The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine of 865,000 euros imposed by the Finnish Data Protection Authority (SA) on Aktia Bank for violating Article 5 (Principles relating to processing of personal data), Article 25 (Data protection by design and by default) and Article 32 (Security of processing) of the GDPR.

       Aktia Bank’s strong electronic authentication service suffered an outage due to a technical change in January 2023. During the short-term outage, some people who logged into various services using Aktia Bank’s online banking credentials had access to the personal data of other customers because the service confused the identities of the people. The security breach affected various public services, unemployment funds, insurance companies, and healthcare providers. Many of these services contain highly confidential information, such as health and financial data, thus affecting approximately 350 people. To date, no misuse of this data has been reported.

       The investigation highlighted deficiencies in: the design and implementation of the technical change, insufficient testing of the new system, and the lack of adequate change management. More extensive testing and the use of standard methods could have prevented the incident.

       In this context, the Finnish SA imposed an administrative fine of EUR 865,000 on the controller for failure to comply with the requirements of data protection legislation regarding the safe processing of personal data and data protection from the moment of design and by default. A reprimand was also issued.

       NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

       The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine of 100,000 euros applied by the Italian Data Protection Authority (SA) to the company Banco Bilbao Vizcaya Argentaria SA for violating Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 15 (Right of access by the data subject) of the GDPR.

       A bank customer, a victim of fraud, requested access to the records of calls made to the customer service, which were essential for contesting a transfer of approximately 10,000 euros and for clarifying the circumstances of the incident. As the bank did not provide a satisfactory response within the legal deadline, the customer filed a complaint with the Italian SA. The records were only transmitted after the Authority initiated an investigation, thus exceeding the 30-day deadline provided for by the GDPR.

       During the investigation, the Italian SA emphasized that, in accordance with the Guideline 01/2022 of the European Data Protection Board on the right of access, including telephone calls between customers and banks constitute personal data. Therefore, they must be made available to the data subject upon request, while respecting the rights of any third parties involved.

       In this context, the Italian SA imposed an administrative fine of 100,000 euros on the company Banco Bilbao Vizcaya Argentaria SA. When setting the amount of the fine, the Authority took into account the bank’s turnover, its cooperation during the investigation and the absence of previous infringements.

       NCPDP, as the national supervisory authority for the processing of personal data, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on the protection of personal data and to ensure that personal data processing operations comply with the legislation in force.

       On December 11, 2025, the National Center for Personal Data Protection (NCPDP) held a training session in the field of personal data protection for representatives of the Ministry of Infrastructure and Regional Development (MIRD), organized at the request of the institution.

       The event aimed to strengthen the capacities of MIRD staff in terms of the correct and responsible implementation of legal requirements in the field of data protection, thus ensuring a high level of compliance and a unified approach in internal processes for processing information containing personal data.

       During the training session, the most relevant aspects of the national and european regulatory framework were analyzed and explained, including: the fundamental principles of personal data processing; the legal grounds that allow data processing in the activity of public authorities; the responsibilities of the controller and the authorized persons; risk assessment and application of appropriate technical and organizational measures; transparency and information of data subjects; management of security incidents and their notification.

       The training contributed to harmonizing MIRD’s internal practices with the regulations in force, facilitating an institutional culture based on personal data protection and accountability. The event provided participants with clarity on how they can prevent processing errors, but also on their obligations in their daily activities.

       Participants highlighted the following key benefits of the training:

• the need to review and update internal procedures;
• the importance of properly documenting processing processes;
• the critical role of cross-departmental cooperation in ensuring compliance;
• the relevance of applying a proactive approach in preventing security incidents and protecting the rights of data subjects.

       NCPDP reaffirms its commitment to supporting public authorities in the correct implementation of data protection standards and remains open to future collaborations dedicated to strengthening the culture of personal data protection in the Republic of Moldova.

       The event was attended by 38 representatives from the Ministry of Infrastructure and Regional Development.

       On December 12, 2025, the National Center for Personal Data Protection (NCPDP) held a training session in the field of personal data protection for representatives of the Ministry of Culture (MC), organized at the request of the institution.

       The purpose of the training session was to strengthen the level of knowledge and application of legal norms regarding data protection in the current activities of the MC, especially in the context of managing information regarding employees, beneficiaries, artists, participants in cultural projects and other categories of data subjects.

