MoldovaPersonal Data Protection Law, Reach Over Scraped Public Personal Data
Legea nr. 195/2024 privind protectia datelor cu caracter personal, art. 6, art. 9(2)(e)
In force since .
A personal data rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- none
What it requires
- A scraper collecting the personal data of a person in Moldova from a public, unauthenticated page must still establish an art. 6 lawful basis, such as consent or a legitimate interest that respects the person's rights, for the collection and any later use, including training a model.
- Treat a biometric identifier, or other special-category data, derived from publicly posted photographs, video, or audio as subject to art. 9's narrower regime unless the data subject manifestly made that specific special-category data public themselves.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 6(1) lists the lawful bases for processing and article 9(2)(e) lifts the ban on special-category data that the data subject has manifestly made public. Neither requires a log or record. The same law carries a record of processing activities in article 30 and an accountability principle in article 5, which are other articles this row does not cite. Territorial reach is taken from the law's own article 3: it applies to controllers established in Moldova, and to controllers not established there that offer goods or services to, or monitor the behavior of, data subjects in Moldova.
- Kind
- None
- As of
What this law does
Article 6(1) requires a lawful basis, such as consent, a contract, a legal obligation, or a legitimate interest, before processing personal data at all, with no exception for personal data that happens to be publicly accessible; article 6(1)(f)'s legitimate-interest ground is the one most likely to be invoked to justify scraping ordinary personal data from a public page, but it still requires weighing the data subject's rights and interests rather than acting as a blanket carve-out.
Article 9(1) separately prohibits processing special-category data, including biometric data, without a ground listed in article 9(2); the only publicly-available-adjacent ground there is article 9(2)(e), which reaches special-category data the data subject manifestly made public themselves, and does not extend to ordinary personal data, or to special-category data another party (rather than the data subject) posted or that became public through a third party's disclosure.
A scraper collecting the personal data of a person in Moldova from a public, unauthenticated page must therefore still establish an article 6 lawful basis for the collection and any later use, including for training a model, and must treat any biometric or other special-category data derived from public photographs, video, or audio as subject to article 9's narrower regime.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .