will be submitted to delegations the draft Statement on “Covid-19 Vaccination, digital attestations and data protection”

6. Other data protection authorities

–     Fine in the amount of 10.4 million euros applied by State Commissioner for Data Protection in Lower Saxony, Barbara Thiel to Notebooksbilliger.de AG for monitoring its employees for at least two years with no legal justification. The video cameras were installed in the workspaces, sales floors, warehouses and staff rooms. According to the company the video cameras had been installed to prevent and investigate criminal offences and to track the flow of goods in warehouses. At the same time, many of the recordings were stored for more than 60 days, contrary to the law. The fine of 10.4 million euros is the highest penalty that has ever been imposed by the State Commissioner for Data Protection in Lower Saxony under the General Data Protection Regulation (GDPR). The GDPR enables supervisory authorities to impose fines of up to 20 million euros – or up to 4% of a company’s total annual turnover worldwide.

–     The administrative fine in the amount of 250 000 euro applied by Swedish Authority for Privacy Protection to Police Authority, for unlawfully use of application Clearview AI for facial recognition in order to identify people. The investigation carried out by Swedish Authority for Privacy Protection concluded that Clearview AI has been used by a few employees without any prior authorisation. The Police Authority has failed to implement sufficient organisational measures to ensure and be able to demonstrate that the processing of personal data in this case has been carried out in compliance with the Criminal Data Act, unlawfully processing biometric data for facial recognition as well as having failed to conduct a data protection impact assessment which this case of processing would require. Furthermore, to the fine mentioned above, Police Authority will conduct further training and education of its employees in order to avoid any future unlawfully processing of personal data.

–     Administrative fine in the amount of EUR 6.000.000 applied by Spanish Data Protection Authority (AEPD) to CAIXABANK, S.A., for unlawfully processing of clients’ personal data (4.000.000 EUR) and not providing sufficient information regarding the processing of personal data (2.000.000 EUR). The Spanish Data Protection Authority considered that CAIXABANK did not provide sufficient information regarding the categories of personal data concerned, the purposes of the processing of personal data and the lawfulness of their processing, especially regarding those processing activities based on the company’s legitimate interest. Consequently, the AEPD found a breach of the provisions of Articles 13 and 14 of GDPR, imposing a fine of EUR 2.000.000. The Spanish Data Protection Authority found that CAIXABANK did not provide any mechanism to collect the data subject’s consent and the processing activities based on the company’s legitimate interest were not sufficiently justified. The AEPD concluded that this constituted an infringement of Article 6 of the GDPR and, in accordance with Article 83 (5) a of the GDPR, an administrative fine of EUR 4.000.000 was imposed. When deciding on the amount of the administrative fine, the AEPD took into account, the nature, gravity and duration of the infringement, the relationship between the company’s activity and the processing of personal data and its turnover. In addition to the administrative fine, the highest ever imposed by the Spanish DPA, the AEPD ordered CAIXABANK to bring its processing operations into compliance with Articles 6, 13 and 14 of the GDPR within the next six months.

–     Fine in the amount of EUR 475 000 applied by Dutch Data Protection Authority (DPA) to Booking.com for delay in reporting data breach. In a telephone scam targeting 40 hotels in the United Arab Emirates (UAE) in December 2018, the criminals persuaded hotel staff to reveal the log-in details for their accounts in a Booking.com system. In this way, the criminals gained access to the data of 4 109 people who had booked a hotel room in the UAE. The data included their names, addresses and telephone numbers, as well as details of their booking. Furthermore, the criminals were able to access the credit card information of 283 people. In 97 cases, the credit card security code was obtained as well. The criminals also tried to get hold of the credit card information of other victims, by posing as Booking.com staff in emails or on the telephone. Dutch Data Protection Authority warned it was seeing an explosive increase in the number of hacks aimed at stealing personal data, which in 2020 was 30% higher than in the previous year.

–     Total fine in the amount of EUR 1 258 478 applied by Swedish Authority for Privacy Protection (IMY) to Medhelp and Voice Integrate for the recorded phone calls to the medical consultation service, 1177, which were available and unprotected on the Internet.  The cause of the incident was that a network attached storage unit had been incorrectly configured and was thereby accessible on public internet. In addition, the unit did not use encrypted communication. Consequently, a vast amount of calls became available without password protection or other security protection. The only thing that was necessary in order to get access to the files with the phone calls was to know the IP address of the storage unit. Further to the contraventions that were established, the IMY has issued an administrative sanction of 12 million SEK (1 193 813 €) towards Medhelp and an administrative sanction towards Voice Integrate of 650 000 SEK (64 665 €).

1. Information and training activities performed by NCPDP

In the period May to July 2020, the National Center for Personal Data Protection (NCPDP) organized a series of workshops and participated in several webinars related to the field of personal data protection organized for various public authorities and private entities.

At the same time, it should be mentioned that, pursuant to Decision no. 6 of National Extraordinary Commission of Public Health of the Republic of Moldova from 10.03.2020, following the evolution of the epidemiological situation at national level, in order to ensure the protection of life and health of employees and visitors of the institution, and to prevent the spread of COVID-19 virus, NCPDP, like other state institutions, had in a special work regime, thus limiting itself only to the strictly necessary activities.

·         On May 19, 2020, a working meeting was organized at the NCPDP headquarters with the participation of the high management of the Customs Service of the Republic of Moldova and the National Authority for Personal Data Protection. During the working meeting, some aspects regarding the compliance of the Customs Service of the Republic of Moldova with the provisions of the legislation in the field of personal data protection, including the notification of the video surveillance filling system and other personal data filling systems managed by the entity concerned, in particular the Integrated Customs Information System, were discussed

·          On June 4, 2020, at the invitation of the high management of the Congress of Local Authorities of Moldova (CALM), NCPDP’s representatives gave a speech in a webinar addressed to secretaries of local councils, members of Secretaries Network of CALM, on “Security policy development and the Regulation on the processing of personal data under the LPA”. The webinar was attended by about 85 secretaries of local councils.

