Ukraine

[UA] Law on Data Protection Enters into Force

IRIS 2011-3:1/31

Taras Shevchenko

Media Law Institute, Kiev

On 1 January 2011 the new Law of Ukraine On Protection of Personal Data that was adopted in June 2010 was enacted. Adoption of the Law was a necessary step after ratification of the European Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. The Law regulates the way personal data are protected during automatic processing and also if it is stored in data banks.

The President of Ukraine in January 2011 created a special office named Data Protection Inspection that would observe compliance with the Law and appointed its Head. Everyone who has a database with personal data has to register it with the Data Protection Inspection. The regulation of how this should be done is still to be defined by the Cabinet of Ministers within the first six months of 2011. Exceptions for such registration are provided for individuals if they create databases for personal use and also for individual journalists. Representatives of Data Protection Inspection will have quite extensive powers under the Law, including the right to enter at any time the premises where data is processed.

The Law provides that consent should be given to include personal data in any database. If the data is taken from an open source there might be only a post factum notification. At the same time the Law does not regulate what a database owner should do with it if the database was created before this Law came into force. Another problem is a prohibition to make any data public without the consent of the person affected, even if the data was taken from an open source. This may have a negative effect if the government tries to stop dissemination of information about a person, especially about officials, even if it was not stored in the form of a database. This Law may also diminish the positive effect of the Law On Access to Public Information as in some cases the government may reject information on the grounds that it is contained in a database.