Newsletter No. 23

I.                  Information and training activities carried out by the NCPDP

       During the third quarter of 2025 (July – September), the National Center for Personal Data Protection (NCPDP) continued to make significant progress in achieving its objectives, focusing particularly on the development and implementation of activities aimed at informing and raising awareness of the general public regarding the importance of the field of personal data protection. In this context, a series of educational initiatives and awareness campaigns were carried out aimed, on the one hand, at explaining citizens’ rights regarding the management of their personal data, and on the other hand, at promoting responsible behavior regarding their protection.

       Through these actions, NCPDP aimed not only to increase the degree of understanding of the legal regulations in the field, but also to cultivate an organizational and social culture in which respecting confidentiality and data security becomes an integrated practice in the daily life of every citizen. This approach aims to ensure not only compliance with national and European legislation, but also to strengthen the general public’s trust in the personal data protection process.

       During the reference period, the organization of training sessions for the subdivisions of the General Inspectorate of Police (GIP) continued, according to the training plan approved and signed by the heads of the NCPDP and GIP, on January 28, 2025.

       Thus, training sesssions were organized for the following subdivisions:

• July 15 – Căușeni Police Inspectorate;
• August 5 – Criuleni Police Inspectorate;
• September 23 – Dubăsari Police Inspectorate.

       In this context, 225 representatives from the GIP subdivisions were trained.

       Likewise, the organization of training sessions for employees within the structural, specialized and territorial subdivisions of the General Inspectorate for Migration (GIM) continued, according to the training plan approved and signed by the heads of the NCPDP and GIM, on January 27, 2025.

       Thus, training sessions were organized for the following subdivisions:

• September 17 – Structural and Specialized Subdivisions of the GIM;
• September 19 – Southern Regional Directorate of the GIM.

       In this context, 31 representatives from GIM subdivisions were trained.

       During the reference period, NCPDP demonstrated openness and a spirit of collaboration, organizing multiple training sessions for representatives of public/private institutions, at their request.

       Thus, training sessions were organized for the following entities:

• July 1 –  Moldtelecom;
• July 02 – The National Energy Regulatory Agency (NERA);
• July 03 – Moldovan Banks Association;
• July 12 – School of Building Administrators;
• July 19 – School of Building Administrators;
• September 02 – National Office of Social Insurance;
• September 08 – Customs Service;
• September 11 – Post of Moldova.

       In this context, 325 representatives of the above-mentioned entities were trained.

       The training sessions aimed to familiarize with aspects related to the field of personal data protection, the regulation of processing procedures, as well as the confidentiality and security regime of personal data in accordance with the legislation in force. Important topics were discussed during the events, such as: defining general notions related to the field of personal data protection; principles and legal grounds for the processing of personal data; rights of personal data subjects; processing of special categories of personal data; requirements regarding the personal data protection in the exercise of job duties; ensuring the security and confidentiality of processed personal data; aspects related to the appointment of the Data Protection Officer (DPO), as well as his obligations and tasks; aspects related to the Data Protection Impact Assessment (DPIA), as well as the stages of conducting a DPIA, etc.

       At the same time, the information and awareness campaign for the school community was continued with the theme: “Personal data protection and children’s safety in the online environment”. The goal of the campaign was to raise awareness and educate children regarding: the importance of protecting personal data; identifying risks in the online environment; adopting responsible, safe and informed behavior in the digital space to support children to browse the internet in a safe, ethical and informed manner, reducing their vulnerability to online threats. The topics addressed during the trainings focused on: what personal data is; how to protect your personal data online; risks and threats in the online environment; safety on communication platforms and online games, etc. The training session was organized on July 7, 2025 for the Class of the Future, with 38 students being trained.

II.               Control activity

       Between July and September 2025, NCPDP initiated verification of the compliance of personal data processing operations in 116 cases. During the reference period, 97 decisions were issued, of which 44 cases found a violation of legal provisions, with 36 reports being issued regarding the contravention, which were subsequently submitted to the court for resolution.

III.           Findings of the National Center for Personal Data Protection

1.        The NCPDP examined the complaints of several petitioners from the Gagauzia Autonomous Region, in which they reported receiving several messages mentioning the allocation of financial sources in their names from banks in the Russian Federation.

       During the investigation, all the petitioners claimed that they did not participate in meetings organized by political parties in 2023–2024 and did not transmit their personal data to anyone, and that the social assistance received from the state was provided through the Post Office or through another secure method. Thus, the petitioners assume that members of a political party group would have made registrations on platforms used by banking entities in the Russian Federation, using information obtained from the Directorate of Health and Social Assistance of the Gagauzia Autonomous Region.

       During the inspection, it was determined that, in the context of the operations complained about by the petitioners, the applications/platforms “Centrify”, “Qsms” and “Authentify” are products of companies not headquartered in the Republic of Moldova. At the same time, from the information presented in the public space, including by the competent law enforcement agencies, it was noted that personal data were collected and transferred cross-border to entities in the Russian Federation, namely, entities in this country could make transfers in Russian rubles.

