The observance of the rights of Ukrainians in the field of personal data protection needs sufficient modernisation. This was set by the EU as one of the requirements for Ukraine on its path to European integration. On June 14, 2023, an expert discussion of the Council of Europe's opinion on Draft Law on "Personal Data Protection" No. 8153 as of 25.10.2022, which is being prepared for the first reading in the Parliament, took place. The discussion brought together more than 100 participants - MPs, government representatives, NGOs, international and national experts, and business.

The event was organised by Parliament Committee on Human Rights, De-occupation and Reintegration of the Temporary Occupied Territories, National Minorities and Interethnic Relations jointly with the Council of Europe Project “Supporting Implementation of the European Human Rights Standards in Ukraine”.

In recent years, our societies have become increasingly digitalized. There has been a significant increase in activities related to online data processing, especially in the areas of big data and social media. In addition, Ukrainian businesses are being influenced by their European customers and their expectations to comply with international standards in the field of personal data protection, namely the Convention 108+ and the EU General Data Protection Regulation (GDPR). This altogether creates a need to update Ukrainian legislation.

The key problem of personal data protection in Ukraine, according to the participants of the expert discussion, is the lack of an effective national system of personal data protection and an appropriate mechanism for bringing to liability.

Accordingly, the Draft Law No. 8153 on "Personal Data Protection" is intended to create a framework for the protection of personal data in both public and private sectors, as well as to assist bodies with the right of legislative initiative in developing regulations governing the processing of personal data and their security.

Taras Tarasenko, Member of Parliament of Ukraine, Chairman of the Sub-Committee on Human Rights of the Parliament Committee on Human Rights, De-occupation and Reintegration of the Temporary Occupied Territories, National Minorities and Interethnic Relations, emphasised that the purpose of Draft Law No. 8153 is to form a new policy in the field of personal data protection. He outlined three key objectives of the Draft Law: 1) to update the legislation in order to prevent the use of personal data of Ukrainians in the face of new challenges caused by the armed aggression of the Russian Federation against Ukraine; 2) to prioritise the protection of privacy over corporate interests; 3) to create a culture of responsible attitude of Ukrainians to their personal data.

Yegor Chernev, Member of Parliament of Ukraine, Deputy Chairman of the Parliament Committee on National Security, Defence and Intelligence, emphasised that Ukrainian legislation on personal data protection has not been updated for more than 10 years. In the context of the war and the increasing impact of the Internet on people's lives, adopting the new legislation has become more evident than ever, which will help to protect human rights and fulfil the conditions for Ukraine's European integration.

The opinion on Draft Law No. 8153 prepared by experts of the Council of Europe notes that the document contains an expanded version of the provisions establishing a comprehensive data protection legal framework highlighting the following: "The general approach envisaged by the Draft Law is quite close to the one based on European standards. In this regard, it can be noted that some provisions are in line with the Convention 108+ and the GDPR, as well as other relevant standards, and do not require amendments while other provisions are recommended to be reviewed, clarified or amended to ensure their compliance with European standards and, in particular, Convention 108+ and GDPR."

International experts of the Council of Europe, Dijaną Šinkūnienę Director of State Data Protection Inspectorate of the Republic of Lithuania, and Nana Botchorichvili, a lawyer in the field of personal data protection and privacy, were involved in the preparation of the opinion on the compliance of the Draft Law No. 8153 on "Personal Data Protection" with the Council of Europe standards and the GDPR.

Among the experts' recommendations to the Draft Law No. 8153, the following should be noted:

• the provisions governing the processing of personal data as part of electronic communications should provide a framework that guarantees the confidentiality of communications, including the possibility of interference permitted by law. The conditions applicable to such interference, which are not further defined in the Draft Law, should be more specifically regulated. The same applies to the access of competent authorities to data on the location of individuals, which is only addressed in general terms in the Draft Law;
• within the articles concerning the processing of personal data by providers of electronic communication networks and/or services, the Draft Law includes provisions regulating the conditions for processing traffic data of users of such services. It generally addresses the possibility of access to such data by the competent authorities but does not regulate the conditions under which such storage may take place. The issue of traffic data retention should be regulated by a specific legal framework and appropriate safeguards;
• as part of the process of finalising and adopting the Draft Law, it is strongly recommended to consider it together with the Draft Law regulating the activities of the supervisory authority, as these two legal acts are very closely related and cannot be implemented without each other in accordance with Convention 108+ and the GDPR. The existence and functioning of the supervisory authority is a key component of an effective data protection system.

In their opinion, the experts also recommend that government agencies involved in the legislative process should be obliged to include in the legislation regulating the processing of personal data the purpose of the processing in question and, depending on the circumstances, other relevant information. This obligation may be enshrined in the Draft Law or in other legal acts of Ukraine regulating the legislative process.

Lilit Daneghian, Deputy Head of Co-operation Programmes Division in Department for the Implementation of Human Rights, Justice and Legal Co-operation Standards, said: "Modernisation of the data protection legislation creates wide-range benefits and positive impact both for the individuals and businesses. Allow me also to stress its contextual importance from the standpoint of the war dimension. Informational confidentiality and data protection in times of war becomes an obvious need for Ukraine." Ms Daneghian also noted that the Council of Europe is at the origin and the heart of promoting the responsible use of technology ensuring respect for privacy. "I would like to reiterate the Council of Europe's commitment to further support Ukraine's efforts towards a rules-based market economy where the privacy is highly respected," she added.

Recording of the event:

Reference information:

The Council of Europe project "Supporting Implementation of the European Human Rights Standards in Ukraine" is aimed at assisting the Ukrainian authorities in the effective implementation of the European human rights standards, combating ill-treatment and rehabilitation  of victims of torture, strengthening the operational capacity of the Ombudsperson’s Office, as well as supporting data the modernisation of the data protection legislation in Ukraine.