The year 2021 marks 40 years since the adoption, in 1981, in Strasbourg, of Convention 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data.

The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data represents an international instrument that engages responsibility and protects individuals from abuses that may occur during data collection and processing, and raises the task of regulating the cross-border data flows.

The Republic of Moldova signed this Convention 108 on May 4, 1998 and ratified it by the Parliament Decision No. 483-XIV of July 2, 1999, and it is in force in our country since June 1, 2008. The Republic of Moldova has designated the National Center for Data Protection with Personal Character as a competent authority for the implementation of the provisions of the Convention and for maintaining relations of mutual assistance with other Parties.

In this context, the National Center for Personal Data Protection (Center) informs that the objective of the authority remains the same – informing data subjects about their rights and holding personal data controllers responsible for complying with the relevant legislation.

The retrospective of the year 2020 indicates the following basic aspects in the activity of the Personal Data Protection Authority:

The Center examined 833 complaints submitted by individuals – subjects of personal data, i.e. 12% more compared to the previous year. Most complaints concerned the following topics:

– realization of the rights of personal data subjects (access, information, intervention, opposition),

– processing of personal data through video / audio surveillance systems,

– processing of personal data stored in various state information resources, etc.

During 2020, the Center examined 1472 notifications submitted for registration in the Register of evidence of personal data controllers, both personal data controllers and filing systems stored in automated and / or manual form in which personal data are processed.

Regarding the control of compliance of personal data processing with the requirements of the Law on personal data protection, in 2020, more than 300 control materials were initiated and examined, both based on complaints of personal data subjects, notifications / self-notifications , as well as on the basis of requests for authorization of the cross-border transmission of personal data.

Even though 2020 was a year of challenges, emerging from the global pandemic situation, the Center sought to focus on strengthening bilateral and multilateral relations with external partners, both within international organizations and individually. To achieve this, the Centre’s staff participated in the working meetings of the European Data Protection Board and the plenary meetings of the Council of Europe. At the same time, during 2020, the Center applied and obtained the support from the TAIEX Project – on the organization of the workshop: “Processing and protection of personal data in the field of public health, in the context of possible global challenges! (COVID-19 pandemic) ”. This event is currently taking place in online format (January 26-28).

In terms of training, the Center held multiple working meetings with representatives of public and private institutions on issues related to: assistance in developing codes of conduct in various areas of activity, examination of sectoral laws, guidance and consulting, etc. At the same time, the representatives of the Center organized trainings attended by about 500 people both from Chisinau and from the districts of the Republic of Moldova.

The storage period as well as the disclosure of health data in the context of the COVID-19 pandemic – among the topics of interest discussed during the workshop “Processing and protection of personal data in the field of public health in the context of possible global challenges! (COVID – 19 pandemic)”, conducted online over three days (January 26,27,28).

Denis Coțofan, Deputy Head of the Legal Department, NCPDP spoke during the event about the requirements of personal data protection legislation in the health sector at national level, the processing of special categories of personal data, as well as the legal grounds of the processing of health data. In this context, Mr. Coțofan answered the questions of the participants regarding the video surveillance in hospitals, the storage period of the information obtained after the video surveillance containing personal data, but also regarding the processing of health data in the context of the pandemic COVID-19. Furthermore, recommendations were presented for employees in the health sector in order to apply security measures related to the personal data protection.

Jelena Siminiati, Assistant Director of Legal Affairs Clinical Hospital Center Rijeka, Croatia mentioned during the workshop about the EU experience on the legality of personal data processing  by the competent public authorities in the context of the pandemic COVID – 19, patients’ rights, obligation of confidentiality, as well as the balance between public health and security and the right to the personal data protection.

An important aspect in combating the pandemic COVID – 19, according to Mr. David Balla, Director of Reimbursement system, DRG Team, Ministry of Health, Slovakia, would be use of location data and contact tracing tools. Furthermore, Mr. Balla exposed himself on topics such as disclosure of personal data, data minimisation and storage limitation.

The workshop was moderated by personal data protection experts from Croatia, Slovakia and representatives of the NCPDP and was organized for three regions of the country: central, northern and southern. The event was attended by about 200 persons.

The workshop was organized and funded by the Technical Assistance and Information Exchange instrument of the European Commission (TAIEX).

Personal data are processed at any time worldwide – at work, by public authorities and private entities, in the field of health, when trading goods or services, while traveling outside the country or when data subjects surf the Internet.

Data Protection Day is celebrated every year, on January 28. On this occasion, the national authorities responsible for ensuring the protection of personal data organize specific activities to draw attention to the rights and responsibilities regarding the personal data protection. These activities include campaigns aimed at the general public.

