An investigating official with Moldova’s Anti-Money Laundering Service (SPCSB) logged in the governmental database to check the profile with personal of RISE Moldova journalist Iurie Sanduta, just hours before the newsroom published an investigation.
The journalist himself learned about this fact more than a year later, from the very officer who had viewed the classified information. During informal conversations, the officer produced two entirely different explanations.
When the journalist requested an official explanation, the institution refused to disclose the reason, limiting the response only to “the personal data of Mr. Iurie Sanduta was processed for work-related duties”.
The reporter took the matter to court. After more than three years of legal proceedings, and only after a court order to comply with its ruling, did the Service come with a third explanation: a possible case of mistaken identity.
Petru Macovei, director of the Independent Journalism Association (API), says the circumstances bear “all the hallmarks of an attempt to intimidate an investigative journalist”.
On 15 July 2021, at 9:34 a.m., an investigating official from the SPCSB accessed the governmental database and viewed the classified profile of journalist Iurie Sanduta. He used the Web-Access application that allows authorized institutions to visit the servers of the Public Services Agency, including the State Population Register.
Nine hours later, on the same day, RISE Moldova published an investigation entitled “Casta” – about cocaine trafficking from Latin America to Eastern Europe. The investigation identified, among others, people connected to influential politicians. One of them was businessman Iurie Luncasu, who was found dead with a gunshot wound to the head on 17 August 2019.
MEETING THE OFFICIAL
More than year later, on 17 August 2022, an SPCSB employee met the RISE Moldova journalist in a public place and told him that he was the person who had seen his personal data.
“I asked the investigating official why he needed my data and whether I was investigated in a criminal case. He said no, there was nothing on me and that it was all a routine check. My name raised a flag in connection with my Revolut card I used to make payments,” Sanduta recalls.
The journalist replied that at the time his profile was checked he had not had a Revolut card.
An official response from Revolut, a digital bank providing services to individuals and companies, confirms that the journalist only opened his Revolut account in May 2022. He mainly used it for investigative work — almost a year after his personal data had been checked.
The SPCSB employee then gave him a different explanation. He said that he had found the journalist’s identification number in an Excel file of a colleague and simply wondered who could be the person with that number. This is how, he claimed, he ended up viewing Sanduta’s personal data.
Iurie Sanduta, journalist at RISE Moldova: If the version with the Excel document is true, I find it serious that a public official would keep files with identification details of public figures on a personal or work computer without a lawful reason.
After the meeting, the reporter returned to the newsroom and checked what the official had told him. He logged into the government portal using his digital signature. The portal allows any citizen to see who has accessed their personal data. There he found a record showing that the SPCSB had viewed his profile on 15 July 2021 at 9:34 a.m.
“I normally log in every six months to see who has checked my profile. I started doing so particularly after noticing that [the national telecom company] Moldtelecom had accessed my data even though I have not been its customer for several years. But I missed the [SPCSB] official reading my profile data and did not check again for more than a year,” the journalist says.
Since the explanations given by the SPCSB employee differed and were unsupported by evidence, the RISE journalist asked the SPCSB to give the actual reason for reading my profile and to disclose the name of the employee who did it.
“FOR OFFICIAL DUTY PURPOSES”
On 19 October 2022, the SPCSB issued an explanation that was different from the one delivered by its employee:
“In the context of your request, we inform you that the personal data of Mr. Iurie Sanduta were processed for official duty purposes in compliance with Law No. 308/2017 on prevention and combating of money laundering and terrorist financing. The processed data were not disclosed to third parties or retained after processing.”
Iurie Sanduta, RISE Moldova journalist: I reviewed my personal security audit, in which for several years I have been recording details and carefully monitoring every incident and every threat I receive. I noticed that during that period I received repeated messages from a source saying that someone in an oligarch’s circle was trying to gain access to my email and other communications platforms, and urging me to make sure my security precautions were up to date. After the SPCSB refused to acknowledge the purpose for which it needed my personal data, flagged this suspicious incident.
In November 2022, the reporter lodged a complaint with the National Centre for Personal Data Protection (CNPDCP). The institution found that the SPCSB had not breached personal data protection legislation.
API director Petru Macovei believes “it is worth knowing whether the official did it for personal or institutional reasons… What is troubling, however, is that the Personal Data Protection Centre has found no breach of law in this case. I remember that, previously, the Centre ruled in the past against investigative journalists who had accessed a prosecutor’s profile for work-related purposes. But in this case, the Centre sees no problem.”
In March 2023, the RISE journalist challenged the CNPDCP’s decision in court, and in October 2023 he also sued the SPCSB.
On 21 February 2025, the Chisinau District Court ruled in favor of our journalist. The court ordered the SPCSB to reveal whether it had ordered his profile to be analyzed, for what purpose, what data it had used, and whether it had passed the data to a third party. Details HERE
“The fact that the claimant’s personal data were retrieved places a positive obligation on the state authorities to explain why such a measure was necessary,” Judge Liudmila Holevitcaia noted in her ruling.
