DECISION
on the cessation of processing operations
of personal data
May 28, 2015 mun. Chisinau
Director of the National Center for Personal Data Protection of
Of the Republic of Moldova, Vitalie PANIS, based on the materials accumulated within
control no. 02-11 / 119/15, FIND:
De facto,
The circumstances that served as the reason for triggering the control
the legality of personal data processing operations.
On May 27, 2015, through the media entities, the alleged fact was notified
illegal dissemination of information with limited accessibility from the record system State Register of Legal Entities and Individual Entrepreneurs, Managed by I-5.
State Registration Chamber ”in the part concerning the data categories: name,
first name and share of the associates, in the address of unauthorized third parties._
as a result of the actions that were required to be performed in accordance with
the circumstances of the case, on May 27, 2015, the National Center for Data Protection with
Personal Character of the Republic of Moldova (Center) carried out an unexpected control at
personal data controller - [.S. "State Registration Chamber", being
found the fact of disclosure / marketing! information with limited accessibility ?, what
records personal data, addressed to unauthorized third parties - ie any
persons who pay a pecuniary amount.
Moreover, as a justification for disclosing this information with
accessibility limited to any applicant, without proving a legitimate interest established in art. 5
para. (5) of the Law on the protection of personal data, were invoked
the provisions of art. 34 para. (1) of the Law on state registration of legal entities and
of individual entrepreneurs, according to which, apparently, the data from the State Register of
legal entities and individual entrepreneurs would be public, as well as annex no. |
of the normative act - Government Decision no. 926 of July 12, 2002 regarding the approval
tariffs for paid services provided by i.S. "State Registration Chamber" that offers

In accordance with the definitions found in DEX, COMMERCIALIZE, sell, vb. 1. Tranz. To put a commodity, a good
summer. in trade, to make and become the object of trade. (Pr: -ci-a-] - Din fr;
2 in accordance with the provisions of art. 8 para. (1) of the Law on access to information, according to cirora, information with character
staff is part of the category of official information with limited accessibility and consists of data relating to a person
identified or identifiable physical condition, the disclosure of which would constitute a violation of private, intimate 41 family life, and according to
para. (2) of the same article, the access to the personal information is realized in accordance with the provisions
legislation_ on the protection of personal data,

Careful! The document contains personal data, processed within the evidence system no. 0000001-011, registered in
Register of personal data operators www. repistru.datepersonale.md, wlterioard processing of these data
can be carried out only under the conditions provided by Law no. 133 of 08.07.2011 regarding the protection of personal data.

]
the possibility of issuing (marketing) such information against payment.
Thus, [.S. The "State Registration Chamber" initiated the development of the activity of
enterprising in the part aimed at marketing (disclosure to third parties
unauthorized) information with limited accessibility that records character data
personally, based on the alleged legal grounds:
i. in accordance with the phrase (first 12 semantic elements) of art. 34 para. (1)
of the Law on state registration of legal entities and entrepreneurs
individual, quoted: ,, The data from the State Register and from the articles of incorporation are public and
accessible to all ”;
2. annex no. 1 of the normative act? - Government Decision no. 926 of July 12, 2002
regarding the approval of tariffs for paid services, —_— provided
of 1S. ,,State Registration Chamber".
De jure,
The analysis performed by the Center pursued the objective of assessing compliance
processing * of personal data> performed by the data operator® - LS.
State Registration Chamber".
In view of the above, the Center, as the sole Authority
national verification of compliance of personal data processing, which
acts in conditions of impartiality and independence, which aims to ensure
protection of the fundamental rights and freedoms of the natural person with regard to
processing of personal data, in particular, the right to the inviolability of life
intimate, family and private, enshrined in art. 28 of the Constitution of the Republic of Moldova qualifies as inadmissible the dissemination / marketing of personal data in
purpose of obtaining a pecuniary interest, but not limited to it, in the address of third parties
unauthorized.
Starting from the international law and the European / national acquis of protection of
personal data, we highlight the following.
In accordance with Art. art. 1, 3 and 4 of the CONVENTION FOR
PROTECTION OF PERSONS REGARDING AUTOMATED PROCESSING

