The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 450,000 applied by Data Protection Commission to Twitter International Company for the infringement of Article 33(1) and 33(5) of GDPR.

The Data Protection Commission (DPC) investigation commenced in January, 2019 following receipt of a breach notification from Twitter and the DPC has found that Twitter infringed Article 33(1) and 33(5) of the GDPR in terms of a failure to notify the breach on time to the DPC and a failure to adequately document the breach. The DPC has imposed an administrative fine of €450,000 on Twitter as an effective, proportionate and dissuasive measure.

The draft decision in this inquiry, having been submitted to other Concerned Supervisory Authorities under Article 60 of the GDPR in May of this year, was the first one to go through the Article 65 (“dispute resolution”) process since the introduction of the GDPR and was the first Draft Decision in a “big tech” case on which all EU supervisory authorities were consulted as Concerned Supervisory Authorities.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fines in the amount 100 million EUR and 35 million EUR applied by French Data Protection Authority (CNIL) to Google and Amazon for the  unlawful use of cookies. The fines resulted from two separate investigations carried out by CNIL in relation to the use of cookies on the French websites of Google and Amazon.

CNIL fined Google LLC for 60 million EUR, and Google Ireland Ltd (Google’s headquarters) for 40 million EUR. Combined, these fines are the largest ever sanction handed out by the CNIL. Both Google LLC and Google Ireland Ltd were deemed jointly responsible for the use of cookies as both were considered to exercise decision-making power in relation to personal data processing concerning users located in France.

CNIL also fined Amazon Europe Core, a company registered in Luxembourg and belonging to the Amazon group, the largest online retailer, with 35 million EUR, for the infringement of local legislation on “cookies”.

The French Data Protection Authority specified that the French sites of Google and Amazon did not require the consent of visitors before these cookies were saved on their devices and did not provide internet users with clear information on how the two companies intend to use the results of websites navigation and how the visitors of French sites may refuse the use of cookies.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

Online sessions organized by the Bureau of the Committee of Convention 108

 The high management of the National Center for Personal Data Protection participated at the online sessions organized by the Bureau of the Committee of Convention 108 and the Data Protection Unit of the Council of Europe from the 1st to the 3rd of July, the dates were initially scheduled for the 40th Plenary meeting of the Committee which had to be postponed in light of the current global circumstances. The purpose of the above-mentioned event was to present the work of the Committee to a broader audience than usual. During the event, a wide range of topics was discussed such as:

•        Follow-up and evaluation mechanism;

•        The latest challenges posed by profiling in the era of artificial intelligence;

•        The right to data protection in an educational settings;

•        Digital identity;

•        Facial recognition;

•        Political campaigns and elections.

For more information on each topic you can access the following link:  https://www.coe.int/en/web/data-protection/data-protection-views-from-strasbourg-in-visio-1-3-july

On 12-13 December 2019, EU Twinning Project Experts “Capacity Building of the National Center for Personal Data Protection”, in collaboration with NCPDP, organized a training course “Personal data protection and video surveillance”. The event was hosted by IT Center, Tekwill.
About 185 representatives of public and private institutions attended the course, given the increased interest in this topic, in the context of the last sanctions applied by the NCPDP for the non-compliant processing of personal data through video surveillance systems. Among the institutions that participated in this training course the following can be nominated: State Chancellery, the Ministry of Education, Culture and Research, Information Technology and Cyber Security Service, National Archives, Chamber of Commerce and Industry, Moldova Agroindbank, Orange Moldova, Moldcell, Metro Moldova, etc.
The training course, moderated by the EU Twinning Project Expert, Ian Deguara, and NCPDP representative, Victoria Butușanu, main state inspector, Legal Department, aimed at addressing the topics related to the personal data protection and video surveillance and the impact that the new draft law on personal data protection will generate.
The EU expert, Ian Deguara, mentioned that „Video surveillance should take place taking into account more aspects. Before installing video surveillance devices, you should ask yourself, when, where and for what purpose should I install video surveillance cameras? If we are talking about an apartment block, you have to obtain the consent of the owners, if we are talking about a public space, they have to be installed in such a way that they do not capture the private property near or the access area of the neighbors, etc.”. At the same time, the EU expert addressed topics such as: the notion of applicability, accountability principle, the use of video cameras for domestic purposes, fake cameras, recording for an altitude, vehicle reversing cameras, necessity of processing and proportionality, the legal basis for data processing, the disclosure of footage to third parties, transparency obligation, the right of access, the storage period of recordings, the security of data processing and data protection impact assessment.
NCPDP representative, Victoria Butușanu, spoke about the new draft law, the rights of data subjects, the concept of “controller” and “processor”, the principles of personal data processing, thus providing a number of practical examples.
The training course was conducted within the EU Twinning Project “Capacity building of the National Center for Personal Data Protection”, funded by European Union. The project is implemented between October 2017 and January 2020 by the German Foundation for International Legal Cooperation (IRZ) and the Ministry of Justice of Latvia.