Personal data are processed at any time worldwide – at work, by public authorities and private entities, in the field of health, when trading goods or services, while traveling outside the country or when data subjects surf the Internet.

Data Protection Day is celebrated every year, on January 28. On this occasion, the national authorities responsible for ensuring the protection of personal data organize specific activities to draw attention to the rights and responsibilities regarding the personal data protection. These activities include campaigns aimed at the general public.

Thus, in the context of Data Protection Day, a few employees of the National Center for Personal Data Protection (NCPDP) distributed to passers-by, near the Cathedral Square, information materials on the importance of personal data protection. During the action, citizens were informed about personal data, the rights of personal data subjects, security and confidentiality measures when processing data. At the same time, people have been made aware of possible abuses and consequences of situations in which personal data may be taken by violating the provisions of national law in the field by personal data controllers.

This year, NCPDP aims at organizing several activities to inform the public about the protection of personal data, but also to ensure the development of a constructive and permanent dialogue with all stakeholders in order to identify optimal solutions for the correct application of legal rules in the field of data protection.

Dear citizens,

January 28 is a special day for the personal data protection. On 28 January 1981, in Strasbourg, was adopted the Convention no. 108 for the protection of individuals with regard to the automatic processing of personal data. Subsequently, on 26 April 2006, the Committee of Ministers of the Council of Europe decided to launch a Data Protection Day, which would be celebrated every year on 28 January. Thus, January 28 was declared – Data Protection Day. Every year, the member states of the Council of Europe organize various public activities and events to celebrate this day.

Respectively, the Republic of Moldova celebrates this event together with all European states. Although the field of personal data protection is a relatively new one for the society of the Republic of Moldova, however, in the last decade we have managed to make great steps in ensuring respect for the right to privacy, in terms of personal data processing, as well as regarding our efforts to comply with European standards in the field of personal data protection.

This year, NCPDP will continue to inform data subjects and to hold controllers accountable for complying with the provisions of the relevant legislation. Although the year 2020 was marked by the COVID-19 pandemic, NCPDP representatives continued to conduct online training, both in Chisinau and in the country. Over 500 people from various fields were trained within these activities. The trainings were focused most on the following fields: central and local public administration, health, police, social sphere and labor law.

For 2021, the objectives of the NCPDP are: continuation of information campaigns in the country, training and education of personal data protection officials in the public and private sector. We will ally with parents to raise awareness of personal data protection, we will continue to monitor how data protection rights are respected, we will continue to promote the new draft law on personal data protection for voting in final reading by the Parliament of the Republic of Moldova.
Dear citizens, for me it is important to involve everyone! I urge you to pay special attention to the protection of personal data and the rights of personal data subjects, and if you have noticed situations of improper processing of data concerning you, contact the National Center for Personal Data Protection.

Take care of your data!

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine, equivalent to 460 thousand euros applied by the Poland Personal Data Protection Office (UODO) to the Polish mobile phone company, Virgin Mobile Polska for the lack of adequate technical and organizational measures implemented to ensure the security of the processed data.

UODO stated that the company infringed the principles of data confidentiality and accountability. Virgin Mobile did not carry out regular and comprehensive tests, measurements and evaluations of the effectiveness of the technical and organisational measures applied to ensure the security of the data processed. Activities in this regard were only undertaken when there were suspicions of vulnerability or in connection with organisational changes. Moreover, no tests were carried out to verify safeguards related to the transfer of data between applications related to the servicing of buyers of prepaid services. In addition, the vulnerability associated with data exchange in these systems was used by an unauthorised person to obtain data from some of the company’s clients.

In connection with a data breach, as a result of which an unauthorised person obtained customers data from one of the databases, the Supervisory Authority carried out the inspection at the company. As a result of the irregularities found, the authority instituted administrative proceedings finalised with the imposition of a fine.

The Supervisory Authority considered that the implementation of a data processing system for use without proper validation of assumed parameters was a flagrant breach by the controller.

However, given the scale and gravity of the breaches, the UODO considered that it would be disproportionate to apply remedies other than an administrative fine.