On 16 December 2025, the Chisinau Court of Appeal dismissed the SPCSB’s appeal and upheld the first-instance judgment. The appeal judges found that the Service’s response issued to the journalist was “declarative in nature, without any concrete substance” and that it had “unlawfully refused to explain specifically why it was necessary to interfere with the claimant’s rights”.
According to the same court, “the SPCSB had not identified any specific risk to an ongoing investigation, for the prevention of money laundering or state security, limiting itself to a generic reference to its institutional status”. The judges also pointed out that “merely invoking Law No. 308/2017 on prevention and combating of money laundering and terrorist financing cannot serve as a legal basis any time it needs to retrieve someone’s personal data”.
Both courts found that the SPCSB had pursued no formal actions and had filed no case in which the journalist’s data were required. The Service itself admitted in court that “no actions or documents whatsoever had appeared as a result.” Therefore, there is no way of establishing whether the journalist’s data have been passed on to anyone else.
Promo-LEX lawyer Vadim Vieru explains that “a state institution may check a person’s data without their consent only for a specific purpose, which it must be able to demonstrate. It may refuse to explain the reason only if it can show what specific investigation would be put at risk by doing so”.
He continued, “‘For official duty purposes’ could validate any access and therefore explains nothing, while ‘mistaken identity’ remains an affirmation that nobody can verify, because the Service itself told the court that it had issued no document whatsoever concerning this operation.”
Although the Court of Appeal’s judgment remained enforceable, the SPCSB did not hurry to issue a formal response to the journalist, so his lawyer asked the judges to ensure enforcement of their own judgment. On 15 June 2026 the Court of Appeal issued an order obliging the Service to comply – and it did so, almost seven months after the judgment.
The journalist’s lawyer, Nicolae Frumosu, says that “the SPCSB was unwilling to comply with the judgment guaranteeing the right of access even after the judgment had become final and enforceable”.
“We had to initiate a legal procedure to compel enforcement of a judgment through the Chisinau Court of Appeal. The information we had been waiting for arrived only after a special order from the Court,” Frumosu explains.
And here is where things turned funny if they weren’t about a serious violation of law.
THE THIRD VERSION
In a letter dated 13 July 2026, the SPCSB said that the journalist’s name, surname and IDNP (unique tax code) had been checked to “rule out a possible case of mistaken identity” with another person being investigated by the Service. Mr. Sanduta, if added, was not that person.
However, in documents submitted to the court, the SPCSB said that several categories of data had been checked, such as name, surname, identification number, date of birth and residential address.
But even in this latest response the SPCSB avoided telling the truth. “A search in the state database application works when someone feeds the IDNP — a unique identifier against which there can be no case of mistaken identity. The given explanation therefore appears absurd,” says Sergiu Bozianu, president of the Association for Protection of Private Life.
Nicolae Frumosu, the RISE journalist’s lawyer, says that “the response from the SPCSB appears rather formalistic, while verifying whether it is accurate in a court of law is practically impossible”.
The Court of Appeal, he added, “has few tools at its disposal, within the enforcement proceedings, to establish whether the information provided by the SPCSB is truthful”.
“What we can do now is to accept this response and trust that SPCSB officials acted in good faith when complying with an enforceable court judgment. Otherwise, those responsible may face administrative and criminal liability for failing to comply with a court judgment.”
So far, the SPCSB has not revealed the name of the person who had retrieved our journalist’s data from its duty station, what the information was needed for, why exactly on day RISE published its investigation, or who was the suspect they were looking for during the search through the database.
ANTI-MONEY-LAUNDERING SERVICE TAKES THE CASE TO THE SUPREME COURT
Meanwhile, the Service has filed a legal motion with the Supreme Court of Justice (CSJ) against the Court of Appeal’s decision. On 9 December 2026, the CSJ is due to decide, in absentia of the parties, whether to admit that motion for examination.
According to API director Petru Macovei, “situations like this pose a risk both to journalists, who receive ‘signals’ telling them to ‘behave’ themselves, and to their sources of information, including potential whistleblowers, who are discouraged and forced to feel insecure”.
Data protection expert Sergiu Bozianu says: “What we see is a classic failure of enforcement of the Personal Data Protection Law followed by attempts to conceal the abuses against an investigative journalist who is a permanent source of annoyance for certain decision-makers, institutions and public authorities with investigations about those individuals or people connected to them.”
Vadim Vieru explains what one can do under such circumstances:
“Anyone who discovers from the database logs that their personal data were checked is entitled to request an explanation from the institution which accessed their profile. If they receive a merely formalistic response, they can file a complaint with the Data Protection Centre and launch a legal administrative motion. Where there are signs that the check had nothing to do with the institution’s work, they should also notify a prosecutor. When a journalist realizes his profile was viewed, and that the logs is dated with the day his investigation is published, the state owes an even more detailed explanation, because the very press freedom is also at stake.”
API director Petru Macovei likewise says that personal data may be accessed only on strong legal grounds and under specific conditions defined by law, while every case of unlawful interference should be investigated and sanctioned.
“I am convinced that journalists must report the abuses in this area whenever they occur, and our society as a whole must safeguard that personal data is not used to exert pressure or to intimidate,” Petru Macovei stated for RISE.
