Personal Data Protection Law, Reach Over Scraped Public Personal Data
Legea nr. 195/2024 privind protectia datelor cu caracter personal, art. 6, art. 9(2)(e)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force 24 days, effective 23 August 2026.
A personal data rule binding public and private bodies.
As of 6 September 2026.
What it requires
- A scraper collecting the personal data of a person in Moldova from a public, unauthenticated page must still establish an art. 6 lawful basis, such as consent or a legitimate interest that respects the person's rights, for the collection and any later use, including training a model.
- Treat a biometric identifier, or other special-category data, derived from publicly posted photographs, video, or audio as subject to art. 9's narrower regime unless the data subject manifestly made that specific special-category data public themselves.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 6(1) requires a lawful basis, such as consent, a contract, a legal obligation, or a legitimate interest, before processing personal data at all, with no exception for personal data that happens to be publicly accessible; article 6(1)(f)'s legitimate-interest ground is the one most likely to be invoked to justify scraping ordinary personal data from a public page, but it still requires weighing the data subject's rights and interests rather than acting as a blanket carve-out.
Article 9(1) separately prohibits processing special-category data, including biometric data, without a ground listed in article 9(2); the only publicly-available-adjacent ground there is article 9(2)(e), which reaches special-category data the data subject manifestly made public themselves, and does not extend to ordinary personal data, or to special-category data another party (rather than the data subject) posted or that became public through a third party's disclosure.
A scraper collecting the personal data of a person in Moldova from a public, unauthenticated page must therefore still establish an article 6 lawful basis for the collection and any later use, including for training a model, and must treat any biometric or other special-category data derived from public photographs, video, or audio as subject to article 9's narrower regime.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics