Today, July, 7 the National Center for Personal Data Protection (NCPDP) in collaboration with TAIEX project experts organizes the National Conference “The impact of new technologies, caused by the COVID – 19 pandemic, on personal data protection in the public sector”. Based on the global situation of the SARS-COV-2 pandemic, the event takes place online.

The aim of the workshop is to present the aspects of the impact of technologies in the field of personal data protection. The event will serve as an opportunity for a sharing of experience and good practices on raising awareness and informing the public sector about cybersecurity and the impact of new technologies caused by the COVID-19 pandemic on personal data protection, to a state institution.

The workshop is conducted by personal data protection experts from Italy, Latvia and Lithuania. Amongst the topics addressed by the experts are: current challenges regarding personal data protection for the public sector (EU experience); requirements of data protection legislation at international level; the difference between data privacy and data security; steps taken by public institutions to protect citizens from personal data breaches, data breach notifications; obligation of secrecy; national cyber security governance framework (NIS directive), as well as overview of cyber security incidents that has impact on personal data.

The event is attended by about 70 representatives of the public sector.

The workshop is organized and funded by the Technical Assistance and Information Exchange Instrument of the European Commission (TAIEX).

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 49th Plenary Session of the European Data Protection Board (EDPB), which was held online on 19 May, 2021.

During the Plenary, the EDPB adopted several documents, among which:

·        Two Opinions on the first draft decisions on transnational Codes of Conduct presented by the Belgian Supervisory Authority (draft decision concerns the EU CLOUD Code of conduct, addressed to cloud service providers) and French Supervisory Authority (draft decision concerns the CISPE Code of conduct, addressed to cloud infrastructure service providers). These Codes aim to provide practical guidance and define specific requirements (Art. 28 GDPR) for processors in the EU subject to these Codes. They are not to be used in the context of international transfers of personal data. The EDPB is of the opinion that both draft codes comply with the GDPR and fulfil the requirements set forth in Art. 40 and 41 GDPR.

·        Statement on the Data Governance Act (DGA) in light of developments in the legislative process. The EDPB reiterates that, without robust data protection safeguards, there is a risk that the trust in the digital economy would not be sustainable. The statement further highlights the need to ensure consistency of the DGA with the EU data protection acquis and urges the co-legislators to carefully consider certain aspects, such as the interplay between the DGA and the GDPR, and the importance of ensuring that the new definitions and concepts are not incompatible with the GDPR.

·        Recommendations on the legal basis for the storage of credit card data for the sole purpose of facilitating further online transactions. The recommendations cover situations in which data subjects buy a product or pay for a service via a website or an application and provide their credit card data in order to conclude a unique transaction. As such, consent in accordance with Art. 6 (1) (a) GPDR should be considered the sole appropriate legal basis for storing credit card data after the purchase.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

Every year, on 9 May, Europe Day is celebrated, a celebration of peace and unity in Europe. The date marks the anniversary of the historic Schuman Declaration, this year marking the 71st anniversary of its signing. At a speech in Paris in 1950, Robert Schuman, the then French foreign minister, set out his idea for a new form of political cooperation in Europe, which would make war between Europe’s nations unthinkable. Robert Schuman’s proposal is considered to be the beginning of what is now the European Union. To mark Europe Day, the EU institutions open their doors to the public in early May in Brussels and Strasbourg. Local EU offices in Europe and all over the world organise a variety of activities and events for all ages.

The National Center for Personal Data Protection (NCPDP), next to the other institutions from the Republic of Moldova as well as from the EU, participates every year in the celebration of Europe Day, organizing various events to raise public awareness about the EU. During the years of activity, NCPDP followed the European vector, collaborated closely with the EU institutions, and received support from them.

Only during 2021, NCPDP, in collaboration with the Technical Assistance and Information Exchange instrument (TAIEX), organized on January 26-28, the workshop entitled “Processing and protection of personal data in the field of public health in the context of possible global challenges! (COVID – 19 pandemic) ”, for the representatives of the Ministry of Health, Labor and Social Protection, Medical Institutions, Ministry of Justice, Ministry of Internal Affairs, General Inspectorate of Police of the North, Center and South of the country. During the event, about 200 participants were trained. At the same time, on July 10, the conference “The impact of new technologies, caused by the COVID – 19 pandemic, on personal data protection in the public sector” will be organized.

These events, organized with the support of the TAIEX team, serve as an opportunity for the exchange of experience and good practices with EU experts on raising awareness and informing the public sector on personal data protection in the context of the COVID – 19 pandemic.

