NCPDP’s clarification on the processing of personal data in the framework of the Population and Housing Census in 2024

In the light of the multitude information disseminated in the public space in relation to personal data processing in the context of conducting the Population and Housing Census of the Republic of Moldova in 2024, the National Centre for Personal Data Protection (NCPDP) comes with the following clarifications:

The purpose of Law No 133/2011 on the protection of personal data is to ensure the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data, in this regard establishing framework requirements to ensure compliance of the processing of personal data in various sectors, such as: medical, financial-banking, police, education, telecommunications, etc.

In this respect, the law in question contains general provisions and sectoral regulations that may lay down specific rules on the purpose of processing personal data, the categories of data subject to processing, the data subjects, the conditions under which processing takes place, measures to ensure the confidentiality and security of personal data, the entities to which personal data may be disclosed, etc.

The reasoning set out above is also valid in relation to the normative acts regulating the organization and conduct of the Population and Housing Census in the Republic of Moldova in 2024.

It is worth mentioning that, in view of the competences assigned to it, the NCPDP actively participated in the approval process of the normative acts regulating the processing of personal data related to official statistics, submitting comments and proposals to improve their content, in order to comply with the requirements of the legislation on personal data protection.

In view of the issues raised in the public space regarding the processing of personal data in the process of conducting the Population and Housing Census in 2024, it will be emphasized that the processing of personal data is considered lawful when it is carried out on the legal grounds provided for in Article 5 of the Law on the Protection of Personal Data. In this regard, para. (5) of the aforementioned article provides for situations where the consent of the data subject is not required for the processing of personal data, for example, as appropriate to the case at hand, for the fulfilment of an obligation incumbent on the controller by law or for the performance of tasks in the public interest or resulting from the exercise of the prerogatives of public authority vested in the controller or the third party to whom the personal data are disclosed.

Thus, in order to provide information of public interest on the resident population and housing for the elaboration, monitoring and evaluation of policies, for the argumentation of human development decisions, for scientific research and for the development of the business environment, the legislator adopted Law No 231/2022 on the population and housing census, and subsequently approved the related secondary regulatory framework, acts which involve/generate the processing of personal data for the purpose of the census. 

Respectively, the processing of personal data in the framework of this exercise is carried out on the basis of the normative acts regulating the organization and conduct of the Population and Housing Census in the Republic of Moldova in 2024, but the Law on the Protection of Personal Data does not come with specific regulations/conditions in this regard.

Thus, the provisions of Article 7 of the Population and Housing Census Act, which make participation in the census compulsory, are relevant. For example: in para. (1) of this article states that participation in the census of persons who meet the conditions of Art. 3 para. (1)(1)(a) to (c) is compulsory. Further, para. (5) states that if one or more members of the household are missing, the enumerator shall complete the census questionnaires on the basis of information provided by the other members who are fully competent, if they know the answers to the questions in the questionnaires. The necessary information about minor children is provided by their legal representatives. Article 23 of the same Act provides that violations of the provisions of the Act shall give rise to disciplinary, civil, criminal and/or misdemeanour liability, as appropriate.

In the same vein, it should be mentioned that, as a data controller, the National Bureau of Statistics is empowered by law to collect, process and store personal data, ensuring appropriate confidentiality and security of individual data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, through technical, organisational and administrative measures implemented in accordance with the Personal Data Protection Policy and other legislation related to the subject matter.

In addition it should be mentioned that, in accordance with Article 14 para. (4) of the Population and Housing Census Act, the NBS is prohibited from transmitting personal data collected for the purpose of the census to other natural or legal persons.

In another context, it should be noted that, by Law No 175/2021, the power of the NCPDP to authorize the processing of personal data was excluded, as well as the obligation of data controllers to notify the NCPDP of personal data processing operations, while at the same time Article 28 of Law No 133/2011 was repealed, which led to the liquidation of the Register of personal data controllers. In these circumstances, we draw attention to the fact that the National Bureau of Statistics, including the census takers involved in the collection of census data in the territory, must not hold and, respectively, present respondents with any authorization issued by the NCPDP to process personal data.

In the context of the above subject, it should be noted that, to date, the NCPDP has not received any complaints from data subjects regarding the possible non-compliant processing of their personal data carried out in the framework of the Population and Housing Census of the Republic of Moldova 2024, including with regard to alleged transmissions of personal data to unauthorized persons.

Finally, the NCPDP recommends the population to get information from official sources, and when there are any uncertainties regarding the legal regime of personal data protection or official statistics, to contact the competent authorities.