EGA Director on Free Access to Media Databases: Without Modifying the Legal Framework, Access Cannot Be Guaranteed

Which data sets can journalists access online via the E-Government Agency (EGA), when will the media have free access to public databases, and when will we use mobile electronic signatures for free? Olga Tumuruc, the director of the authority, answers these and other questions about digitalization and citizens’ literacy.

Media Azi: Last November, the EGA announced it was working on a mobile electronic signature that could be used by journalists for signing various documents. At what stage is its development, and what advantages does it imply?

Olga Tumuruc: The technical solution for mobile electronic identity which does not require using specialized devices by the signer, abbreviated as MobiSign, is at an active development stage. We have prepared a predemo version for internal testing and registration of the application on the appropriate platforms of Android and iOS operating systems providers. Simultaneously, we take necessary organizational and legal steps for establishing the mechanisms for registering, certifying, and developing the necessary legal framework. This is a new solution, therefore, it should be regulated correctly: the related legal reports and the instructions we need, necessary regulations, and all the documentation required for approval and certification of the solution by the Information and Security Service (ISS), as stipulated by Law No 91 [Law on Electronic Signature and Electronic Document – editor’s note].

The application which allows obtaining an electronic identity based on the qualified advanced signature offers multiple advantages for all users. There are no specific facilities for different categories such as journalists, doctors, or teachers. It will have an impact on all those interested in an electronic identity, because they will no longer need a physical device obtained from a provider and containing an electronic signature, such as a SIM card or a USB token [device for generating a secure cryptographic signature – editor’s note]. The new type of electronic signature will be generated directly on the mobile phone based on sophisticated encryption algorithms ensuring the necessary security.

Hence, it will require downloading an application on the phone.

This process has to be followed step by step. At the first stage, as we do not have any remote identification mechanisms yet, the beneficiary will still need to address the authority, i.e. the Public Services Agency (PSA) which has multifunctional offices all over the country for identification and registration. Citizens abroad, including Moldovan citizens from the diaspora, can address the diplomatic missions and consular offices, which will issue the identity for the electronic signature. Those who already have an electronic signature will not need any registration, because they have already fulfilled through this procedure. Afterwards, the application will be downloaded, following all the steps according to the instructions, and, finally, the signature will be available free of charge on mobile phones for all citizens.

When could we start using it?

We plan to launch this service this year. We have not complied with the deadlines we originally set for ourselves, because we depend on other factors, such as registration on iOS and Android platforms. It involves a complex procedure for such applications, including certification from the Information and Security Service. Without following these stages, we could launch this solution in production. The deadline we have set is this April.

How many citizens currently use the electronic signature?

At the moment, there are approximately 200 000 electronic signature beneficiaries; this number is insufficient, which is due to several factors, including the fact that the process of obtaining the signature is more complicated and involves some expenses. As a result, we have a limited number of electronic identities, and due to this factor, we decided to develop a more accessible new solution.

How are people getting used to it? It is much easier for some people to use a printer, to sign by hand, or to wait in line, for example. Do you feel people’s attitude has changed?

Yes, people are now more eager to use electronic services and information technology for purposes other than those they are already accustomed to. Even the pandemic has played its part in increasing the use of electronic services; hence, people who have already gained this experience have more confidence in the alternative solutions. All of these factors have predetermined this change among the citizens.

How much has the number of citizens who prefer using digital public services increased?

We have recently completed a sociological survey for assessing the perception of electronic services by citizens. The figures demonstrate that, during the last year, citizens frequently used electronic services and addressed public service providers via alternative channels more often. Obviously, one of the explanations is that citizens were forced to do so, but as the number of digital service users increases, so does their confidence in these services. Despite being constrained to use them due to the pandemic restrictions, because they could not visit the providers physically, the citizens have finally gained more confidence and positive experience. Strange as it may sound, everyone acknowledges that the positive effect of the coronavirus pandemic is that it has stimulated digitization and increased people’s confidence in such services.

WAITING FOR FREE ACCESS TO THE DATABASES

For several years now, there have been talks of providing free access to state databases for journalists. Shifting this responsibility from the PSA to the EGA was also mentioned. There were promises; then, a draft law was registered by the Parliament, but afterwards, it was put into cold storage. Media Azi has addressed this topic repeatedly, including discussions with the new government representatives; therefore, we would like to know your opinion: what has caused this stagnation?

We have discussed this issue more than once. In our opinion, it is clear that, first and foremost, the regulatory framework for the press needs to be updated, amended, or perhaps even completely changed, because, in the context of access to data, the basic issue to be addressed is keeping a balance between journalists’ interest and people’s personal data protection. With the current legislation, implementing it in the media segment is difficult because there are no clear definitions of who can be considered to be a data user, a person, or a journalist, and the extent to which this data could be accessed for journalistic purposes is not stipulated. These issues need to be clarified. There should be a very clear definition of the role of an investigative journalist or a media representative who has the right to data access.