3 in accordance with the provisions of art. 2 Law on normative acts of the Government and other administrative authorities
central and local public, according to cirora - the normative act is the legal act, issued by the Government and other authorities of
central and local public administrations based on constitutional and legal norms;
4 processing of personal data - any operation or series of operations performed on the data with
personal data by automated or non-automated means, such as collection, registration, organization,
storage, preservation, restoration, adaptation or modification, extra market, consultation, use, disclosure by
transmission, destruction or otherwise, alteration or combination, blocking, erasure or destruction;
3 personal data - any information relating to an identified or identifiable natural person (subject of
personal data). The identifiable person is the person who can be identified, directly or indirectly, by reference
to an identification number or to one or more elements specific to his physical, physiological, mental identity,
economic, cultural or social;
6 operator - natural person & or legal person of public or private law, including public authority, any other
institution or organization carc, individually or together with others, establishes the purposes and means of processing
personal data expressly provided by the legislation in force.

‘Attention The document contains personal data, processed within the evidence system no. QOOOOOI-O11, registered in
Register of personal data operators wow. régistru.datepersonale.md. Ullerioardi processing of this data
can be performed only under the conditions provided by Law no. 133 of 08.07.2011 regarding the protection of personal data.

2
OF PERSONAL DATA no. 108 (Strasbourg, 28.01.1981), state
The Republic of Moldova has assumed the responsibility and, respectively, guarantees the person
physical right to the inviolability of intimate, family and private life, regardless of
ethnicity, religious views, etc. and / or the (economic) activities they
unfolds.
In the same order of ideas, in accordance with the provisions of art. art. 7, 11 and 16 of
Directive 95/46 / EC of the European Parliament and of the Council of 24 October 1995
on the protection of individuals with regard to the processing of data with _character
personal and free movement of this data, is provided exhaustively and without the right to
interpretation, cA any processing of personal data, in the case given by
disclosure, dissemination, transmission, use, etc., are to be carried out: 1. with
the consent of the subject of personal data; 2. in the absence of consent
the subject concerned, provided that there is a legal provision that must be made
in a democratic state.
It should be mentioned that the principles of personal data protection
provided for in the international acts mentioned above, have been transposed equidistantly into
the national profile legislation whose premises were established with its adoption
Of the Constitution of the Republic of Moldova, in particular, the right to the inviolability of private life,
family and private established in art. 28 of this law.
We reiterate, however, the invocation of the provisions of art. 34 para. (1)
of legal persons and individual entrepreneurs as justification a
disclosure / marketing of personal data - may not be subject to any
criticisms, for the simple reason, c4 according to the quintessence par. (1)
promptly, quoted: ,,. The data from the State Register and from the articles
and accessible to all under the conditions and within the limits provided by

of the Law on Registration
of this article, we detach
of incorporation are public
the legislation:

"on access to information",
in accordance with the provisions of art. 7 para. (2) lit. c) of the Law on access to
information, access to official information may not be restricted, except
personal information, the disclosure of which is considered a
interference in the private life of the person, protected by data protection legislation
personal,
In accordance with Art. 8 paragraph, (2) of the same law, access to information
with personal character is made in accordance with the provisions of the legislation regarding
protection of personal data.
»Protection of personal data",
? The Republic of Moldova signed the Convention on May 4, 1998 and ratified it by Parliament Decision ar483-X1V of July 2, 1999,
and this is in force for our country since June 2008. * With the instrument of ratification of the Convention have been deposited
Declarations by which the Republic of Moldova announces that it will not apply the Convention on the processing of personal data by
individuals exclusively for personal needs $ 1 families (provided that they do not infringe the rights of
personal data), we also take care of the processing of personal data attributed to information that constitutes a state secret, but,
at the same time, it will apply the Convention, including personal data that are not processed automatically,
The Republic of Moldova has designated the National Center for Data Protection and Personal Character as the competent authority for
implementation of the Convention provisions and for the maintenance of relations of mutual assistance with other States Parties, taking into account some
problematic aspects in the field of personal data protection, together with the entry into force, on December 6, 2013, of Law no.
271 of November 7, 2013, the Declarations of the Republic of Moldova to the Convention for the Protection of Persons Concerning 1a were revised
automated processing of personal data.