       During the session, NCPDP experts presented essential topics such as: the fundamental principles of personal data processing; the legal bases applicable to activities specific to the cultural sector; the technical and organizational measures necessary to ensure data protection; good practices in data management within cultural events and projects; institutional obligations regarding transparency, data security and notification of security incidents.

       The training was of significant importance for MC, given the multitude of situations in which personal data is processed in the cultural and administrative activities of the institution. Compliance with legal requirements contributes to: protecting the rights of data subjects; secure management of sensitive information; increasing public trust in public institutions; alignment with national and european standards in the field of data protection.

       The lessons learned from the training course highlighted the need to:

• strengthening an organizational culture oriented towards data protection;
• updating internal procedures regarding the collection, storage and use of personal data;
• increasing attention to the risks associated with non-compliant processing;
• ensuring transparent communication with data subjects;
• continuously developing staff skills to meet the challenges of the cultural sector.

       NCPDP reaffirms its commitment to supporting public institutions through training and specialized assistance, contributing to the development of an efficient data protection system at the national level.

       During the event, 32 representatives from the Ministry of Culture were trained.

       On December 10, 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for representatives of the State Social Inspectorate, at their request.

       The goal of the training session was to provide participants with an in-depth understanding of the legal framework regarding the protection of personal data, as well as how it applies to activities specific to the social field. The training covered both theoretical aspects  processing principles, data subjects’ rights, responsibilities of controllers and processors  and practical components, oriented towards solving real situations encountered in professional activity.

       The importance of this training session derives from the growing need to ensure responsible management of personal data, especially in a sector where varied and sensitive categories of information are processed. In the context where the digitalization of public services is continuously expanding, and data security risks are becoming more complex, the training offered by NCPDP represents an essential tool for preventing incidents, protecting vulnerable people, and strengthening trust in state institutions.

       During the session, participants benefited from practical examples, personalized recommendations for their field of activity, as well as clarifications on the management of high-risk situations. Topics addressed included: assessing the compliance of processing processes; correct application of technical and organizational security measures; institutional responsibilities regarding the transparency and legality of processing; preventing breaches and managing security incidents, etc.

       Following the training session, representatives of the State Social Inspectorate obtained significant benefits, such as:

• improving the ability to correctly identify and manage personal data in operational processes;
• strengthening the skills of risk assessment and application of security measures;
• increasing the degree of accountability regarding compliance with the national and european legal framework;
• forming a unified perspective on how data protection contributes to the efficiency of institutional activity.

       NCPDP reaffirms its commitment to support public institutions in the process of correct implementation of data protection rules and to promote an institutional climate based on respect for the fundamental right to privacy.

       The event took place online, with 18 representatives of the State Social Inspectorate being trained.

       On December 3, the National Center for Personal Data Protection (NCPDP) held a training session for employees of the Ocnița Police Inspectorate (PI), thus marking the completion of the training program planned for 2025 within the subdivisions of the General Inspectorate of Police (GPI). The annual program was approved and signed by the heads of the NCPDP and the GPI on January 28, 2025.

       The main objective of the training session was to strengthen the capacities of PI Ocnița employees to correctly and responsibly apply the rules on personal data protection in operational and managerial activity. The NCPDP aimed to ensure a uniform understanding of the legislation, promote an organizational culture oriented towards respecting the rights of the data subjects and preventing security incidents.

       Participants were trained on: the fundamental principles of personal data processing and the obligations of law enforcement institutions; correct practices for collecting, storing and transmitting data in specific police activities; identification of high-risk situations and the necessary measures to reduce them; the importance of transparency, legality and data minimization in all operations carried out; reporting and response procedures in case of data security incidents.

       The training discussed real case studies and operational scenarios, which allowed participants to understand the impact of non-compliance with data protection rules and identify practical solutions applicable in everyday work.

       Completing this annual training program brings an important set of benefits to GPI subdivisions, such as:

•  Increasing the level of compliance with national and european data protection legislation;
• Reducing operational risks associated with the processing of sensitive data in law enforcement and investigative activities;
• Improving the quality of services provided to citizens by adopting responsible and transparent practices;
• Strengthening the organizational culture towards data protection and the protection of fundamental rights;
• Streamlining internal collaboration by clarifying roles, obligations and procedures in the field of data protection.

       The successful completion of all training sessions planned for 2025 confirms the joint commitment of the NCPDP and the GPI to promote a safe, professional and human rights-oriented environment in all personal data processing processes.

       During the event, 50 representatives of the Ocnița Police Inspectorate were trained.

