Amendments to the Personal Data Protection Laws
On 24 July 2013, the President of Ukraine signed the Law of Ukraine "On Amendments to Certain Laws of Ukraine Regarding Improvement of Personal Data Protection System" (the "Law"). The Law will come into effect on 1 January 2014 and will amend some core data protection principles, namely:
1. Abolition of the State Service on Personal Data Protection
According to the Law, the powers of the State Service will be transferred to the Commissioner of Human Rights (the "Ombudsman") being appointed as authorized body for personal data protection.
In particular, the Ombudsman is empowered to do the following:
The State Register of Personal Databases as well as submitted registration applications will be transferred to the Ombudsman within 3 months from the moment when the Law comes into effect.
2. Notification on Personal Data Processing Instead of Personal Databases Registration
The Law specifies that the owners of personal databases should notify the Ombudsman on processing of personal data if such data poses a risk to the individuals' rights and freedoms. Such notification is to be made within 30 business days from the date when the processing was commenced.
Currently, such risks criteria are not identified.
Moreover, the notification should include information on the responsible data protection officer.
The Law specifies that owners of personal databases which process respective personal data at the time when the Law is effective, must notify the Ombudsman on such processing within 6 months.
Currently, the status of registered databases or those submitted for registration is unregulated. It is still unclear whether the notification in relation to processing of such databases will be required.
3. Other Amendments
The definition of "consent of personal data subject" is abolished under the Law. Consequently, this may lead to ambiguity with regards to the form of consent.
The period for notification of individual of his/her personal data processing is extended up to 30 business days in case the data was not directly provided by such individuals.
© Asters 2013