Authentic! The document contains personal data, processed within the record system no, OOO0001-011, registered in
Register of records of personal data operators www, registru.datepersonale.md. Ultcrioard processing of this data
can be carried out only under the conditions provided by Law no. 133 of 08.07.2011 regarding the protection of personal data.

3
In accordance with Art. 4 of the Law on data protection with character
personally, personal data must be: processed correctly and accordingly
the provisions of the law; collected for specific, explicit and legitimate purposes, and subsequently sé
not be processed in a manner incompatible with these purposes; adequate, relevant $ i
not excessive in terms of the purpose for which they are collected and / or further processed;
accurate and up-to-date, stored in a form that allows the subject to be identified on a
the period that will not exceed the time necessary to achieve the goals.
In accordance with Art. 5 para. (1) of the Law on data protection with
personal data, the processing / disclosure of personal data may be carried out
with the consent of the subject of personal data, or, in the cases provided in
para. (5) of the same article - situations irrelevant to the case, due to non-existence
a civil legal report from the applicant, which would legislate the alleged interest
legitimate.
on registers ”
In accordance with the provisions of art.15 par. (2) of the Law on Registers,
the rights and obligations of the recipient of the register data are established by the legislation regarding
access to information.
in accordance with the provisions of art. 21 para. (1) of the same law, at the end
registers containing personal data will be strictly observed
human rights and freedoms, and according to par. (2) of the same article, the manner of
collection, processing, storage and use of personal data in the registers of
state is established by law.
in accordance with the provisions of article 24 par. (1) of the same law,
the responsibility for the integrity of the register data lies with the owner! his, and in
in accordance with the provisions of par. (3) of the same article, the data protection requirements
it is approved by the Government, unless the law provides otherwise. The owner of the register is obliged, in
comply with the data protection requirements of the register, and ensure the measures
organizational and technical necessary for data protection and compliance with these measures.
In accordance with Art. 30 para. (4) of the same legislative act, the data
personal data of natural persons are used under the legislation on
personal data protection, and in accordance with the provisions of par. (6) al
of the same article, the owner of the register is obliged to monitor the use of data in
the manner established by the data protection conditions. Providing information technology
about the use of data is regulated by law.
in this context, the provisions of art. 1 para. (2) of the Law on Enterprise
State, emphasizes that the state enterprise is an independent economic agent with
rights of a legal person, which, on the basis of state property, transmitted to them in
management, carries out entrepreneurial activity, and in accordance with the provisions
art. 9 of the same law, the enterprise may practice any kind of activity
provided in its statute, except those prohibited by law.

Careful! The document contains personal data, processed within the accounting system. OOOO0O1-011, registered in
Register of evidence of personal data operators www.registru.datepersonale.md. Further processing of this data
can be carried out only under the conditions provided by Law no. 133 of 08.07.2011 regarding the protection of personal data.