       On November 25, 2025, the National Center for Personal Data Protection organized a training session entitled “Protection of personal data within data recording information systems” for deputies of the 12th legislature, staff from the offices of persons with public dignitaries, including civil servants from the Secretariat, at their request.

       The purpose of the training was to consolidate knowledge regarding legal requirements and good practices in the field of data protection, especially in the context of the use and administration of information systems that manage large volumes of personal data. Participants were familiarized with the institutional and individual obligations arising from national and european legislation, as well as with the essential principles of data processing – from legality and transparency, to security and accountability.

       The event addressed a series of essential topics for strengthening good practice in the field of personal data protection, such as: clarifying general concepts specific to this field, exercising the rights of data subjects, the principles and legal bases governing data processing, and the responsibilities related to the designation and role of the Data Protection Officer. Particular emphasis was placed on access to information of public interest, analyzed from the perspective of data protection legislation. The discussions focused on how a balance can be ensured between the public’s right to information and the need to protect personal data, in particular by applying the principle of proportionality  when deciding to disclose information. At the same time, the rules regarding the correct limitation of access were examined, as well as the obligations related to the retention, storage and use of data after the completion of processing operations, so that their disclosure or archiving fully complies with legal requirements.

       Participants benefited from an interactive session, which resulted in several conclusions and strengthened skills, including: in-depth understanding of institutional and individual responsibilities regarding the protection of personal data; identification of typical risks associated with the use of information systems of record and ways to mitigate them; the need to implement appropriate technical and organizational measures, including access control, clear internal policies and periodic audit programs; the importance of respecting the principles of data minimization, accuracy and limited time retention and improving internal communication and cooperation with the Data Protection Officer for the correct management of processing situations.

       Through this initiative, NCPDP reaffirms its commitment to supporting public institutions in developing the necessary skills for secure, transparent and responsible management of personal data, thus contributing to protecting the fundamental rights of citizens.

       The event was attended by 90 representatives from the Secretariat of the Parliament, including staff from the offices of persons with public dignitaries and deputies from the 12th legislature.

       On December 3, the National Center for Personal Data Protection (NCPDP) continued the national campaign to inform and raise awareness among students regarding the protection of privacy in the digital environment. In this context, the institution organized the training course “Protection of personal data and children’s safety in the online environment”, intended for students of the Art School in Ialoveni.

       The main objective of the activity was to familiarize children with the notion of personal data, as well as to understand how this information should be managed in everyday life. NCPDP trainers focused on:

• explaining the difference between simple personal data, sensitive data and public information;
• identifying situations in which children’s data may be collected or used abusively;
• understanding the rights that minors have in relation to data protection and digital safety.

       The crucial goal of the session was to develop self-protection skills in the online environment, so that students would be aware of the importance of prudent and responsible behavior when interacting on the internet.

       In an ever-changing digital context, children are among the most exposed to various online risks – from excessive data collection to cyberbullying, phishing, or contact with unknown people. Through this course, students:

•  understood why data such as full name, address, phone number, photos, location or passwords must be carefully protected;
• found out how their information can be used by malicious individuals, including for manipulation or fraud purposes;
• discovered the role of privacy settings, strong passwords and checking sources before accessing a link or sharing content.

       The emphasis was on the idea that digital safety is a personal responsibility, and knowing how the online environment works helps them navigate with more confidence and protection.

       The course included interactive discussions, practical examples, and real-life situations that children may face in the digital environment. Among the most important concepts learned are: recognizing personal data and understanding its value; identifying the risks associated with the uncontrolled distribution of online information; critically evaluating digital content, unknown messages and suspicious requests; protective measures: correct use of passwords, activating two-step authentication, reporting abusive behavior; the role of trusted adults – the importance of asking for help when encountering uncomfortable or potentially dangerous situations. Students actively participated in the discussions, asked questions and provided examples from their own experiences, demonstrating interest and openness to the topics addressed.

       Through such activities, NCPDP reaffirms its mission to contribute to creating a culture of data protection among children and young people, promoting a safe, responsible and friendly digital environment. The institution will continue to conduct training in schools across the country, providing accessible information adapted to the age level of the students.

       The event was organized at the initiative of the National Council for the Protection of Children and Youth, training 55 students. At the same time, the information materials, as well as the gifts offered to the students, were developed with the support of the United Nations Children’s Fund (UNICEF).

