Processing of personal data for purpose of combating crime regulated by new law in Moldova

The protection of personal data processed for the purpose of preventing and combating crime will be regulated by a new legal framework, harmonized with European Union’s legislation. The draft law was adopted by the parliament in the second reading.

The draft law, developed by the Justice Ministry, sets out special rules on how competent authorities – criminal investigation bodies, prosecution offices, courts and other empowered institutions – process personal data for the purpose of preventing or combating crime, investigating criminal acts, conducting criminal proceedings or enforcing penalties and security measures.

The document regulates the processing of personal data throughout the entire criminal process: from the registration of a complaint and the conduct of preliminary investigations to the initiation of criminal prosecution, the application of procedural coercive measures, the conduct of special investigative measures, the recovery of criminal assets and other actions undertaken in the context of criminal proceedings.

At the same time, the provisions of the law will also apply to data processed by courts and other competent authorities when exercising judicial control over pre-trial procedures. The draft also regulates certain situations that are not part of a criminal case, but are related to the detection of crimes, such as the receipt and examination by competent authorities of reports submitted by whistleblowers.

The law imposes strict obligations on authorities that process personal data. They will have to implement appropriate technical and organizational measures to ensure data security, keep detailed records of all processing operations, appoint a data protection officer who will supervise compliance with the law internally, and publish on their official website the contact details of the controller that processes personal data.

Citizens will have the right to contact the controller to find out whether or not their data has been processed. If the answer is affirmative, the person will have access both to the respective data and to additional information about how it is used.

The competent authority may refuse the request, if it would obstruct an ongoing investigation. If a citizen considers the refusal to be unfounded, they may contact the National Center for the Protection of Personal Data to verify the lawfulness of the processing, or they may challenge the refusal directly before the administrative court.

Authorities that process personal data, as well as persons empowered by them will be required to cooperate with the National Center for the Protection of Personal Data and provide it, upon request, with records of processing operations, in order to enable the monitoring of compliance with the law. If the Center finds a violation or if the authorities fail to comply with the measures ordered, it may impose fines of up to 2,000,000 lei.

The law will enter into force on August 23, 2026, simultaneously with the Law on the Protection of Personal Data, adopted in July 2024, which regulates the protection of personal data in all other areas, except those covered by this draft.