From these considerations, when discussing possible solutions for configuring and providing access to databases for journalists, one of the most reasonable solutions would be the following: access could be stipulated for the newsrooms, whereas the newsrooms could assume regulating the relations with the journalists. In fact, neither the PSA nor the EGA or any other institution is empowered to establish clearly whether a journalist has a certain status and whether they are authorized to practice journalistic activity, to work on research materials, etc. The solution could involve interacting with the newsrooms which know their journalists, are aware of their activity and the segment each reporter specializes in, therefore, they could assume this responsibility for processing the data.

As to free use, access can only be ensured by changing the legal framework. What is the role of the EGA in this context? Promoting the regulatory framework for journalists’ activity and the media is not the EGA’s mission. It goes beyond our sphere of competence and responsibilities. Our role is ensuring interoperability and data exchange. Since 2019, we have prepared the technological platform and the organizational model to be applied. We have all the relevant solutions available, such as authorized access via the date.gov.md portal. This model allows us, on the one hand, to have access to data and, on the other hand, to allow its correct use, as it is based on user authentication and identification to ensure the balance between journalistic interest and private individuals’ interest.

Have the Agency’s representatives been addressed on this subject recently?

We haven’t. Last autumn, we had a discussion at the PSA, which was an initiative of the Public Services Agency to try to probe the ground and see how we could move forward in that direction. We had only one discussion with several journalists, and we agreed to share the information about which data is available and how it could be accessed, but these discussions were abandoned by the journalists; therefore, no progress was made, and no active interest was obvious. On the one hand, access to information is required, and we present the ways to ensure it, but on the other hand, we make no headway. Probably the media institutions are used to the previous methods of accessing data and prefer traditional ways as long as they still have those channels. We have witnessed only a declarative interest on the part of media institutions to access data in a more organized and structured way via an interoperability platform.

However, I would like to reiterate: if free access to data is the goal, then we cannot intervene until the regulatory framework is amended.

Has the EGA already signed any paid access contracts with any newsrooms?

No, we haven’t signed any contracts.

If such a contract is signed, what types of data would an editorial office have access to?

Several data sets are available on the platform. First of all, these are those regarding real estate and movable property and legal entities, if we talk about the data from the PSA. Also, the data from the National Social Insurance Office, the National Medical Insurance Company, the National Financial Market Commission, the State Fiscal Service (FISC), etc. Currently, quite a lot of data is configured in the interoperability platform; many institutions actively use this platform to share data with each other. I cannot assess whether it’s much or little, or whether this is exactly what is required by the journalists, because journalistic investigations differ by spheres and topics.

What we always mention while working with an institution is that we need to have a starting point. We have always made the data sets available to all the interested parties, and we have suggested starting with what we already have and identifying together what other information would be required. The platform is dynamic, and it can be expanded if any new needs arise. For instance, we had no data on real estate leasing, but we started collecting it. As you know, lenders have to declare such agreements to the FISC, which is a rather disorganized procedure. Subsequently, the FISC made a consolidated effort to ensure that this information was registered. It is a continuous data collection process, and we are currently working on creating the database.

ON THE BALANCE BETWEEN PUBLIC INTEREST AND PERSONAL DATA PROTECTION

It was an impediment until recently, and the obligation to register as a personal data operator was recently canceled.

Yes, the amendments to Law No 133 [Law No 133 of 08.07.2011 on Personal Data Protection – editor’s note] actually excluded the obligation to register as a personal data operator, as well as the need to submit a notification to the National Center for Personal Data Protection (NCPDP). This amendment was also made due to the need to be in line with the European practices and the European regulations on personal data protection. But the fact that this obligation to register no longer exists does not imply that operators are free to access and process unjustified amounts of data. The lawfulness of data processing and the correlation between the purpose of processing and the amounts of data processed should always prevail.

It should be taken into account that, due to the same digitization package, additional amendments were made to Law No 133, which establishes for operators the need to assess the impact of personal data processing operations. In fact, depending on the nature, scope, context, and purposes of personal data processing, before processing the data, the user is supposed to perform this analysis and assess the impact of the operations, ensuring that there is a balance I have mentioned earlier.

Obviously, the role of the national authority for personal data protection is important, because the operators will not cope with making this assessment without an operational support from the competent institution. Methodological support and guidance from the authority are mandatory, and individuals’ rights to privacy and proper processing of personal data should be ensured. Otherwise, the situations are likely to get out of hand, but it is important for the Center to be aware of its role in guiding all the operators, economic entities, and public institutions on properly organizing the process of personal data processing, and using these assessments is in the interests of both the institutions and the citizens.

