In his article “Privacy’s triumphant move”, Dmytro Chopovsky from the Institute for Mass Information analyzes the Law on Personal Data Protection recently passed by parliament and signed into law by the President despite calls from business, human rights and media organizations. His assessment is equally damning.

He begins by stating that “From when the Law on Personal Data Protection comes into force, it will be prohibited to circulate any personal data about a person without their consent, unless the person is a first category public official”.

 

He comments dryly that after decades during which people’s communal living quarters were divided by sheets, the idea of privacy had scarcely taken root in our consciousness, when the Verkhovna Rada set to legislating “privacy”. And, “as is the way here, any good initiative is spoiled by bureaucratic procedures and political calculating, becoming, as a result, a threat. In this case it is a threat to freedom of speech and of non-compliance with European democratic standards”.

 

The area of privacy and personal data had lacked proper legislative regulation. A Law on Personal Data Protection was passed in March 2006, as part of measures to fulfil Council of Europe demands and reform information legislation. In April 2006 President Yushchenko vetoed the law on the grounds that it did not comply with the Council of Europe Convention.

 

In June this year the Verkhovna Rada made another attempt, passing with a large majority (355 votes for) the Law on Personal Data Protection which President Yanukovych despite very active protest from the business community and civic society signed on 24 June.

 

“Parliament thus decreed that personal data is information on restricted access. Personal data, according to the law, is any data about a person enabling others to identify him or her.  This can even be last name, name and patronymic, mobile telephone number.” This means that the gathering, processing or circulating of any such data is possible only with the consent of the person or in cases envisaged by law. The Law makes an exception only for first category public officials: National Deputies, the heads of State committees who aren’t members of the Cabinet of Ministers; the heads of other central bodies of power under the Cabinet of Ministers; the Permanent Representative of the President in the Crimea; the President’s Representatives in the regions, Kyiv and Sevastopol; the first deputy ministers; first deputy heads of State committees which are part of the Cabinet of Ministers; the Heads of the President’s Administration; the Secretariat of the Verkhovna Rada and other equivalent positions

The author points out that members of civic society have long stressed the need for a law on personal data protection.  The Law passed recently is in principle aimed at protecting personal data, but in practice it “could complicate life for all of us, worsen conditions for Ukrainian business and significantly restrict freedom of speech”.

 

The Law needed to comply with the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and other documents however it would have been quite sufficient to issue a compact law of a general nature. Instead they came up with a true masterpiece, so general that it could apply to absolutely everything.

 

“The law establishes a mechanism to protect against the collection, processing and use of personal data without a person’s consent. Yet there is no link with protection of the right of respect for private life, of which personal data is a component part. Under such circumstance the provisions of the law may be used for other purposes than to protect human rights.  A new controlling body appears entitled to make implementation by all parties mandatory, while on the other hand the law enforcement agencies receive yet another pretext for checking and initiating criminal investigations”. The author points out that criminal liability for intrusion in the private life has been established in Article 182 of the Criminal Code, and that this can apply since the circulation of such information can be treated as unlawful.

 

Among other extraordinary innovations he mentions the definition of a database, according to which even a case with business cards could be deemed such, and should therefore have State registration. “According to Article 1 the law does not apply to creation of personal databases and processing of personal data in these databases by an individual, exclusively for their non-professional personal or everyday needs”. So if your collection of business cards has your hairdresser, that’s OK, if it contains those of business partners, then this is use for professional needs.

 

The author suggests that school textbooks will need to be written more or less as “A held talks with B”, “the flag over the Reichstag was raised by A, B and C”, since the law states that “the use of personal data for historical, statistical or academic purposes can only be in depersonalized form”.  Taken entirely literally, then you can’t even cite other colleagues in an academic work even with their written consent.

 

Freedom of speech

The restrictions on the right to privacy in the case of public figures is one of the guarantees of freedom of speech.

 

The Law states that it does not apply to the activities of a journalist in creating or processing personal databases, yet does apply if the person’s data is not in any database, or is in, for example, a State database. In practice this means that after the law comes into force on 1 January 2011, a journalist will not be able to circulate any personal data (as per the definition above) without the person’s consent, unless the person holds electoral office or is a first category public official.

 

The Law does not contain the concept of “public figure” which is an “axiom” of European democratic standards. In European Court of Human Rights case law, there is more scope for permissible intrusion in a person’s private life. This means that it is possible to collect and circulate information of a personal nature about such people without their consent if it is of public importance. Instead, the Law makes an exception only for people standing for or in positions of electoral office or first category public officials.

 

This means that the circulation of personal data of other people by a journalist can be considered an infringement of this law and result in civil or criminal liability. According to the law, simply mentioning a person will require written consent. The restriction to freedom of speech is thus entirely disproporitionate, and there could be problems for advertising, publishing, the postal services and others.

 

The author does not mention the clear threat to banking and related areas (see: Bank Association calls on President to veto Law on Personal Data Protection)

The author concludes that the Ukrainian law creates far more problems than it resolves, and many of its provisions actually infringe the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and other documents.

 

He assumes that the law was drawn up in such a severe version so that the excessive points could be gradually removed and because the legislators expected it to be mellowed through non-enforcement.

The Law on Personal Data Protection does not meet European standards and could have an adverse effect on freedom of speech in Ukraine, and can thus not be considered implementation of its international commitments.

 

The author points out that the process by which the Law was passed shows how isolated the authorities are from the public, how ready they are to totally ignore public opinion.

He adds that the law comes into effect from 1 January 2011 leaving everybody a mere 6 months to bring their activities into line with the law. Given the law’s content, it is safe to assume that this is impossible. An analogous law in the Russian Federation was passed in July 2006 and only fully comes into force on 1 January 2011.

 

“One can only hope that the entry into force of the law will be deferred and the relevant norms brought into line with European norms.