One more step towards secrecy and restriction of freedom of speech

As of 1 January 2010, the Law on Personal Data Protection, adopted by the Verkhovna Rada on 1 June 2010, has come into force and human rights groups continue to warn of its grave consequences for freedom of speech and of access to information.

President Yanukovych ignored calls from media, human rights and business organizations and signed the bill into law.  Nor have later calls from the Ukrainian Helsinki Human Rights Union for amendments to be made been heeded. 

The law gives a definition of personal information which is dangerously broad and cannot be considered to fulfil Ukraine’s international obligations to the Council of Europe and EU.   Despite European standards which divide personal data into data of a general nature (name, address, etc) and sensitive personal data (health, financial records, etc), the Law deems as personal data any data about a person enabling them to be identified. That is, even their name with the number of a mobile telephone.

This means that the gathering, processing or circulating of any such data is possible only with the consent of the person or in cases envisaged by law.  An exception is made only for first category public officials: National Deputies, the heads of State committees who aren’t members of the Cabinet of Ministers; the heads of other central bodies of power under the Cabinet of Ministers; the Permanent Representative of the President in the Crimea; the President’s Representatives in the regions, Kyiv and Sevastopol; the first deputy ministers; first deputy heads of State committees which are part of the Cabinet of Ministers; the Heads of the President’s Administration; the Secretariat of the Verkhovna Rada and other equivalent positions.

The Law claims to not cover the activities of journalists in creating and processing personal databases, yet it fully covers the rules for circulating personal data about a person who is not in any database, or is in, for example, State databases.

As warned back in June 2010, this means that in practice the media will be prohibited from circulating any personal data (as per the very wide definition of this) without the person’s consent if they are not in the categories above-listed.  Since the circulation of such information can be deemed unlawful, the most innocuous coverage could carry criminal liability under Article 182 of the Criminal Code.

What is also incredible is that the President also ignored a call from the Association of Ukrainian Banks to use his power of veto over the law which they stressed did not comply with international standards and would have extremely negative consequences for the country’s economy.

The consequences of this ill-conceived law are indeed wide-reaching and extremely seriously. As Dmytro Chopovsky from the Institute for Mass Information wrote back in July, even school textbooks could “need to be written more or less as “A held talks with B”, “the flag over the Reichstag was raised by A, B and C”, since the law states that “the use of personal data for historical, statistical or academic purposes can only be in depersonalized form”. 

Very disturbingly, the Law does not contain the concept of “public figure” which is an “axiom” of European democratic standards with more scope being given for permissible intrusion in a person’s private life. This means that it is possible to collect and circulate information of a personal nature about such people without their consent if it is of public importance. Instead, the Law makes an exception only for people standing for or in positions of electoral office or first category public officials.

Dmytro Chopovsky stresses that this means that publication of any personal data, as per the definition above, by a journalist can be considered an infringement of this law and result in civil or criminal liability. “The restriction to freedom of speech is thus entirely disproporitionate, and there could be problems for advertising, publishing, the postal services and others”.

The new law also requires the creation of a State Register of Personal Databases by all enterprises and organizations regardless of their form of ownership. They effectively all have to establish and register personal databases. There are over one million such entities and the demand for all to do this is considered impossible by many experts. They also assure that registration will be on a fee bases. The law also envisages the creation of an authorized state body on protection of personal data which will have the right of free access to any premises where personal data is stored or processed. There are fears that such a State body could be used as a means of pressure on businesses.

New information from the BBC  See also the UHHRU appeal to the President, the Bank Association’s appeal