Journalists have also previously complained about the difficulties they face while accessing open data provided by the EGA: for instance, they say that the information is outdated, and older data were generated compared to those provided by the PSA. Have any steps been taken in this regard?

The difference is that the journalists access open data. There are three distinct components on the date.gov.md portal, and the authorized data access module works a little differently than the one configured for open data. In case of open data, an Excel file regularly published by the PSA is used, because this is the reference account, and in that case, such as records from the State Register of Legal Entities, for instance, we cannot talk about real-time data access. Therefore, it has nothing to do with updating data. Whatever is listed in the register is provided.

DIGITAL LITERACY AND CYBERSECURITY OF THE REPUBLIC OF MOLDOVA

What is the digital literacy rate among the citizens of the Republic of Moldova?

The level of digital skills differs greatly, and we have to organize our efforts and generate the desirable modifications proceeding from this reality. One thing is for sure: digital skills are not just about using a computer, a phone, applications, or operating systems. Currently, digital skills imply much more: using information correctly and efficiently, working with data, articulating the need for data amount, communication, proper cooperation in digital space, and creating and editing digital content. We should also mention online security, protecting the devices we work with, solving problems, and using certain digital tools we have at our disposal. Once we are aware of the complexity of digital skills, we can work in that direction to develop new digital skills and train people to improve the activities they take part in, to work in a digital environment efficiently and comfortably, and to adapt to the increased pace of technological progress.

We have set a goal to launch targeted information campaigns for different user groups on different topics and on different channels, taking citizens’ different levels of digital skills into account. To do this, we use written information activities and train business environment, public institutions, and academia representatives; currently, we organize such activities online due to the pandemic, and also share video products with the general public. Another element would be adjusting training programs to all the cycles of education. For this purpose, we intend to develop a closer cooperation with the Ministry of Education and Research, because the study curriculum can be modified only with the support of this authority.

How would you assess the degree of cybersecurity of the Republic of Moldova? How protected are we in this regard?

It is a sensitive subject. I cannot provide any comment on the other entities, but everything we developed at the EGA is designed and configured in compliance with the principles of providing information security and personal data protection by default from the very start. All the e-government solutions that have been developed are hosted on the MCloud government platform, which, in its turn, has very complex eight-level security architecture and provides a great degree of security in terms of availability, confidentiality, and system and data integrity.

If we mention critical, sensitive scenarios, systems, and processes such as data sharing, additional security rules are set up to be applied directly to a specific need and to exclude such issues as unauthorized access, message interception, or altering the content of data exchange messages. At the same time, access to the EGA systems and solutions, including for the administrators of these solutions, is configured strictly and only on the basis of an electronic identity to make access controlled and authorized, and provide traceability of all the actions taken. Another step would be event logging using a third-party logging tool such as MLog Government Electronic Logging and Auditing Service, where events cannot be deleted or modified after they are logged. That is the principle of functioning of this service.

If all the systems and registries managed by other entities follow at least the same rules and mechanisms which are implemented at the Agency level, we would certainly reach a very high level of security and become much less vulnerable to cyberattacks, and it would be less difficult to detect certain attempts in proper time and minimize their negative impact as soon as possible. Generally speaking, there is a continuing and active concern on the part of all the Moldovan authorities and entities, which is actually a good thing, because, if we do not even think about ensuring system and data security and protection, it means that we are unaware of eventual risks and the damage that could follow, including to citizens.

How do you see the digital future of the Republic of Moldova? How fast are we progressing?

I think we are rather open to quickly implementing technologies, solutions, changing, and modernizing, and this is a really good premise to succeed in generating the changes which will have a positive impact. In the Republic of Moldova, our future will be a more pleasant and more technological one.

As a citizen, I believe that digital future of the Republic of Moldova would mean electronic public services, efficient interaction, a state that uses information technologies, including for optimizing its internal activity, reducing costs, and making administrative activity more efficient. A digital state would also mean informed and curious citizens interested in using information technologies, and also a civil society that brings positive pressure on the public administration insisting on the use and continuous updates of technologies and innovations. Implementing a technology or innovation is not enough; it is important to keep pace with all the changes taking place. Any innovation involves optimizations and changes we have to keep up with.

Does the political factor play an important role in this sphere?

Yes, political support is necessary for any changes. Innovation and information technology demand investment, and without any guidance and political support, it would be much more difficult. We have to be aware of the enormous effects and benefits of these investments, and we need to accept and promote them.