Personal Data Protection in Ukraine: European Standards or New Risks for Society?

In today’s information society, personal data protection is becoming an increasingly important aspect of ensuring citizens’ privacy and security. As Ukraine seeks membership in the European Union, it must also adapt its legislation in this area to GDPR standards.

The General Data Protection Regulation (GDPR; Regulation (EU) 2016/679) is a regulation under European Union law on the protection of the personal data of all individuals within the EU and the European Economic Area. It also covers the export of personal data outside the EU and the EEA. The GDPR primarily aims to give EU citizens and residents control over their personal data and to simplify the regulatory environment for international business by unifying regulation within the EU.

In Ukraine, meanwhile, the Law “On Personal Data Protection” has been in force since 2012; it also regulates the processing of personal data, but with some differences from the GDPR. The Ukrainian law does not contain requirements as strict as the GDPR’s regarding mandatory prior consent to the processing of personal data. In Ukraine, there are differences in terminology and in the bodies responsible for monitoring and supervising compliance with personal data processing rules. At the same time, given that Ukraine is not under the jurisdiction of the European Union, the GDPR may apply to Ukrainian companies insofar as they process the data of EU citizens.

At the same time, as some believe, Ukraine has committed to adapting EU legislation in the field of personal data protection. In fact, as stated in Article 15 of the Agreement, the Parties agreed to cooperate in order to ensure an adequate level of personal data protection in line with the highest European and international standards.

You will agree that a commitment to adapt and an agreement to cooperate are different things. As of today, improvements to national legislation are advancing at the level of individual legislative initiatives.

As for the drafting and promotion of the new draft law “On Personal Data Protection”, it has been met with significant criticism from experts, the business community and the public for the past two years.

According to the conclusion of the National Agency on Corruption Prevention (hereinafter, NACP) and the anti-corruption review it conducted of the draft Law of Ukraine “On Personal Data Protection” No. 5628 of 07.06.2021, developed to implement Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, corruption risk factors were identified in the draft law.

The main corruption-inducing factor of the draft Law is the excessive number of evaluative legal constructs and legal uncertainties that may lead to biased assessment by officials of the supervisory authority (the National Commission for Personal Data Protection and Access to Public Information) of whether controllers and processors of personal data comply with the requirements of the draft law.

The draft Law also contains a number of provisions that may in practice restrict the freedom of journalistic activity, which is an important prerequisite for building civil society and a component of the national anti-corruption infrastructure.

In turn,

• Introducing legal regulation that would make it possible to avoid criminal, administrative, disciplinary and civil liability.
• The draft Law proposes creating a new central executive body with a special status that shapes and implements state policy in the field of personal data protection and access to public information, and exercises state control over compliance with legislation on personal data protection and/or access to public information.
• Contradictions between different provisions of the same legal act or between provisions of different legal acts of equal legal force on the same issue, allowing for different interpretations of the rules.
• Establishing or expanding the discretionary powers of a state authority or local self-government body, or of a person authorized to perform the functions of the state or local self-government, without defining an exhaustive list of cases, grounds, forms, deadlines and procedures for exercising such powers, control over their exercise and liability for possible abuse in the course of their exercise,
• Narrowing the content or scope of the existing powers of specially authorized anti-corruption bodies,

calls into question any progress of Ukrainian society towards integrity, accountability and transparency.

Why is it important to pay attention to the risks that may arise from the adoption of the “updated” law “On Personal Data” (the first-reading vote on which is expected as early as summer 2024)?

1. Lack of transparency and controversial aspects of the draft law

• The draft law was developed in a non-transparent format, without proper involvement of business and civil society representatives.
• Expert opinions and the anti-corruption review point to the draft’s inconsistency with the Constitution of Ukraine and the presence of corruption-inducing factors.
• The draft law grants excessive supervisory and sanctioning powers to the new personal data protection body, which may lead to pressure on businesses and other entities.

2. Increased costs for business

Hasty implementation of GDPR standards without adequate time for adaptation will lead to significant costs for businesses to introduce new security systems and software and to pay specialists, which will negatively affect the competitiveness of Ukrainian enterprises, especially small and medium-sized businesses.

3. Restricting the rights of open data users

The draft law narrows the scope of the rights of open data users, limiting the free use and dissemination of information containing personal data. This, in turn, affects business transparency, the development of civil society, the fight against corruption and other important areas.

4. Shortcomings and irrelevance of the draft law

The draft law lacks clear definitions and rules, which may lead to uncertainty and arbitrariness on the part of supervisory authorities. Ukraine lacks the resources and specialists to ensure the effective implementation of new personal data protection rules. The draft law does not take into account pressing social issues such as corruption, business security and the detection of Russian agents.

5. Threat to freedom of speech

There is a risk that the new personal data protection rules could be used for censorship and to restrict freedom of speech. This could lead to self-censorship among journalists and civic activists.

[note] The draft law “On Personal Data Protection” requires substantial revision taking into account the views and comments of experts, the business community and the public, so that it meets the needs of Ukrainian society and international standards as fully as possible.

It is necessary to ensure a clear and transparent process for implementing the new legislation and to create effective mechanisms for monitoring compliance with legal requirements.

Alignment with European standards should not come at the cost of restricting citizens’ rights and freedoms, increasing costs for business and creating new bureaucratic structures.

Finally, it should be noted that when developing such a significant draft law, the risks associated with restricting freedom of speech and holding back economic activity should be carefully assessed. In many provisions, the previous draft law No. 5628 of 07.05.2021 essentially copies the EU GDPR, and many provisions of the Ukrainian draft are even stricter than the European ones, even though the European regulation is considered the most demanding in terms of data handling. Moreover, the draft law itself is quite voluminous and complex. While studying and implementing its provisions thoroughly makes sense for large companies or government bodies, for small businesses it could become an unbearable burden that would worsen market competition and the country’s economic situation in general.

Background

On 25.10.2022, a new draft Law of Ukraine “On Personal Data Protection” No. 8153 was registered, which takes into account some of the comments of experts and the public.

As of 28.05.2024, draft Law No. 8153 is under consideration by the Verkhovna Rada Committee on Digital Transformation.

Sources

The following materials were used in writing this article:

• Wikipedia. General Data Protection Regulation
• Personal data protection at the cost of billions of hryvnias. Risks and threats of the new rules
• Conclusion of the anti-corruption review of the draft Law of Ukraine “On Personal Data Protection”
• Conclusion of the anti-corruption review of the draft Law of Ukraine “On the National Commission for Personal Data Protection and Access to Public Information”
• Analysis of the draft Law of Ukraine “On Personal Data Protection” No. 5628, prepared with the support of the European Union and the International Renaissance Foundation within the joint initiative “EU4USociety”.