·         On June 4, 2020, a working meeting was organized at the NCPDP’s headquarters with the participation of the high management of Î.C.S. Metro Cash & Carry Moldova S.R.L. and the National Authority for the Protection of Personal Data. During the working meeting were discussed some issues regarding the compliance of Î.C.S. Metro Cash & Carry Moldova S.R.L. with the provisions of the legislation in the field of personal data protection, including the notification of the video surveillance filling system.

·          On July 27, 2020, at the request of the Training Center in the Field of Labor Relations, the NCPDP’s representative participated as a trainer, moderating a seminar on personal data protection in which the following topics were addressed:

l) general notions of personal data;

2) registration of the employer (enterprise) as a personal data controller;

3) protection of personal data of employees.

The seminar was attended by about 90 employers and representatives of employers such as accountants, directors, lawyers, heads of departments, as well as specialists in the field of human resources.

• On July 31, 2020, NCPDP’s representatives participated at the invitation of the USAID Moldova Structural Reforms Program in online discussions with institutions in the field of personal data protection, consumer protection and competition protection. The purpose of the thematic discussions and consultations in question was to conduct a complex study of the realities of e-commerce in the Republic of Moldova, at all levels, but also to address specific recommendations for the promotion of e-commerce.

Regarding the courts, during the reference period (May 20, 2020), the Supreme Court of Justice decided irrevocably to maintain in force the decision of the NCPDP of November 16, 2018, which found the processing of personal data inconsistent with the requirements of the legislation in the field of personal data protection by the Ministry of Internal Affairs, in the Automated Information System “Register of forensic and criminological information”, the latter being obliged to destroy information containing personal data relating to the data subject covered by this processing, which were collected / obtained from unrecognized authorities / institutions from the Transnistrian region.

2. The control activity of NCPDP

During the reference period, NCPDP carried out a number of 92 investigations on data controllers, in order to verify the lawfulness conditions of personal data processing performed. Out of the 92 investigations – 12 investigation procedures were initiated as a result of the self-notification of the NCPDP in connection with an alleged non-compliant processing of personal data. Out of 92 investigations, on 38 completed cases, the violation of the legal provisions was found, 52 minutes regarding the contravention were concluded, being subsequently submitted to the court for settlement.

3. The supervision activity of NCPDP

During the reference period, 268 notifications were submitted for examination at the “One-Stop Shop” of the NCPDP for the registration of personal data controllers and / or managed filing systems. Following the analysis of those notification forms, 131 authorization decisions and 137 refusal decisions were issued. Thus, about 98 data controllers and 131 personal data filing systems were registered in the Register of evidence of personal data controllers, which indicates an increased interest of data controllers to comply with the rules established by Law no. 133 of July 8, 2011 on  personal data protection, compared to the previous period.

4. European and international news

 In the period May to July, 2020, several plenary sessions of the European Data Protection Board were held. The meetings took place remotely, each of them addressing one or two topics. Among the most important are: the 25th and 26th plenary sessions, which focused on the EDPS letter on the Polish presidential election by postal vote and the decrees of the Hungarian government on coronavirus during the state of emergency. The 28th plenary session, which discussed topics such as: the letter from Amazon to the President of the EDPB on the COVID-19 project, the processing of personal data for the purpose of reopening EU borders in the context of COVID-19, the website of the EDPB – the publicly available summaries of art. 60.  The 34th meeting, which discussed: Decision SCHREMS II of the European Court of Justice, Decision of the French Council of State on the guidelines on CNIL cookies, Decision of the French Council of State on the sanction of Google. GOOGLE / FITBIT merger, transparency of EDPB minutes.

5. Other data protection authorities

During the above-mentioned period, several European data protection authorities carried out investigations which led to the imposition of administrative fines on data controllers in various sectors of activity. Regarding this aspect, the following should be mentioned:

–          an administrative fine of 120 000 Swedish kronor (approx. 11 000 euro) against the Healthcare Committee in Region Örebro County is imposed by the Swedish Data Protection Authority for wrong publishing on the region’s website sensitive personal data about a patient admitted to a forensic psychiatric clinic.

–          a fine of 50 000 Danish kroner against the Danish recruitment company JobTeam has been proposed by the Danish Data Protection Authority for not metting the basic requirements of the General Data Protection Regulation (GDPR) that personal data must be processed lawfully, fairly and transparently.

–          an administrative fine of 72 000 EUR on Taksi Helsinki is imposed by the Finnish Data Protection Authority for processing the personal data of drivers, staff and the customers of its drivers with a camera surveillance system that records both video and audio, that was not in line with the GDPR’s principle of data minimisation.

–          a fine of 5 000 EUR on a candidate in local elections is imposed by the Litigation Chamber of the Belgian Data Protection Authority for using the staff registry of a municipality to send election propaganda (in the form of a letter) to staff members.

–          a fine of 10 000 EUR on a controller is imposed by the Belgian Data Protection Authority for sending a direct marketing message to the wrong person and for not responding adequately to the data subject’s subsequent request for access to his data.

–          a fine of 800 000 EUR on a Dutch organization is imposed by the Netherlands Data Protection Authority for failing to comply with the right of access of data subject. Specifically, the entity in question charged an annual amount for accessing that data online, and if they wanted to receive that information by mail, applicants could obtain it free of charge, but only once a year.

–          a fine of 600 000 EUR on Google Belgium is imposed by the Belgian Data Protection Authority for not respecting the right to be forgotten of a Belgian citizen, and for lack of transparency in its request form to delist.