CIVIL SOCIETY SUPPORT FOR REFORM criminal complaints. Previously, lawyer Iurie Margineanu had accused the Government of political interference, persecution, and violation of judges’ rights, both directly and through NGOs, and accused NGOs of acting as the Government’s secret police, allegedly present in state structures at all levels, key positions, and commissions. 172 On 3 May 2023, the Prosecutor’s Office of the Chisinau mu­nicipality instituted criminal proceedings on suspicions of treason and espionage, following the scandal in which an NGO was accused by politicians, judges, prosecutors, and lawyers of illegally accessing personal data from the Real Estate Register. The prosecutor’s order of instituting pro­ceedings was leaked and published. According to it,“from 25 May 2022 until 15 July 2022, persons unknown to the pros­ecuting body, in complicity with Constantin Copaceanu, who according to the contract between PSA and IPRE, was the sole user who had access to the Central Database of the Real Estate Register, with the purpose of collecting information, registered with the username and password attributed to Copaceanu, who, at that time, was not even in the country”. Moreover, Copaceanu and his accomplices made“net­work connections using a VPN from 26 IP addresses located in Panama. They accessed information about real estate related to 680 259 cadastral addresses, including information about the buildings of the Presidencial Office, the Government, SIS, the PG’s Office, the Interior Ministry, the Ministry of Defense, Chisinau Airport – objectives that are part of the country’s critical infrastructure, the destruction of which could nega­tively affect the safety, security, and well-being of the state.” 173 According to explanations given to the IPRE complainants, it was about“a bot which got out of control”. 174 Apparently, 680,259 cadastral addresses were accessed to assist the Pre-Vetting Commission in evaluating 20 candidates for judges and prosecutors. Law 26/2022 gives the Pre-Vetting Commission the right to access information systems containing data necessary for the fulfilment of its mandate, 175 but does not provide for such powers for NGOs supporting the Commission’s activ­ities. It is not clear, however, whether specific individuals from IPRE have been part of the Commission’s Secretariat, apart from the alleged role of IPRE’s Co-Executive Director, Adrian Ermurachi, in providing advice and training at the start of the Pre-Vetting Commission’s work. CASE STUDY 21. IPRE Executive Director Iulian Groza apologizes for erroneous download of cadastral data of hundreds of thousands of people IPRE.md, 26 January 2023,“IPRE condemns any intimidation of Executive Director Iulian Groza and comes up with information on the incident of erroneous access to data on real estate” 176 During May-August 2022, a team of experts contracted by IPRE conducted re­search, the subject of which was the independent integrity check of candidates for judges for the position of member of the SCM and prosecutors for the po­sition of member of the SCP, respectively. The purpose of the research was to support the extraordinary evaluation efforts undertaken in accordance with Law No. 26/2022 on some measures related to the selection of candidates for membership in the self-administrative bodies of judges and prosecutors. As a result of the research, two independent reports have been published on candidates for membership of the SCM and the SCP.... As part of the research methodology, the experts were to verify the correctness of the declaration of declared real estate assets mentioned in the last five years in the declarations of assets and personal interests of prosecutors and judges subject to evalua­tion under Law No. 133/2011. In this context, in order to carry out research in the public interest and tak­ing into account the provisions of Law No. 133/2011 on the protection of per­sonal data(Art. 10, Art. 12 para.(3) and Art. 5 para.(5), lit. e) and f)), IPRE has concluded a contract with the PSA regarding access to the web service of the real estate cadastre. In this context, the responsible person was designated, on the basis of a service provision contract signed with IPRE, as the sole user of the real estate cadastre web service, who was in charge, from June to July 2022, of checking the information on real estate for the verification/confirmation of the real estate owned by the subjects of the assessment. After finalizing the research and publishing the reports, IPRE found that the ex­pert contracted as the sole user of the web service erroneously accessed dur­ing the process the data on real estate that did not concern the subjects of the research. According to the expert’s own statement, the expert erroneously ac­cessed the data by entering the data into the search engine of the cadastre web service using an electronic robot application for automatic access. The user stated that the erroneous access was discovered at the end of the work process and all the erroneously accessed information was deleted from the list of ac­cesses without being analysed or processed by the user. Both IPRE and the single user who directly admitted the erroneous access have provided the National Centre for Personal Data Protection with all the infor­mation regarding the circumstances of the incident, in accordance with the rig­orous requirements of Law No. 133/2011 on the protection of personal data. Accordingly, IPRE has taken all internal measures for confidentiality and se­curity in the process of working with the data, and after the incident was de­tected, IPRE has taken all internal measures to check the single user’s work pro­cess and to sanction the single user for the incident. We reiterate that the research carried out by IPRE experts only concerned the candidates of judges and prosecutors who applied for the competition for the position of member of the SCM and the SCP. None of the third-party IPRE mem­bers, including the management and the researchers who worked on the in­dependent evaluation reports, had access to the information accessed by the single user, either for the purpose of the research or the data accessed errone­ously. The contracted expert was the only person who had access to the cadas­tral web service. IPRE regrets and apologizes to those affected by the erroneous access to real estate data. 172 https://unimedia.info/ro/news/9046dca961587923/avocat-un-ong-a-accesat-baza-de-date-a-unor-judecatori-si-avocati-aceste-organiza­tii-sunt-un-fel-de-politie-secreta-a-guvernarii.html 173 https://unimedia.info/ro/news/40f66e57f0ce78c4/tradare-si-spionaj-cum-un-angajat-ipre-ar-fi-accesat-date-despre-cladirile-presedintiei-guvernului-par­lamentului-sis-si-alte-680-mii-de-adrese-de-pe-ip-uri-din-panama 174 Ibid. 175 Law 26/2022 on Pre-Vetting, Art. 10 para.(2). 176 https://ipre.md/2023/01/26/ipre-condamna-orice-intimidare-in-privinta-lui-directorului-executiv-iulian-groza-si-vine-cu-informatie-privind-inciden­tul-de-accesare-eronata-a-datelor-privind-bunurile-imobile/ 53