The NCPDP, as the national authority for the supervision of personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

Today, the National Center for Personal Data Protection (NCPDP) in collaboration with TAIEX project experts organizes the online workshop – “Processing and protection of personal data in the field of public health in the context of possible global challenges” (pandemic COVID – 19). The event will last three days (January 26,27,28).

The aim is to strengthen and enhance the skills of public health representatives on possible challenges that may arise globally (in the context of the pandemic COVID – 19), while respecting the fundamental rights and freedoms of individuals on personal data protection. This includes: when the processing is necessary for reasons of public interest in the area of public health, in adopting good practices based on relevant case law; setting a balance between the processing, storage, and disclosure of health data and the right to privacy; promoting clarity and specialized analysis, oriented towards the provisions of the law on personal data protection in the specific field of application. Concerning health, aim is familiarization of medical representatives with the new challenges related to the processing of personal data.

The workshop will be conducted by personal data protection experts from Croatia, Slovakia and representatives of the NCPDP and will be organized for three regions of the country: central, northern and southern. Amongst the topics addressed by the experts are: the definition of personal health data, the processing of special categories of personal data and the legal basis for the processing of personal health data.

About 300 people from the three regions of the country are expected to participate in the event.

The workshop is organized and funded by the Technical Assistance and Information Exchange Instrument of the European Commission (TAIEX).

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine equivalent to 20 000 euros, applied to the Polish insurance company, Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. The sanction was applied for violating the provisions of the General Data Protection Regulation.

In May 2020, the Personal Data Protection Office of Poland (UODO) received information from a third party about the personal data breach, which consisted in sending by e-mail an insurance policy by an insurance agent, being a processor for the WARTA S.A. Insurance and Reinsurance Company, to an unauthorized addressee.

The attached document contained personal data as: names, surnames, addresses of residence, PESEL numbers (personal identification numbers) and information concerning the subject matter of insurance (passenger car).

At the request of the supervisory authority, the insurance company confirmed that there had been an incident related to a personal data breach, yet the fined company considered that the breach did not require notification to the UODO.

When imposing an administrative fine, the President of the UODO also took into account that the company asked the wrong recipient to permanently delete the correspondence received. However, it is worth mentioning that a request for deletion of data is not tantamount to guaranteeing that the data is actually erased by an unauthorized person and does not preclude possible negative consequences of their use.

The NCPDP, as the national authority for the supervision of personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount EUR 250,000 applied by Polish Data Protection Authority to ID Finance Poland for loss of confidentiality of the personal data principle.

In the proceedings, the President of the Personal Data Protection Office (UODO)  established that the breach took place following the failure to restore the appropriate security configuration after one of the servers operated by the processor  was restarted. The controller was notified about this by one of its cybersecurity specialists, who detected the vulnerability and indicated sample, publicly available information. ID Finance Poland did not immediately check the system’s identified vulnerabilities and, as a result, a few days later, the data was stolen from this server.

When imposing the fine, the UODO took into account the scale of the breach and the scope of the stolen data. In addition, because unencrypted passwords have also leaked, it is possible to use these data to log in to different customer accounts, if they used the same login (e.g. e-mail) and password on other websites. In establishing the amount of the fine, Polish Data Protection Authority also took into account the controller’s delay in taking preventive measures. The amount of the fine should fulfil both a repressive and a preventive function. In the opinion of the authority, it should prevent similar breaches in the future both in the penalized company and at other controllers’.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 450,000 applied by Data Protection Commission to Twitter International Company for the infringement of Article 33(1) and 33(5) of GDPR.

The Data Protection Commission (DPC) investigation commenced in January, 2019 following receipt of a breach notification from Twitter and the DPC has found that Twitter infringed Article 33(1) and 33(5) of the GDPR in terms of a failure to notify the breach on time to the DPC and a failure to adequately document the breach. The DPC has imposed an administrative fine of €450,000 on Twitter as an effective, proportionate and dissuasive measure.

The draft decision in this inquiry, having been submitted to other Concerned Supervisory Authorities under Article 60 of the GDPR in May of this year, was the first one to go through the Article 65 (“dispute resolution”) process since the introduction of the GDPR and was the first Draft Decision in a “big tech” case on which all EU supervisory authorities were consulted as Concerned Supervisory Authorities.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fines in the amount 100 million EUR and 35 million EUR applied by French Data Protection Authority (CNIL) to Google and Amazon for the  unlawful use of cookies. The fines resulted from two separate investigations carried out by CNIL in relation to the use of cookies on the French websites of Google and Amazon.