Furthermore, international cooperation continues to be the promoter of the NCPDP’s institutional development objectives. Successes in this regard have been achieved through the exchange of experience, knowledges, good practices with data protection authorities, training provided by EU experts, the takeover and implementation of international personal data protection standards. Cooperation, both at European and international level, is a strategic issue that requires involvement in all ongoing initiatives. In this context, NCPDP regularly participates in the Plenary Meetings of the European Data Protection Board and the Meetings of the Bureau of the Committee of Convention 108.

During the last years, various meetings have been organized within the NCPDP with the ambassadors of the EU member states: Latvia, Germany, Romania, as well as with the ambassador of the EU Delegation in the Republic of Moldova, for the purpose of familiarizing them with the NCPDP activity as the National Authority for the Supervise the Conformity of the Processing of Personal Data, the implementation of Convention 108 and related legislation, as well as in the context of ensuring future cooperation.

The NCPDP considers that solidarity is the pillar on which the functioning of the European Union is based and Europe Day marks the values that were at the beginning of the European Union.  Europe Day is about the future of every European citizen, while the EU is a democratic model of values ​​and principles, which have been and remain fundamental to their prosperity.

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about adoption of the Declaration of the Council of Europe’s Committee of Ministers regarding the protection of children’s privacy in digital environment. In the context of the COVID-19 pandemic, European states should enhance safeguarding measures in processing personal data of children, notably health-related data and data collected in education settings, to minimise potential adverse effects, including the public identification of a child.

Furthermore, the Committee of Ministers expressed its concern about the consequences and impact of the COVID -19 pandemic on children as a result of increased online activities and use of online products and services, or of digital exclusion. However, it also acknowledged the opportunities and benefits, such as those presented by remote learning and enabling contact with family and friends. The information and communication technologies, in general, are an important tool in children’s lives, but the use of these technologies can at the same time generate risks. Notably, the traceability of children’s activities in the digital environment may expose them to criminal activities, such as discrimination, bullying, stalking and other forms of harassment.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

Declaration by the Committee of Ministers on the need to protect children’s privacy in the digital environment

The National Center for Personal Data Protection (NCPDP), for information purpose, communicates about the participation of National Center for Personal Data Protection management at the 48th Plenary Session of the European Data Protection Board (EDPB), which was held online on 13 April, 2021.

During the Plenary, the EDPB adopted several documents, among which:

• two Opinions on the draft UK adequacy decisions (Opinion 14/2021  based on the GDPR and Opinion 15/2021 based on the Law Enforcement Directive). The EDPB notes that there are key areas of strong alignment between the EU and the UK data protection frameworks on certain core provisions such as: grounds for lawful and fair processing for legitimate purposes; purpose limitation; data quality and proportionality; data retention, security and confidentiality; transparency; special categories of data; and on automated decision making and profiling.
• Guidelines on the application of Article 65(1)(a) GDPR to delineate the main stages of the procedure and clarify the competence of the EDPB when adopting a legally binding decision on the basis of this Article. The guidelines will be subject to public consultation for a period of six weeks.
• Final version of the Guidelines on the targeting of social media users following public consultation. The aim of the Guidelines is to clarify the roles and responsibilities of social media providers and targeted individuals.
• Statement on international agreements including transfers. The EDPB invites EU Member States to assess and, where necessary, review their international agreements that involve international transfers of personal data to align them with EU data protection law.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the importance of the participation of the Republic of Moldova in the Plenary Sessions organized by the EDPB, as well as the weight of adopted documents.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fine in the amount of EUR 475 000 applied by Dutch Data Protection Authority (DPA) to Booking.com for delay in reporting data breach.

In a telephone scam targeting 40 hotels in the United Arab Emirates (UAE) in December 2018, the criminals persuaded hotel staff to reveal the log-in details for their accounts in a Booking.com system. In this way, the criminals gained access to the data of 4 109 people who had booked a hotel room in the UAE. The data included their names, addresses and telephone numbers, as well as details of their booking.

Furthermore, the criminals were able to access the credit card information of 283 people. In 97 cases, the credit card security code was obtained as well. The criminals also tried to get hold of the credit card information of other victims, by posing as Booking.com staff in emails or on the telephone.

Booking.com was informed of the data breach on 13 January 2019, but did not report it to the DPA until 7 February, which is 22 days too late: data breaches must be reported within 72 hours. The investigation into the Booking.com breach was international in scope, targeting customers from a range of countries. Booking.com’s global headquarters are in the Netherlands, which is why the Dutch DPA performed the investigation, this being coordinated with other European data protection supervisory authorities.

