The National Centre for Personal Data Protection ('NCPDP') announced, on 24 May 2022, that it had found an unnamed real estate company in violation of Articles 4(1)(a) and (b) and 5 of the Law of 8 July 2011 No. 133 on Personal Data Protection ('the Law'), following a complaint.

Background to the decision

In particular, the NCPDP detailed that it was informed by a citizen of the Republic of Moldova that, following the exercise of their data subject rights, they discovered that the real estate company had personal data regarding real estate that belonged to them.

Findings of the NCPDP

Following an explanation from the real estate company, the NCPDP noted that the real estate company's data processing could not be justified. Specifically, the NCPDP clarified that the real estate company failed to demonstrate the need to access the personal property information in relation to the data subject or establish a causal link between the data subject and the purpose of processing.

Furthermore, the NCPDP explained that the provision in Article 6(1) of the Law of 23 February 1998 No. 1543 on Real Estate Cadastre, which permits the processing of personal data in accordance with the Law, does not provide unlimited rights to obtain information from the Real Estate Register. On this point, the NCPDP further explained that each access to personal data must be necessary, justified, and only carried out if the person has, in examining the file, demonstrated a direct causal link between the personal data processed and the data subject concerned.

In light of the above, the NCPDP concluded that the real estate company did not disclose with certainty the determined, explicit, and legitimate purpose, as well as the legal basis for accessing the personal data aimed at the property owner, or comply with the legal rules of access, thus violating Articles 4(1)(a) and (b) and 5 of the Law.

Outcomes

Finally, the NCPDP reiterated that the purpose of the Law is to ensure the protection of the fundamental rights and freedoms of individuals with regard to the processing of personal data, in particular the right to the inviolability of privacy, family, and private life.

You can read the press release, only available in Romanian, here.