Widely condemned Personal Data Protection Bill gains fangs
The words read database (picture http://gurt.org.ua/)
From 1 July 2012 stiff penalties can be imposed for violation of a law condemned by media and human rights organizations, not least because of the enormous scope it provides for abuse.
The law makes additions to the Code of Administrative Offences and updates Article 182 of the Criminal Code.
Penalties may now be imposed for the following infringements of personal date protection legislation:
1) not informing a person or informing them late about their rights in connection with their personal data being included in a personal database, the purpose of collecting this data and the people who this data is passed to;
2) failure to inform or inform in timely fashion the State Service for Protection of Personal Data of a change in the information provided for state registration of a personal database;
3) avoiding state registration of a personal database;
4) failure to observe the legally established rules of procedure for protecting personal data in a personal database with this leading to unlawful access to it.
The penalties for such actions range from 1.7 thousand to 17 thousand UAH depending on the type of “offence” and whether it has happened before. Penalties for officials from the above-mentioned State Service range from 1.7 thousand to 3.4 thousand UAH.
The law also makes amendments to Article 182 of the Criminal Code by extending the sphere of force of the article to any circulation of confidential information. This was previously circulation of the information in a public address, work publicly demonstrated, or in the media. Liability is added for destroying or unlawfully changing confidential information. Liability is also increased 10 times with a fine from 8.5 thousand to 17 thousand UAH. The article has also been supplemented with liability for causing considerable damage from 1.7 thousand or more UAH.
The Media Law Institute points out that the lack of stipulation in Article 182 of the Criminal Code that there is no liability for circulated information of public importance will be a serious deterrent since officials of state bodies of power will not be able to carry out the function of exposer of human rights violations, misleading the public etc.”
Liability had been deferred for six months.
The Personal Data Protection Act was adopted despite strongly voiced concern from media, human rights and business organizations over serious flaws and lack of any real clarity as to what constituted a database, etc.
In June 2011 the Media Law Institute issued a statement expressing grave concern over a new and highly dangerous law. “On 2 June 2011 the Verkhovna Rada passed a Law with Amendments to Some Legislative Acts regarding Infringements of Legislation on Personal Data Protection. This Law significantly increases criminal liability for the circulation of confidential information about a person of up to 5 years imprisonment. This article could be used in the first instance to prosecute journalists”
The Media Law Institute stresses that there is serious concern over the law quality of the actual Law on Personal Data Protection. It notes in particular the vagueness of provisions on registration of databases and of the very term “database”. Rather than providing clear guidelines, the government is imposing penalties for failure to adhere to a law with dangerously unclear provisions.
“The Law passed by the Verkhovna Rada can easily be used to put pressure on any organization, for example, by stating that a system for registering staff has not been registered as a database. Or a fine could be imposed for there being an address book in a work mobile telephone which can be considered a database. When instead of explanations and clarification of a flawed law, the State sets to establishing strict liability, this in our opinion demonstrates the undemocratic nature of the regime”.
It is perhaps also worth noting that the Verkhovna Rada Office was reported yesterday to have refused to provide a journalist with copies of income declarations for National Deputies and their families. The excuse given explains what kind of “personal data”, or more precisely, whose, the authorities are hoping to protect. “Although Article 6 of the Law on Access to Public Information stipulates that income declarations of National Deputies and members of their families do not constitute information on restricted access, these documents do contain personal data of members of their family and other information which the law has stated is information on restricted access”.