Thus, in the context of Data Protection Day, a few employees of the National Center for Personal Data Protection (NCPDP) distributed to passers-by, near the Cathedral Square, information materials on the importance of personal data protection. During the action, citizens were informed about personal data, the rights of personal data subjects, security and confidentiality measures when processing data. At the same time, people have been made aware of possible abuses and consequences of situations in which personal data may be taken by violating the provisions of national law in the field by personal data controllers.

This year, NCPDP aims at organizing several activities to inform the public about the protection of personal data, but also to ensure the development of a constructive and permanent dialogue with all stakeholders in order to identify optimal solutions for the correct application of legal rules in the field of data protection.

Dear citizens,

January 28 is a special day for the personal data protection. On 28 January 1981, in Strasbourg, was adopted the Convention no. 108 for the protection of individuals with regard to the automatic processing of personal data. Subsequently, on 26 April 2006, the Committee of Ministers of the Council of Europe decided to launch a Data Protection Day, which would be celebrated every year on 28 January. Thus, January 28 was declared – Data Protection Day. Every year, the member states of the Council of Europe organize various public activities and events to celebrate this day.

Respectively, the Republic of Moldova celebrates this event together with all European states. Although the field of personal data protection is a relatively new one for the society of the Republic of Moldova, however, in the last decade we have managed to make great steps in ensuring respect for the right to privacy, in terms of personal data processing, as well as regarding our efforts to comply with European standards in the field of personal data protection.

This year, NCPDP will continue to inform data subjects and to hold controllers accountable for complying with the provisions of the relevant legislation. Although the year 2020 was marked by the COVID-19 pandemic, NCPDP representatives continued to conduct online training, both in Chisinau and in the country. Over 500 people from various fields were trained within these activities. The trainings were focused most on the following fields: central and local public administration, health, police, social sphere and labor law.

For 2021, the objectives of the NCPDP are: continuation of information campaigns in the country, training and education of personal data protection officials in the public and private sector. We will ally with parents to raise awareness of personal data protection, we will continue to monitor how data protection rights are respected, we will continue to promote the new draft law on personal data protection for voting in final reading by the Parliament of the Republic of Moldova.
Dear citizens, for me it is important to involve everyone! I urge you to pay special attention to the protection of personal data and the rights of personal data subjects, and if you have noticed situations of improper processing of data concerning you, contact the National Center for Personal Data Protection.

Take care of your data!

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine, equivalent to 460 thousand euros applied by the Poland Personal Data Protection Office (UODO) to the Polish mobile phone company, Virgin Mobile Polska for the lack of adequate technical and organizational measures implemented to ensure the security of the processed data.

UODO stated that the company infringed the principles of data confidentiality and accountability. Virgin Mobile did not carry out regular and comprehensive tests, measurements and evaluations of the effectiveness of the technical and organisational measures applied to ensure the security of the data processed. Activities in this regard were only undertaken when there were suspicions of vulnerability or in connection with organisational changes. Moreover, no tests were carried out to verify safeguards related to the transfer of data between applications related to the servicing of buyers of prepaid services. In addition, the vulnerability associated with data exchange in these systems was used by an unauthorised person to obtain data from some of the company’s clients.

In connection with a data breach, as a result of which an unauthorised person obtained customers data from one of the databases, the Supervisory Authority carried out the inspection at the company. As a result of the irregularities found, the authority instituted administrative proceedings finalised with the imposition of a fine.

The Supervisory Authority considered that the implementation of a data processing system for use without proper validation of assumed parameters was a flagrant breach by the controller.

However, given the scale and gravity of the breaches, the UODO considered that it would be disproportionate to apply remedies other than an administrative fine.

The NCPDP, as the national authority for the supervision of personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

Today, the National Center for Personal Data Protection (NCPDP) in collaboration with TAIEX project experts organizes the online workshop – “Processing and protection of personal data in the field of public health in the context of possible global challenges” (pandemic COVID – 19). The event will last three days (January 26,27,28).

The aim is to strengthen and enhance the skills of public health representatives on possible challenges that may arise globally (in the context of the pandemic COVID – 19), while respecting the fundamental rights and freedoms of individuals on personal data protection. This includes: when the processing is necessary for reasons of public interest in the area of public health, in adopting good practices based on relevant case law; setting a balance between the processing, storage, and disclosure of health data and the right to privacy; promoting clarity and specialized analysis, oriented towards the provisions of the law on personal data protection in the specific field of application. Concerning health, aim is familiarization of medical representatives with the new challenges related to the processing of personal data.

