On heightened criminal liability for violation of unclear and flawed data protection legislation
The Media Law Institute expresses grave concern over a new and highly dangerous law which could jeopardize freedom of speech and of the media in Ukraine and calls on the President to use his power of veto.
“On 2 June 2011 the Verkhovna Rada passed a Law with Amendments to Some Legislative Acts regarding Infringements of Legislation on Personal Data Protection. This Law significantly increases criminal liability for the circulation of confidential information about a person of up to 5 years imprisonment. This article could be used in the first instance to prosecute journalists. The Law also imposes serious administrative fines of up to 17 thousand UAH for failure to receive State registration for personal databases, to follow the established rules of procedure for personal data protection in a personal database and for not carrying out the demands of officials from the State Service on Personal Data Protection with regard to eliminating violations of personal data protection legislation.
Particularly disturbing is the increase in criminal liability and imposition of imprisonment under Article 182 of the Criminal Code since this article can be very easily used against any journalist. In our view there is no public need for increasing criminal liability for the circulation of confidential information about an individual, while the introduction of this law can seriously obstruct application of the Law on Access to Public Information.
Since the beginning of the year when the Law on Personal Data Protection came into force, there has been discussion about the low quality of this law, and especially the vagueness of provisions on registration of databases and of the very term “database”. Instead of providing the appropriate explanations, the State is passing a law on liability for failure to follow rules which nobody knows how to follow. No system has been introduced for registering databases and yet liability for infringing registration requirements has already been set down in law.
The Law passed by the Verkhovna Rada can easily be used to put pressure on any organization, for example, by stating that a system for registering staff has not been registered as a database. Or a fine could be imposed for there being an address book in a work mobile telephone which can be considered a database. When instead of explanations and clarification of a flawed law, the State sets to establishing strict liability, this in our opinion demonstrates the undemocratic nature of the regime.
By passing first the Law on Personal Data Protection and now this Law on imposing liability, the Verkhovna Rada has in no way created an effective mechanism for personal data protection (in the majority of countries the functions of State supervision and control are entrusted to an independent institution). Instead it is introducing liability in a sphere where to this day there is no clear understanding of the subject of social relations nor established practice of regulation. Such actions by the highest legislative body pose a number of dangers, in the first instance, of corrupt activities, for all with relations falling within the sphere of personal data protection.
The Media Law Institute calls on the President to use his power of veto against the Law with Amendments to Some Legislative Acts regarding Infringements of Legislation on Personal Data Protection and to draw the Verkhovna Rada’s attention to the need to improve basic legislation on personal data protection.