       Based on the circumstances described, from the materials accumulated in the given case, it was not possible to specifically determine the person(s)/entities who transmitted the personal data cross-border in the situations complained of by the petitioners.

       However, it is certain that there has been processing of personal data manifested by their cross-border transmission to a state that does not ensure an adequate level of protection, for purposes that may prejudice the fundamental rights and freedoms of the individual with regard to the personal data protection.

       Thus, in rem, the NCPDP found a violation of the provisions of art. 32 paragraph (5) of Law no. 133/2011 on the personal data protection, in the processing through cross-border transmission of the personal data of the petitioners.

2.         The NCPDP received a complaint from a personal data subject, who requested verification of the legality of the personal data processing operations concerning him, carried out by a company (hereinafter – data controller), through the Real Estate Registry, in accordance with the provisions of Law No. 133/2011 on the personal data protection.

       In these circumstances, the NCPDP initiated the verification of compliance with the provisions of art. 4 para. (1) p. a) and b) and art. 13 of the Law in question, when processing the personal data of the data subject.

       During the examination of the accumulated material, it was found that the data controller consulted the information referring to 3 real estate properties containing data about the owner of the real estate properties; the basis for registration – the name and dates of the act by which the ownership right was acquired.

       Therefore, data processing was to be subject to the consent of the personal data subject and, respectively, to his/her right to decide freely and unequivocally whether or when personal data concerning him/her may be processed by the data controller in compliance with the provisions of Law No. 133/2011 on the personal data protection.

       Moreover, the NCPDP did not consider as well-founded the argument invoked by the data controller that it had consulted the public part of the Real Estate Register, but the public part of the Register does not provide information about the ownership of the real estate and the method of acquiring it.

       Thus, during the investigations, the NCPDP found that the data controller processed the personal data of the data subject without complying with the requirements set out in art. 4 para. (1) p. a) and b) of Law no. 133/2011.

       Subsequently, the data controller did not resolve the data subject’s request regarding the exercise of the right of access, not providing a substantiated/pointed response justifying the personal data processing operations carried out by the latter, including the violation of Article 13 of Law 133/2011. In the case, the NCPDP initiated the contravention procedure.

3.        The NCPDP, initiated proceedings following the receipt of a request from a district councilor, thus examining the case in light of legal powers, namely, investigating an alleged illegal processing of the special category of personal data of data subjects, caused by the inappropriate actions/inactions of the District President.

       Following the accumulation of evidence, it was established that the President of the district issued and signed a response addressed to the district councilors regarding the behavior of medical personnel from some medical facilities in the district.

        To justify the response, the District President attached extracts from the medical records of some patients, containing: name and surname, date of birth, IDNP, home address and information on health status.

       As part of the control initiated by the Control Authority, the District President submitted two declarations of consent signed by some patients, considering that he had a legal basis for data processing.

       However, the NCPDP analysis revealed that consents were obtained from only two data subjects, while the attached documents contained the data of several people. At the same time, the wording in the consents was general and unclear, not meeting the conditions of a valid consent (free, specific, informed, unambiguous).

       Furthermore, the NCPDP revealed that the transmission of medical records to counselors was not necessary and proportionate to the intended purpose, as the verification and subsequent justification of the work schedule of medical personnel in the response to counselors could have been achieved through non-intrusive administrative means.

       As a result of the findings, the NCPDP invoked the following relevant provisions of Law no. 133/2011 on the personal data protection: art. 4 para. (1) p. a), c), e) – processing must be correct, pertinent, not excessive and limited to the purpose; art. 6 para. (1) – prohibits the processing of special categories of data, including those regarding health, with the exceptions expressly provided for by law; art. 29 para. (1) – imposes the obligation to ensure the confidentiality of data and to prevent unauthorized disclosure.

       Therefore, concluding the above, the NCPDP found that the President of the district did not respect the principles of legality, proportionality and confidentiality in the process of processing patient data.

       By transmitting medical records containing sensitive data to counselors, without the consent of the data subjects and without a valid legal basis, an unauthorized disclosure of personal data occurred, which constitutes a violation of the principles of personal data protection. In the case, the NCPDP initiated the contravention procedure.

4.        The NCPDP examined the complaint of a personal data subject, through which he complained about the processing of personal data belonging to him by a company.

       Thus, during the investigation, it was found that the data subject, over a period of time, had concluded a contract with the company in question, however, the personal data processing operations carried out by the controller (legal entity) were carried out automatically, in the absence of the data subject’s consent after the expiry of the contract concluded between them.

       Based on the materials presented by the controller, it was found that the data subject did not give his/her consent to the processing of his/her personal data by the company in question, following the conclusion/closure of the contract, and another legal basis for the processing of personal data, if applicable, was not identified.

       Therefore, through the actions described, the data controller violated the provisions of art. 4 para. (1) p. a), e) and art. 5 para. (1) of Law no. 133/2011. In the case, the NCPDP initiated the contravention procedure.