The workshop will be conducted by personal data protection experts from Croatia, Slovakia and representatives of the NCPDP and will be organized for three regions of the country: central, northern and southern. Amongst the topics addressed by the experts are: the definition of personal health data, the processing of special categories of personal data and the legal basis for the processing of personal health data.

About 300 people from the three regions of the country are expected to participate in the event.

The workshop is organized and funded by the Technical Assistance and Information Exchange Instrument of the European Commission (TAIEX).

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine equivalent to 20 000 euros, applied to the Polish insurance company, Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. The sanction was applied for violating the provisions of the General Data Protection Regulation.

In May 2020, the Personal Data Protection Office of Poland (UODO) received information from a third party about the personal data breach, which consisted in sending by e-mail an insurance policy by an insurance agent, being a processor for the WARTA S.A. Insurance and Reinsurance Company, to an unauthorized addressee.

The attached document contained personal data as: names, surnames, addresses of residence, PESEL numbers (personal identification numbers) and information concerning the subject matter of insurance (passenger car).

At the request of the supervisory authority, the insurance company confirmed that there had been an incident related to a personal data breach, yet the fined company considered that the breach did not require notification to the UODO.

When imposing an administrative fine, the President of the UODO also took into account that the company asked the wrong recipient to permanently delete the correspondence received. However, it is worth mentioning that a request for deletion of data is not tantamount to guaranteeing that the data is actually erased by an unauthorized person and does not preclude possible negative consequences of their use.

The NCPDP, as the national authority for the supervision of personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount EUR 250,000 applied by Polish Data Protection Authority to ID Finance Poland for loss of confidentiality of the personal data principle.

In the proceedings, the President of the Personal Data Protection Office (UODO)  established that the breach took place following the failure to restore the appropriate security configuration after one of the servers operated by the processor  was restarted. The controller was notified about this by one of its cybersecurity specialists, who detected the vulnerability and indicated sample, publicly available information. ID Finance Poland did not immediately check the system’s identified vulnerabilities and, as a result, a few days later, the data was stolen from this server.

When imposing the fine, the UODO took into account the scale of the breach and the scope of the stolen data. In addition, because unencrypted passwords have also leaked, it is possible to use these data to log in to different customer accounts, if they used the same login (e.g. e-mail) and password on other websites. In establishing the amount of the fine, Polish Data Protection Authority also took into account the controller’s delay in taking preventive measures. The amount of the fine should fulfil both a repressive and a preventive function. In the opinion of the authority, it should prevent similar breaches in the future both in the penalized company and at other controllers’.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 450,000 applied by Data Protection Commission to Twitter International Company for the infringement of Article 33(1) and 33(5) of GDPR.

The Data Protection Commission (DPC) investigation commenced in January, 2019 following receipt of a breach notification from Twitter and the DPC has found that Twitter infringed Article 33(1) and 33(5) of the GDPR in terms of a failure to notify the breach on time to the DPC and a failure to adequately document the breach. The DPC has imposed an administrative fine of €450,000 on Twitter as an effective, proportionate and dissuasive measure.

The draft decision in this inquiry, having been submitted to other Concerned Supervisory Authorities under Article 60 of the GDPR in May of this year, was the first one to go through the Article 65 (“dispute resolution”) process since the introduction of the GDPR and was the first Draft Decision in a “big tech” case on which all EU supervisory authorities were consulted as Concerned Supervisory Authorities.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fines in the amount 100 million EUR and 35 million EUR applied by French Data Protection Authority (CNIL) to Google and Amazon for the  unlawful use of cookies. The fines resulted from two separate investigations carried out by CNIL in relation to the use of cookies on the French websites of Google and Amazon.

CNIL fined Google LLC for 60 million EUR, and Google Ireland Ltd (Google’s headquarters) for 40 million EUR. Combined, these fines are the largest ever sanction handed out by the CNIL. Both Google LLC and Google Ireland Ltd were deemed jointly responsible for the use of cookies as both were considered to exercise decision-making power in relation to personal data processing concerning users located in France.

CNIL also fined Amazon Europe Core, a company registered in Luxembourg and belonging to the Amazon group, the largest online retailer, with 35 million EUR, for the infringement of local legislation on “cookies”.

The French Data Protection Authority specified that the French sites of Google and Amazon did not require the consent of visitors before these cookies were saved on their devices and did not provide internet users with clear information on how the two companies intend to use the results of websites navigation and how the visitors of French sites may refuse the use of cookies.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.