VPNs with servers in Moldova

Providers must also preserve data on request for up to 120 days where it risks destruction, and supply, on a lawful request, user data including the payment method and anything that can identify the user. Law 241/2007 (art. 20(3)), as quoted in the ministry’s impact analysis of 29 November 2022, separately requires network and service providers to keep identifying and traffic data for one year for telephony and six months for internet.

That analysis proposed amending Law 20/2009 to let the ministry order immediate preservation of data, and to name the authorities that may order a block. Whether a VPN operator is a service provider under these laws is not established.

Article 7(1)(e1) of Law 20/2009 obliges providers to cut off, under the conditions of the law, access from their own systems to all IP addresses hosting web pages that contribute to offences or breach legislation, or that give instructions for committing them. The provision does not say which authority may order this, and because it blocks by IP address, lawful sites sharing an address can be affected.

The Criminal Code punishes illegal access to computerised information (art. 259) with a fine, community service or up to two years’ imprisonment, and up to three years in aggravated forms, and illegal interception of a non-public data transfer (art. 260¹) with a fine or two to five years. Article 346 covers public incitement to hatred or violence on grounds of prejudice, including through information systems.

The route to an author runs through the provider duties above: user records, 180-day traffic data and disclosure of identifying data on request. Monitoring of electronic communication connections and interception need the authorisation of an investigating judge on the prosecutor’s request (Law on Special Investigative Activity, art. 18).

In Iordachi and Others v. Moldova (10 February 2009) the European Court of Human Rights held unanimously that Moldovan law did not adequately protect against abuse of state power in the interception of telephone communications, a violation of Article 8. The applicants had obtained Supreme Court figures showing that 99.24 per cent of interception applications were authorised in 2007.

Moldova amended its legislation in 2012 in response, adding a new Law on special investigation activity; a Moldovan legal-resources organisation reported in February 2016 that the government had presented no action plan for executing the judgment. The order of the rows is the security score, and a server’s location is not a recommendation.