Ukraine adopted the Law on the Protection of Personal Data
I am a member of the profile (for me) club , which is supervised by the famous Direct Marketing Association in Ukraine . Today, Valentin Kalashnik (president of the said association) sent me his opinion on the recently adopted law on the protection of personal data. I quote the whole letter under the cut.
Hello colleagues!
As you know, the day before yesterday, BP adopted the Law on the Protection of Personal Data (enters into force on 01.01.2011).
The link is a text (in * doc format, as amended previously posted on the BP website in the original language) with some comments *
So far, briefly about what awaits us:
1. We will be controlled by a special authorized state official. a body (it is not yet clear whether it’s new or existing, see Article 23) in which we will all have to register existing personal data bases (BPDs). In fact, this is a notice about the owner of the BPS, its managers, the purposes of processing, the place of processing. Registration is a declarative principle, but authorized by the state. the authority may refuse to register (Article 9, Clause 2, Clause 5).
2. Representatives of the authorized body will have the right to enter any room where the air traffic control is processed or located (possibly processed or located, in the opinion of the inspector) (Article 23, Clause 4)
3. From the definition of what is “personal data” it follows that Any enterprise and entrepreneur has a BPD. At some enterprises, the number of BPD (advertising business, call centers, data centers) will be measured in hundreds. Accordingly, the body will have a lot of work. These works will be financed, including, “... at the expense of the subjects of relations related to personal data (Article 26) ...” - i.e. us with you.
4. The law confirms the norms previously existing in the legislation (Constitution, Law “On Information”) on the inadmissibility of using PD without the consent of the owner of the PD. At the same time, the Law provides for the possibility of obtaining the consent of the owner of the PD in other ways than written (Article 2, the definition of the term “consent of the subject of the PD”), which allows the legal existence of BDPs created during telephone marketing or on the Internet.
5. The most unpleasant and difficult to implement norm of the Law is the need to notify the owner of the PD “in writing exclusively” of his rights, the purpose of collecting the PD, the people to whom his PD will be transferred “for ten slaves. days from the date of inclusion of its PD in the PD database ”(Article 12, Clause 2). Such a requirement is not logical, since any processing of PD (including collection of PD) and so on becomes possible only after obtaining the consent of the owner of the PD (Article 11, paragraph 1.).
6. The law provides that professional associations may develop “corporate codes of conduct” (Article 27, clause 2), taking into account the specifics of individual industries (for example, marketing). This norm makes it possible to develop industry standards for working with PD.
7. As often happens in our country, "the severity of the Law is compensated by the possibility of non-compliance." The law does not establish separate liability for violation of the legislation in the field of protection of PD, in addition, it confirms that liability for violation of the legislation on protection of PD (not only of this Law) is established precisely by the Law (Article 28). This excludes the possibility of imposing direct sanctions for violations of the law by the decision of the “special authorized state. body ”or other executive bodies.
A piquant detail of the text of the bill posted on the BP website (posted before the vote) is that it simply does not contain (as the numbering) the penultimate article (Article 30). Is this a typo or is a hidden surprise hidden in this place that will become known after the official publication of the adopted Law.
In general, despite some “distortions”, we believe that the adoption of such a Law will positively affect the development of direct marketing and related industries.
We invite everyone who is interested in this topic to a round table on personal data protection, which will be held on Friday, 04.06, at 17-00 at the business forum “ Direct Marketing Days in Ukraine ”.
The first impression is full of delirium. But due to my modest legal knowledge, I am not fully aware of the consequences that can hurt me as the owner of an online store, respectively, the owner of the BPS. One thing pleases that there is NO RESPONSIBILITY so far, but I am sure that it is temporary, otherwise there would be no reason to pass a law with loopholes.
* Do not be alarmed by the “law of the Russian Federation” mentioned in the comments - the legislation of the Russian Federation is given as a comparison. I
suggest that members of the community who are directly related to the collection and use of the BAP discuss this law
Hello colleagues!
As you know, the day before yesterday, BP adopted the Law on the Protection of Personal Data (enters into force on 01.01.2011).
The link is a text (in * doc format, as amended previously posted on the BP website in the original language) with some comments *
So far, briefly about what awaits us:
1. We will be controlled by a special authorized state official. a body (it is not yet clear whether it’s new or existing, see Article 23) in which we will all have to register existing personal data bases (BPDs). In fact, this is a notice about the owner of the BPS, its managers, the purposes of processing, the place of processing. Registration is a declarative principle, but authorized by the state. the authority may refuse to register (Article 9, Clause 2, Clause 5).
2. Representatives of the authorized body will have the right to enter any room where the air traffic control is processed or located (possibly processed or located, in the opinion of the inspector) (Article 23, Clause 4)
3. From the definition of what is “personal data” it follows that Any enterprise and entrepreneur has a BPD. At some enterprises, the number of BPD (advertising business, call centers, data centers) will be measured in hundreds. Accordingly, the body will have a lot of work. These works will be financed, including, “... at the expense of the subjects of relations related to personal data (Article 26) ...” - i.e. us with you.
4. The law confirms the norms previously existing in the legislation (Constitution, Law “On Information”) on the inadmissibility of using PD without the consent of the owner of the PD. At the same time, the Law provides for the possibility of obtaining the consent of the owner of the PD in other ways than written (Article 2, the definition of the term “consent of the subject of the PD”), which allows the legal existence of BDPs created during telephone marketing or on the Internet.
5. The most unpleasant and difficult to implement norm of the Law is the need to notify the owner of the PD “in writing exclusively” of his rights, the purpose of collecting the PD, the people to whom his PD will be transferred “for ten slaves. days from the date of inclusion of its PD in the PD database ”(Article 12, Clause 2). Such a requirement is not logical, since any processing of PD (including collection of PD) and so on becomes possible only after obtaining the consent of the owner of the PD (Article 11, paragraph 1.).
6. The law provides that professional associations may develop “corporate codes of conduct” (Article 27, clause 2), taking into account the specifics of individual industries (for example, marketing). This norm makes it possible to develop industry standards for working with PD.
7. As often happens in our country, "the severity of the Law is compensated by the possibility of non-compliance." The law does not establish separate liability for violation of the legislation in the field of protection of PD, in addition, it confirms that liability for violation of the legislation on protection of PD (not only of this Law) is established precisely by the Law (Article 28). This excludes the possibility of imposing direct sanctions for violations of the law by the decision of the “special authorized state. body ”or other executive bodies.
A piquant detail of the text of the bill posted on the BP website (posted before the vote) is that it simply does not contain (as the numbering) the penultimate article (Article 30). Is this a typo or is a hidden surprise hidden in this place that will become known after the official publication of the adopted Law.
In general, despite some “distortions”, we believe that the adoption of such a Law will positively affect the development of direct marketing and related industries.
We invite everyone who is interested in this topic to a round table on personal data protection, which will be held on Friday, 04.06, at 17-00 at the business forum “ Direct Marketing Days in Ukraine ”.
Personally, my opinion on this Law
The first impression is full of delirium. But due to my modest legal knowledge, I am not fully aware of the consequences that can hurt me as the owner of an online store, respectively, the owner of the BPS. One thing pleases that there is NO RESPONSIBILITY so far, but I am sure that it is temporary, otherwise there would be no reason to pass a law with loopholes.
* Do not be alarmed by the “law of the Russian Federation” mentioned in the comments - the legislation of the Russian Federation is given as a comparison. I
suggest that members of the community who are directly related to the collection and use of the BAP discuss this law