The New Reform of Legislation in the Sphere of Personal Data Protection

Lidia Sangarovskaya-Gurlach, senior associate with Legal Alliance Company

Illya Kostin, Partner with Legal Alliance Company

On July 3 of this year Verkhovna Rada of Ukraine adopted the Draft Law of Ukraine No 2836 "On amendments to certain legislative acts of Ukraine concerning improvement of the protection of personal data". On July 23 the respective Law of Ukraine No 383 -VII ("Law") was signed by the President of Ukraine. On July 31 Law was officially published.

In accordance with Final and Transitional Provisions of Law the later enters into force on 1 January 2014.

Law introduces several essential changes to the Law of Ukraine "On Personal Data Protection" and the Code of Ukraine on administrative offences. The most significant amendments include the following:

1. The authorized state body on personal data protection is replaced by the Authorized Human Rights Representative of the Verkhovna Rada of Ukraine

According to the amendments established by Law, the term “authorized state body on personal data protection” was completely excluded from the text of the Law of Ukraine "On Personal Data Protection" (currently it is the State Service of Ukraine on personal data protection).

The authorized state body on personal data protection is replaced by the Authorized Human Rights Represenative of the Verkhovna Rada of Ukraine ("Ombudsman").

According to the Law of Ukraine "On Personal Data Protection" Ombudsman will be entrusted, inter alia, with the following autorities:

• receive complaints and other appeals of individuals and legal entities relating personal data protection and issue decisions upon their consideration;
• on the basis of appeals or at its own discretion conduct on-site and off-site, scheduled and unscheduled inspections of controllers and processors of personal according to the procedure established by Ombudsman with ensured by the law access to the premises where personal data is processed;
• receive upon request and have access to any information (documents) of controllers or processers of personal data, which are necessary in order to guarantee the control of personal data protection, including access to personal data from relevant databases or files, restricted information;
• after conducting inspections, consideration of appeals - issue improvement notices (mandatory for fulfilment) on prevention or elimination of violations of personal data protection law;
• execute protocols imposing administrative liability and submit them to the courts in the cases prescribed by law.

2. The procedure of state registration of personal data databases is replaced by the procedure of notification of Ombudsman on personal data processing

Effective as of today Article 9 of the Law of Ukraine "On Personal Data Protection" on state registration of personal data databases from January 1, 2014 will establish the procedure of notification of Ombudsman personal data processing.

Under the new procedure controllers of personal data must notify Ombudsman on the following:

• processing of personal data, which constitutes special risk to the rights and liberties of subjects of personal data, within 30 days from the date the processing started;
• every change in information is subject to notification within 10 days from the date when the change occur.

Types of processing that will be considered to be of special risk to the rights and liberties of subjects of personal data and categories of these subjects will be determined by Ombudsman. Ombudsman will also approve form and procedure of the notification.

Information disclosed to Ombudsman, will be published on the official website of the Ombudsman according to the procedure set by Ombudsman.

In accordance with the Final and Transitional Provisions of Law Ombudsman shall adopt all regulations necessary for the implementation of the Law of Ukraine "On Personal Data Protection" within 3 months from the date of entry into force of Law (till 01.04.2014)

Controllers of personal data that at the time of entry into force of Law perfom processing of personal data of special risk will be required to notify Ombudsman within 6 months from the date of entry into force of Law (till 01.07.2014)

3. List of "sensitive personal data" is changed

According to Law list of personal data subject to special requirements for processing is canged. In particular, to the list in addition to information about health biometric and genetic data is added.

4. The aforementioned amendments consequently have caused changes of elements of administrative offences in the sphere of personal data protection and respective sanctions.