IV.            Prevention activity

       During the reference period, in order to carry out the advisory tasks, in addition to the multiple answers provided, for advisory purposes, 70 consultations were provided by telephone, via e-mail or at the authority’s headquarters.

V.               International and European news

• Between July 2-3, 2025, representatives of the National Center for Personal Data Protection (NCPDP) participated in the 75th meeting of the International Working Group on Data Protection in Technology (known as the “Berlin Group”), which took place in the city of Tbilisi, Georgia.

       The aim of the event was to bring together international experts in the field of data protection to discuss and analyze the impact of new technologies on privacy and personal data security. During the meeting, participants exchanged good practices, presented national innovations, and addressed emerging challenges such as neurodata, 6G technology, and digital identity, with a view to developing common recommendations to support the improvement of data protection standards at the international level.

       During the two working days, important topics were addressed, such as:

• Neurodata and the implications for privacy;
• The evolution of 6G technology and the related challenges in the field of data protection;
• Digital identity;
• Government digital services and data protection within them (e.g. MY.GOV.GE – the unified portal of electronic services in Georgia);
• National presentations on innovations and good practices in the field of data protection.

       The event represented a valuable framework for the international exchange of experience, strengthening cooperation between supervisory authorities and identifying common directions of action facing new technological challenges, bringing together representatives from 14 countries, as well as delegates from the European Data Protection Supervisor and the Electronic Privacy Information Center.

• On September 11, representatives of the NCPDP participated in the plenary meeting of the European Data Protection Board (EDPB) that took place online. During the plenary meeting, the EDPB adopted the guidance on the interaction between the Digital Services Act (DSA) and the General Data Protection Regulation (GDPR).

       This guide is the first of its kind and aims to ensure consistent application of both regulations, given that some provisions of the DSA involve the processing of personal data. Essentially, the DSA complements the GDPR, guaranteeing the protection of users’ fundamental rights in the digital environment and regulating online services such as search engines and digital platforms.

       The guide details how the GDPR should be applied within the framework of DSA obligations, in areas such as reporting illegal content, automated content recommendations, protection of minors and advertising transparency. They also support cooperation between regulators to provide legal certainty to online service providers and protect users’ rights. The guide will be subject to a public consultation, giving stakeholders the opportunity to provide feedback.

VI.            Other data protection authorities

• On June 23, 2025, The Polish Data Protection Authority issued a final decision imposing administrative fines of EUR 4,022,773 on McDonald’s Polska and EUR 43,680 on 24/7 Communication for violating Article 5 (Principles related to the processing of personal data), Article 24 (Responsibility of the controller), Article 25 (Data protection by design and by default), Article 28 (Processor), Article 32 (Security of processing), Article 34 (Communication of a personal data breach to the data subject) and Article 38 (Position of the data protection officer) of the GDPR.

        McDonald’s Polska LLC notified a data security breach, as a controller, finding that the following data of its employees and franchisees were included in the shared file in the public catalogue: names, personal identification numbers (PESEL numbers), passport numbers (if the PESEL number is not available), McDonald’s restaurant number, date and time of starting work, date and time of ending work, number of hours worked, holidays, type of work, etc.

       The investigation found that neither the controller (McDonald’s Polska) nor the processor (24/7 Communication) had conducted a risk analysis and had not implemented sufficient technical and organizational measures to protect personal data. Furthermore, the data protection officer was not properly involved, and the audit and monitoring obligations of the partners were not respected.

       The Polish SA emphasized that the responsibility for data protection lies with both companies that collect and manage personal data and their contractual partners. Security measures must be constantly checked and updated, not just at the beginning of data processing.

        In this context, the Polish SA imposed an administrative fine of 4 022 773 euros on McDonald’s Polska LLC and 43 680 euros on 24/7 Communication LLC.

• The Italian parliament has adopted a new law on artificial intelligence (AI), becoming the first country in the European Union to have comprehensive AI regulations aligned with EU law. The law aims to promote “human-centric, transparent and safe use of AI”, with a focus on “innovation, cybersecurity and privacy protection”.

       The new legislation provides:

• Prison sentences (1–5 years) for the illegal dissemination of AI-generated content (such as deepfakes) when it causes harm; harsher penalties if the technology is used for fraud or identity theft.
• Protection of minors: children under 14 will only be able to use AI applications with parental consent.
• Strict transparency and human oversight rules for the use of AI that will regulate how the technology is used in the workplace and in sectors such as health, education, justice and sports.
• Copyright: works created with the help of AI are protected only if there is a real intellectual contribution; automatic analysis of texts and data will only be allowed for free content or for scientific research carried out by authorized institutions.
• Financial support: The government is allocating up to €1 billion (£870 million) from a state-backed fund for equity investments in small and medium-sized enterprises, as well as large companies active in the fields of artificial intelligence, cybersecurity, quantum technologies and telecommunications.

       The government designated the Agency for Digital Italy and the National Cybersecurity Agency to enforce the legislation, which received final approval in parliament after a year of debate.