You are here

To Be or Not To Be... Data Operator? Find Out the Answer Given by the Center for Personal Data Protection to Journalists

16 October 2019
479 reads
After some journalists and specialists in the field of personal data protection criticised the legislative initiative according to which media outlets are obliged to register as data operators in order to have free access to several databases, Media-azi.md requested the opinion of the National Center for Personal Data Protection (NCPDP) about this requirement. When asked, if the media institutions are generally required by law to register as operators, we received the following answer: ‘the media institutions are not exempted from the obligation to register as a personal data operator’. At the same time, journalists and certain specialists in the field have an opinion contrary to that of the Centre’s.

In the answer provided by NCPDP and signed by the Interim Head of the Legal Department, Angela Colomiicenco, it is mentioned that, although the law provides for certain exceptions for data processing for journalistic purposes, the media institutions are no exception from the obligation to register as an operator.

 

‘Taking into account this legal provision, the media outlets are not exempted from the obligation to register as personal data operator and to notify the record-keeping systems managed, but only from the Articles 5, 6 and 8, which state the legal grounds for the processing of personal data’, stated the official answer of the Centre.
The legal department of NCPDP stated that according to the legal provisions on notifying the Centre and the Register of operators and to the requirements on ensuring the security of personal data processing by personal data information systems, the personal data processing operations in a automated or manual record-keeping system shall be notified with the Centre before their initiation.

Also, according to the legal department, each personal data record-keeping system is notified separately, and the data operator has the obligation to identify and record all the personal data record-keeping systems managed.

On the other hand, the Head of the Association for the Protection of Private Life and former Deputy Head of the Supervision and Compliance Department of the NCPDP, Sergiu Bozianu, stated for Media-azi.md that, however, the media outlets are not obliged to register as a personal data processing operator, as they process information of public interest, and the activity of journalists is limited to keeping a public register.


Photo: Facebook

‘In the Republic of Moldova, the Article 23(5) of the Law on Personal Data Protection, clearly states that it is not necessary to register as a data operator in case of keeping a register intended to inform the general public and which is open for consultation to the public or to any person who proves a legitimate interest, provided that the processing is limited to the data required to maintain the said register. Thus, according to the Press law, the Law on Freedom of Expression, the Law on Access to Information, the media can process only information of public interest, and the processing of personal data is limited to this purpose only: keep a public register – in electronic or paper format, regardless of the method chosen: newspaper, web page, TV, radio, etc.’, pointed out Sergiu Bozianu.
In his opinion, in order to exclude any interpretation on this topic, the NCPDP could, within a very short period of time, on the basis of the Article 23(6) of the same law, issue a regulatory decision to exclude explicitly the obligation of the media to register, as well as other categories of subjects, as a data operator.

According to Bozianu, at present, the registration as a data operator is an inefficient and outdated attribute, which should be cancelled urgently, as it takes a long time to obtain the registration and authorisation as an operator (from 2 to 6-9 months).

In this context, we remind that a draft law was registered in Parliament, which provides the journalists with free access to information from institutions like ‘Cadastru’ and ‘Registru’ about legal companies, provided that they register as a personal data processing operator. At the same time, the Chairperson of RISE Moldova, Iurie Sanduta, stated, during a meeting at the Public Services Agency, where this topic was discussed, that his editorial did not obtain great advantages after it registered as a data operator. He pointed out that, although it had the status of data operator, law enforcement bodies often restricted their access to information by invoking the personal data protection.