Principles and legal bases

The six principles

All processing of personal data must comply with the principles in art. 5(1). Data is processed lawfully, fairly and transparently in relation to the data subject art. 5(1)(a). It is collected for specified, explicit and legitimate purposes and is not further processed in a manner incompatible with those purposes art. 5(1)(b).

Data must be adequate, relevant and limited to what is necessary for the purpose art. 5(1)(c), and accurate and, where necessary, kept up to date art. 5(1)(d). It is not kept in a form that permits identification of individuals for longer than the purposes of the processing require art. 5(1)(e), and it is protected by appropriate technical or organisational measures against unauthorised or unlawful processing and against accidental loss, destruction or damage art. 5(1)(f).

The principle of accountability

The controller is responsible for compliance with these principles and must be able to demonstrate it art. 5(2). The measures by which the controller ensures and demonstrates compliance are laid down in art. 24(1).

Legal bases

Processing is lawful only if and to the extent that at least one of the conditions in art. 6(1) is met:

• the data subject has given consent for one or more specific purposes art. 6(1)(a);
• processing is necessary for the performance of a contract to which the data subject is party, or for pre-contractual steps taken at his or her request art. 6(1)(b);
• processing is necessary for compliance with a legal obligation of the controller art. 6(1)(c);
• processing is necessary to protect the vital interests of the data subject or of another natural person art. 6(1)(d);
• processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller art. 6(1)(e);
• processing is necessary for the legitimate interests of the controller or of a third party, except where they are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child art. 6(1)(f).

Bases resting on a legal obligation or on a task in the public interest must be laid down in the legislation of the Republic of Moldova art. 6(3). Public authorities may not rely on legitimate interests in the performance of their duties art. 6(4). For a new purpose that is not based on consent or on normative acts, the controller determines whether it is compatible with the purpose for which the data was originally collected art. 6(5).

Consent

Where processing is based on consent, the controller must be able to demonstrate that the data subject has given it art. 7(1). A request for consent in a written declaration that also concerns other matters must be clearly distinguishable from them art. 7(2). The data subject may withdraw consent at any time, as easily as it was given art. 7(3). Where the performance of a contract is made conditional on consent that is not necessary for that contract, this counts in assessing whether consent is freely given art. 7(4).

For information society services offered directly to a child, the child’s own consent is sufficient from the age of 14; below that age, it must be given or authorised by the legal representative art. 8(1), and the controller makes reasonable efforts to verify this art. 8(2).

Data that needs special protection

Processing of special categories of data is prohibited art. 9(1). They include data concerning health, genetic data, biometric data used to uniquely identify a person, and data revealing racial or ethnic origin, political opinions or trade union membership. The prohibition does not apply in the situations listed in art. 9(2), for example where the data subject has given explicit consent art. 9(2)(a). Data relating to criminal convictions and offences is processed only under the control of a public authority or where authorised by normative acts that provide appropriate safeguards art. 10(1).

When identification is not required

If the purposes of the processing do not require the data subject to be identified, the controller is not obliged to obtain additional information solely in order to comply with the Law art. 11(1). If it can demonstrate that it cannot identify the data subject, the controller informs him or her accordingly, if possible, and the rights in art. 15–20 do not apply, unless the data subject provides additional information enabling his or her identification art. 11(2).