Preliminary Information and Recommendations for Citizens Regarding the Security Incident Affecting Government Electronic Services

The Public Institution “Electronic Governance Agency” (AGE) notified the National Center for Personal Data Protection (the Center) of a personal data security breach identified in certain government electronic services. According to the preliminary information reported by AGE, following technical investigations conducted by AGE in cooperation with the Public Institution “Information Technology and Cyber Security Service” (STISC) and the Cybersecurity Agency (ASC), approximately one million attempts to unauthorizedly extract personal data sets were identified, along with around 750,000 data sets that may have been extracted without authorization. According to the notification submitted and information made public by AGE, the potentially affected information includes the following categories of data: This list reflects a preliminary assessment of the potentially affected information and does not mean that all data categories were extracted for every individual or through every service concerned. Law No. 195/2024 on the protection of personal data establishes that data must be processed lawfully, fairly, and transparently, for specified and legitimate purposes, and limited to what is necessary. In the event of a data security breach, the controller is required to notify the Center without undue delay and, where possible, no later than 72 hours after becoming aware of the incident. Individuals who believe they were affected by the data security breach in the context of the cyberattack against digital public services have the right to contact the controller for clarification and, where appropriate, to exercise the rights guaranteed by the Law on the Protection of Personal Data.