CNIL fined Google LLC for 60 million EUR, and Google Ireland Ltd (Google’s headquarters) for 40 million EUR. Combined, these fines are the largest ever sanction handed out by the CNIL. Both Google LLC and Google Ireland Ltd were deemed jointly responsible for the use of cookies as both were considered to exercise decision-making power in relation to personal data processing concerning users located in France.

CNIL also fined Amazon Europe Core, a company registered in Luxembourg and belonging to the Amazon group, the largest online retailer, with 35 million EUR, for the infringement of local legislation on “cookies”.

The French Data Protection Authority specified that the French sites of Google and Amazon did not require the consent of visitors before these cookies were saved on their devices and did not provide internet users with clear information on how the two companies intend to use the results of websites navigation and how the visitors of French sites may refuse the use of cookies.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

Online sessions organized by the Bureau of the Committee of Convention 108

 The high management of the National Center for Personal Data Protection participated at the online sessions organized by the Bureau of the Committee of Convention 108 and the Data Protection Unit of the Council of Europe from the 1st to the 3rd of July, the dates were initially scheduled for the 40th Plenary meeting of the Committee which had to be postponed in light of the current global circumstances. The purpose of the above-mentioned event was to present the work of the Committee to a broader audience than usual. During the event, a wide range of topics was discussed such as:

•        Follow-up and evaluation mechanism;

•        The latest challenges posed by profiling in the era of artificial intelligence;

•        The right to data protection in an educational settings;

•        Digital identity;

•        Facial recognition;

•        Political campaigns and elections.

For more information on each topic you can access the following link:  https://www.coe.int/en/web/data-protection/data-protection-views-from-strasbourg-in-visio-1-3-july

On 12-13 December 2019, EU Twinning Project Experts “Capacity Building of the National Center for Personal Data Protection”, in collaboration with NCPDP, organized a training course “Personal data protection and video surveillance”. The event was hosted by IT Center, Tekwill.
About 185 representatives of public and private institutions attended the course, given the increased interest in this topic, in the context of the last sanctions applied by the NCPDP for the non-compliant processing of personal data through video surveillance systems. Among the institutions that participated in this training course the following can be nominated: State Chancellery, the Ministry of Education, Culture and Research, Information Technology and Cyber Security Service, National Archives, Chamber of Commerce and Industry, Moldova Agroindbank, Orange Moldova, Moldcell, Metro Moldova, etc.
The training course, moderated by the EU Twinning Project Expert, Ian Deguara, and NCPDP representative, Victoria Butușanu, main state inspector, Legal Department, aimed at addressing the topics related to the personal data protection and video surveillance and the impact that the new draft law on personal data protection will generate.
The EU expert, Ian Deguara, mentioned that „Video surveillance should take place taking into account more aspects. Before installing video surveillance devices, you should ask yourself, when, where and for what purpose should I install video surveillance cameras? If we are talking about an apartment block, you have to obtain the consent of the owners, if we are talking about a public space, they have to be installed in such a way that they do not capture the private property near or the access area of the neighbors, etc.”. At the same time, the EU expert addressed topics such as: the notion of applicability, accountability principle, the use of video cameras for domestic purposes, fake cameras, recording for an altitude, vehicle reversing cameras, necessity of processing and proportionality, the legal basis for data processing, the disclosure of footage to third parties, transparency obligation, the right of access, the storage period of recordings, the security of data processing and data protection impact assessment.
NCPDP representative, Victoria Butușanu, spoke about the new draft law, the rights of data subjects, the concept of “controller” and “processor”, the principles of personal data processing, thus providing a number of practical examples.
The training course was conducted within the EU Twinning Project “Capacity building of the National Center for Personal Data Protection”, funded by European Union. The project is implemented between October 2017 and January 2020 by the German Foundation for International Legal Cooperation (IRZ) and the Ministry of Justice of Latvia.