July 2013

Amendments to the Personal Data Protection Laws

On 24 July 2013, the President of Ukraine signed the Law of Ukraine "On Amendments to Certain Laws of Ukraine Regarding Improvement of Personal Data Protection System" (the "Law"). The Law will come into effect on 1 January 2014 and will amend some core data protection principles, namely:

1. Abolition of the State Service on Personal Data Protection

According to the Law, the powers of the State Service will be transferred to the Commissioner of Human Rights (the "Ombudsman") being appointed as authorized body for personal data protection.

In particular, the Ombudsman is empowered to do the following:

  • Carry out ordinary and extraordinary, on-site and permanent inspections of personal database owners/processors;
  • Obtain access to any information (documents) of database owners/processors with aim to control personal data protection;
  • Issue mandatory regulations, execute protocols on administrative liability and submit them to the court;
  • Issue recommendations and proposals with regard to personal data protection;
  • Approve Corporate Codes of Conduct and Standard Procedures for Personal Data Processing;
  • Handle complaints of individuals whose data is processed.

The State Register of Personal Databases as well as submitted registration applications will be transferred to the Ombudsman within 3 months from the moment when the Law comes into effect.

2. Notification on Personal Data Processing Instead of Personal Databases Registration

The Law specifies that the owners of personal databases should notify the Ombudsman on processing of personal data if such data poses a risk to the individuals' rights and freedoms. Such notification is to be made within 30 business days from the date when the processing was commenced.

Currently, such risks criteria are not identified.

Moreover, the notification should include information on the responsible data protection officer.

The Law specifies that owners of personal databases which process respective personal data at the time when the Law is effective, must notify the Ombudsman on such processing within 6 months.

Currently, the status of registered databases or those submitted for registration is unregulated. It is still unclear whether the notification in relation to processing of such databases will be required.

3. Other Amendments

The definition of "consent of personal data subject" is abolished under the Law. Consequently, this may lead to ambiguity with regards to the form of consent.

The period for notification of individual of his/her personal data processing is extended up to 30 business days in case the data was not directly provided by such individuals.

For further information please contact partner Oleksandr Padalka
and associate Yulia Yanyuk

© Asters 2013
Web-site  |  Contacts