Ukrainian Railways caught illicitly gathering personal data
The State Administration on Personal Data Protection has ordered Ukrainian Railways [Ukrzaliznytsa] to stop collecting personal data about its passengers. It transpired that the information about all customers was being input into an illegal database. Human rights groups warn that this information can be passed to third parties.
Each day thousands of Ukrainians used the railways without having any idea that all the information about their movements was being input into Ukrzaliznytsa’s database. In breach of the Constitution the passengers were not informed about this database, and there was no attempt to get their consent.
The risk is also great that the information will be passed to a third party, those who have an interest in knowing where you go when you’re not at home or work.
Maxim Shcherbatyuk from the Ukrainian Helsinki Human Rights Union stresses that the risk of abuse is enormous. Such information gathering, for example, could be used for politically motivated monitoring of, for example, the movements of opposition figures, journalists or civic activists.
Tetyana Pechonchyk from the Human Rights Information Centre pointed out that there had already been cases when activists planning to take part in protests had been removed from trains. On 17 May 2013 30 members of VO Svoboda were taken off the train to Kyiv where they were intending to take part in the large-scale rally “Rise Ukraine”. The police knew their travel plans and addressed each of the activists by name.
The State Administration on Personal Data Protection has ordered Ukrzaliznytsa to stop gathering the information by 29 November this year.
Roman Holovenko from the Institute for Mass Information and member of the State Administration on Personal Data Protection’s enquiry commission on Ukrzaliznytsa stresses that Ukrzaliznytsa and subordinate structures may be obliged to add names to tickets, but do not have the right to keep this information.
UHHRU is currently preparing a collective legal suit against Ukrzaliznytsa aimed at removing personal data from the database and holding the company to account. The documentation will be published on the UHHRU siteand can be used by all those wishing to initiate civil proceedings.
From the UHHRU report here