       On November 21, 2025, the National Center for Personal Data Protection organized a training session in the field of personal data protection for employees of the General Inspectorate for Migration (GIM), Center Regional Directorate, according to the training plan within the GIM for 2025, approved and signed by the heads of the NCPDP and GIM on January 27 of this year.

       The training aimed to familiarize participants with the fundamental principles of data protection, strengthening knowledge regarding institutional and individual obligations in the process of processing personal data, identify risks and apply appropriate security measures, as well as increase the level of responsibility in relation to the management of data of citizens and foreigners undergoing migration procedures.

       For GIM representatives, training is a fundamental element in guaranteeing:

• Operational compliance with data protection legislation, given the essential role of the GIM in managing migration flows, documentation and record-keeping processes, as well as specific databases.
•  Increasing the level of institutional security, by reducing the risk of security incidents and by strengthening an internal culture of accountability and transparency.
• Continuous capacity-building for employees, which contributes to a more efficient execution of job duties and to the improvement of services provided to citizens, asylum seekers and migrants.
• Adapting to new regulatory and technological developments, in a context in which the digitalization of processes and the inter-institutional exchange of information are becoming increasingly complex.

       Participants benefited from an interactive session, which resulted in several conclusions and strengthened skills, including: in-depth understanding of data processing principles and their application in daily work, including in documenting migrants, managing files and using internal information systems; awareness of the importance of data minimization, limited access only to authorized persons and the need to justify each processing operation; acquisition of practical knowledge on preventing incidents, such as unauthorized disclosures or illegal access to systems; understanding of the institution’s obligations regarding the communication of security incidents, including the procedures for notifying the NCPDP and informing data subjects when necessary; strengthening the skills to respect the rights of data subjects, especially in complex situations specific to the field of migration, where transparency and fairness of data processing are essential for protecting vulnerable persons.

       During the event, 16 representatives from GIM, Center Regional Directorate, were trained.

       Through such training, NCPDP reaffirms its commitment to constantly support GIM employees in the correct application of data protection rules, to provide them with professional support and practical tools for secure information management, and to contribute to the development of a responsible institutional culture in the field of personal data protection.

       On November 18, 2025, the National Center for Personal Data Protection (NCPDP) organized a training session in the field of personal data protection for the employees of the Nisporeni Police Inspectorate, according to the training plan within the IGP subdivisions for 2025, approved and signed by the leaders of the NCPDP and IGP on January 28 of this year.

       The purpose of the training session was to strengthen the professional capacities of the employees of the Nisporeni Police Inspectorate in the field of personal data protection, by deepening the applicable regulatory framework, as well as by familiarizing them with European standards and good practices in the field.

       The training session aimed to ensure a uniform and correct application of data protection legislation in specific police activities, in the context in which IGP representatives manage sensitive information on a daily basis, in exercising their duties of preventing, detecting and investigating crimes. Therefore, the session focused on developing a consolidated institutional culture in the field of data protection, aimed at supporting both employee professionalism and respect for the fundamental rights of data subjects.

       During the session, NCPDP trainers addressed an extensive set of topics relevant to police activity, such as: the application of the principles of legality, fairness, proportionality and data minimization in current operations; the particularities of processing sensitive data and information regarding persons at risk; the obligation to rigorously document processing activities and the importance of internal registers; the responsibilities of employees in daily activity, as well as the role of the Data Protection Officer; prevention and reporting of security incidents, with an emphasis on prompt response and institutional cooperation.

       The importance of training for employees of the Nisporeni Police Inspectorate derives from the need for responsible, legal and proportionate management of citizens’ personal data, in a complex operational context, characterized by accelerated digitalization, inter-institutional information exchanges and exposure to risks associated with data security. The training contributes to strengthening the capacity of the Nisporeni Police Inspectorate to prevent security incidents, ensure the transparency of internal processes, and maintain a high level of public trust in police activity.

       Among the lessons learned from the training are: strengthening the understanding of the need to strictly comply with data protection legislation in all operational activities; awareness of the risks associated with data processing without legal basis or outside the established limits; recognition of the essential role of transparency and accountability in internal processes; appreciation of the importance of effective communication with the NCPDP and continuous training as a fundamental element in ensuring compliance.

       The NCPDP reaffirms its commitment to support, through systematic training and specialized expertise, all IGP subdivisions in the joint effort to promote compliance, professionalism and the protection of the fundamental rights of the citizens of the Republic of Moldova.

       During the event, 57 representatives of the Nisporeni Police Inspectorate were trained.