4

We explain that, in accordance with the provisions of the Law on data protection with
personal data, the holder of the right to personal data, can only be
natural person & - subject of personal data (and / or in case of death
physical incapacity - successors in the order provided by the Civil Code),
according to art. 3 of the aforementioned law, [.S. "State Registration Chamber" - as
personal data controller, is invested due to specific circumstances
the activity carried out, to process personal data as an operator,
However, this right to process the data of the subjects / shareholders concerned, no
legislate / unfounded assumption of 1.S. "State Registration Chamber" to catalog
as the owner of this information with limited accessibility.
Explain oa, [.S. The State Registration Chamber ”may disclose the character data
personnel of the subjects concerned only on condition that they obtain their consent in
in order to provide certain services / activities and / or in case of its exercise of some
patrimonial / non-patrimonial rights resulting from the actions / inactions of the subject of
date. But from that moment, the company as a data operator with character
personally assumes the obligation to respect the inviolability of intimate, family and life
private. Respectively, [.S. The "State Registration Chamber" can by no means have the quality
of the owner vis-à-vis the personal data of a targeted subject, under the conditions
an adequate and civilized democracy.
Moreover, invoking the provisions of the normative act - annex no. | from Hotdrirea
Government no. 926 of 12 July 2002 on the approval of tariffs for paid services,
provided by {.S. "State Registration Chamber", as the alleged act ce
legislate / allow the processing of personal data of individuals and who
would include the actions of the nominated company in the exhaustive and irremovable provisions
a art. 4 and art. 5 of the Law on the protection of personal data is unfounded,
The center qualifying the actions {.S. "State Registration Chamber" as excessive in the report
with the disclosure of personal data to unauthorized third parties.
We remind you that, according to the provisions of art. 2 para. (1) of the Law on documents
legislative acts are legislative acts adopted by the sole legislative authority of the state in
based on the constitutional norms, according to the procedure established by the Regulation
Parliament, by other regulations in force, and occupies the highest position in the hierarchy
normative acts from the Republic of Moldova.
Thus, the intention to assign / interpret the Government Decision no. 926 of 12 July
2002 on the approval of tariffs for paid services provided by LS. ,,The room
"State registration", as an act that allows the disclosure of categories of character data
targeted personnel & associates of the enterprise - natural persons, in the address of any subject
without justifying the legitimate interest (which is provided by the legislator as a basis
when processing personal data in the absence of the consent of the subject of
personal data in certain cases) contravenes the provisions of legislative acts
international and national statements stated above.
As previously stated, the distinction between the rights they enjoy
natural person and the obligations referring to the legal person in the part concerned
the inviolability of invime, family and private life is to be maintained exhaustively in

Careful! The document contains personal data, processed within the record system 'no. 0000001-011, registered in
Register of records of personal data operators www registru.datepersonale.md. Subsequent processing of this data
can be performed only under the conditions provided by Law no. 133 of 08.07.2011 regarding the protection of personal data,

in conjunction with the principles established by the Law on the protection of personal data,
so that the activity of I.S. "State Registration Chamber" for the provision of services, s4 no
exceed the stated purpose and sf not be applied excessively in relation to the categories of data with
personal data intended to be disclosed to unauthorized applicants. At the same time,
should be retained as the phrase "personal data" is the object of protection
from the state of fundamental human rights by assigning the Authority
National control of the processing of personal data of the identification attributions
and counteracting the intentions of entities that can obviously harm the right of the person
to private life.
As confirmation of those mentioned, the provisions of art. 8 of the Convention
human rights, according to which, the interference of an authority is not allowed
have been invested with attributes of public interest in the exercise of this right than in
to the extent that this mixture is provided for by law and if it constitutes a mdsurd which,
of a democratic society, it is necessary ... ””.

Considering the above, as well as in accordance with the provisions
art. 5 para. (1), 6, 20 para. (1) lit. a), e) and art. 27 para. (4) of the Law on data protection
personal; Chapter I], pet. 3 lit. a), b) and d) of the Regulation of the Center,
approved by Law no. 182-X VI of 10 July 2008, HAVE:
1. Immediate cessation of personal data processing operations
by 1.S. State Registration Chamber ”, legal address - Chisinau mun., Bd. Stefanie
cel Mare si Sfint nr 73, IDNO: 1004600077777 - manifested by
dissemination / disclosure of personal data concerning business associates
- natural persons, in the address of unauthorized third parties, which do not fall within the provisions of art.
4 and art. 5 of the Law on personal data protection.
2. Informing the National Center for Personal Data Protection
of the Republic of Moldova on the actions taken in order to execute this decision,
within 10 days of receiving it.
3. National Center for Personal Data Protection of the Republic
Moldova will publish this decision on its official website.
4. The decision with the right to appeal in order of administrative contentious within
30 days.
Vitalie PANIS
Director

Careful! The document contains personal data, processed within its record system no. GOOOAAAL - 011
registered in the Register of records of personal data operators www_reg | strudatepersonale.md. processing
subsequent publication of these data can be performed only under the conditions provided by the Law of the city. 133 of 08.07.2011 regarding the protection
personal data.

&