Dutch Data Protection Authority warned it was seeing an explosive increase in the number of hacks aimed at stealing personal data, which in 2020 was 30% higher than in the previous year.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection , for information purpose, communicates about the participation of National Center for Personal Data Protection Director at the 47th Plenary session of the European Data Protection Board , which was held online.

During the Session, The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a Joint Opinion on the Proposals for a Digital Green Certificate. The Digital Green Certificate aims to facilitate the exercise of the right to free movement within the EU during the COVID-19 pandemic by establishing a common framework for the issuance, verification and acceptance of interoperable COVID-19 vaccination, testing and recovery certificates.

With this Joint Opinion, the EDPB and the EDPS invite the co-legislators to ensure that the Digital Green Certificate is in line with EU personal data protection legislation and underline that its use may not, in any way, result in direct or indirect discrimination of individuals, and must be fully in line with the fundamental principles of necessity, proportionality and effectiveness.

In addition, the Joint Opinion includes specific recommendations for further clarifications on the categories of data concerned by the Proposal, data storage, transparency obligations and identification of controllers and processors for the processing of personal data.

Following the findings of the National Center for Personal Data Protection (NCPDP), a real estate company from the Republic of Moldova violated the personal data protection rules in relation to one of its clients.

The NCPDP was notified by a complaint alleging the breach of the principles of personal data protection. The employee of the real estate company published on Facebook the service contract, which contained the personal data of the petitioner (name, surname, IDNP, home address, telephone number), thus, they became public.

Following the actions taken by NCPDP, it was found that a service contract was concluded between the petitioner and the real estate company. Subsequently, there were divergences regarding the execution of the contractual obligations, which generated an exchange of remarks on Facebook. Consequently, the employee of the real estate company published the contract concluded between the parties.

The NCPDP found that by publishing the contract containing the petitioner’s personal data, the aim was to disclose this situation in order to be subject to public debates / opinions, given that the conflict, in essence, is not an event of public interest.

In this order of ideas, analyzing the materials accumulated during the examination of the case, NCPDP issued a decision by which it found the violation of the provisions of art. 4 para. (1) let. a), b) and art. 5 of the Law on personal data protection, by the employee of the real estate company.

On March 30, the National Center for Personal Data Protection (NCPDP), performed a training course for the employees of the Parliament’s Secretariat of the Republic of Moldova to ensure the compliant implementation of the provisions of the legislation on personal data protection within personal data filling systems.

The topics addressed in the training were: general notions on personal data protection, the principles of personal data protection, assurance the security and confidentiality of personal data within the personal data filling systems, general aspects of personal data security, simple and essential security measures and data subjects’ rights.

The employees of the Parliament’s Secretariat were trained by the Interim Deputy Head of the Legal Department, NCPDP, Denis Coțofan, who mentioned during the event about the main aspects regarding the legality of personal data processing. In this context, Denis Coțofan specified a set of rules that a data controller should apply, namely: the processing of personal data on the basis of a legal obligation; the purpose and legal basis of the data processing must be argued in a clear and precise manner; data subjects must be informed that at the basis of personal data processing is the law and that there may be restrictions on the exercise of their rights.

The training course was held online at the request of Parliament’s Secretariat and was attended by 51 employees.

National Center for Personal Data Protection (NCPDP) performed, on March 16, a training course in the field of personal data protection for the employees of the National Insurance Company in Medicine (CNAM) at the request of the institution. The event was attended by about 100 persons.

The topics addressed in the training were: the principles of personal data protection, the rights of the data subjects, the recommendations on identifying the filing systems in which the processing of personal data takes place, the regulatory framework for data protection and implementation of legal requirements in that area.

“If personal data are collected directly from the data subject and at the latest at the time of first disclosure, he must be provided with the following information: the identity of the controller, the purpose of processing for which the data are collected, the recipients of personal data, the existence of the rights of access to data, the right of intervention upon data and the right to object, as well as conditions under which such rights may  be exercised and whether the answers to the questions intended to collect data are mandatory or voluntary, as well as the possible consequences of denial to respond ”, mentioned Denis Coțofan, Interim Deputy Head of the Legal Department of NCPDP.

Any personal data subject has the right to obtain from the controller or processor, upon request and free of charge: the rectification, update, blocking or erasure of personal data, the processing of which does not comply with the law, in particular because of their incomplete or inaccurate nature and the notification of the third parties to whom the personal data have been disclosed, about any operations performed, except where such notification proves to be impossible or involves disproportionate effort towards the legitimate interest that might be violated.

The participants in the training asked questions regarding the practical application of the legislation in the field of personal data protection, including the assurance of the legality of personal data processing in the information systems managed by CNAM.