Ukraine has adopted a law on the protection of personal data
I am a member of the profile (for me) club , which is supervised by the well-known Association of Direct Marketing in Ukraine . Today, Valentin Kalashnik (president of the said association) sent me his opinion on the recently adopted law on the protection of personal data. I bring the whole letter under the cut.
Hello colleagues!
As you know, the day before yesterday, BP adopted the Personal Data Protection Act (effective from 01/01/2011).
According to the link text (in * doc format, as edited earlier on the BP website in the original language) with some comments *
')
While briefly about what awaits us:
1. You and I will be controlled by a special authorized state. a body (not yet clearly new or existing, see art. 23) in which we will all have to register existing personal data bases (BAPs). In essence, this is a notice about the owner of the BAP, its managers, processing purposes, place of processing. Registration is declarative principle, but authorized state. the authority may refuse to register (art.9, p.2, p.5).
2. Representatives of the authorized body will have the right to enter any room where the BAP is processed or located (possibly, it is processed or is located, according to the auditor) (Article 23, item 4)
3. From the definition of what “personal data” is, it follows that any enterprise and entrepreneur have a BAP. In some enterprises the number of BPDs (advertising business, call centers, data centers) will be measured in the hundreds. Accordingly, the body will have a lot of work. These works will be financed, among other things, “... at the expense of the subjects of relations connected with personal data (art. 26) ...” - i.e. you and me
4. The law confirms the norms that previously existed in the legislation (the Constitution, the Law “On Information”), on the inadmissibility of using PD without the consent of the owner of the PD. At the same time, the Law provides for the possibility of obtaining the consent of the owner of PD in other ways than written (Article 2, the definition of the term “consent of the subject of PD”), which allows for the legal existence of the BAP created during telephone marketing or on the Internet.
5. The most unpleasant and difficult to implement norm of the Law is the need to notify "only in writing" the owner of the PD about his rights, the purposes of collecting the PD, the persons to whom his PD will be transferred "for ten slaves. days from the date of its inclusion in the database of PD "(art.12, p.2). Such a requirement is not logical, since any processing of PD (including the collection of PD) and so becomes possible only after obtaining the consent of the owner of the PD (Article 11, Clause.).
6. The law provides that professional associations can develop “corporate codes of conduct” (Article 27, paragraph 2), taking into account the specifics of individual industries (for example, marketing). Such a rule makes it possible to develop industry standards for working with PD.
7. As often happens in our country, “the severity of the Law is compensated by the possibility of its non-compliance”. The law does not establish separate responsibility for violation of legislation in the field of protection of PD, besides confirms that responsibility for violation of legislation on the protection of PD (not only of this Law) is established by the Law (Article 28). This eliminates the possibility of imposing direct sanctions for violations of the Law by the decision of the “special authorized state body "or other executive authorities.
A piquant detail of the text of the bill posted on the BP website (posted before the vote) is that it simply does not have (according to numbering) the penultimate article (Article 30). Is this a typo or hidden in this place some surprise will be known after the official publication of the adopted Law.
In general, in spite of some “imbalances”, we believe that the adoption of such a Law will positively affect the development of direct marketing and related industries.
We invite everyone who is interested in this topic at the round table on the protection of personal data, which will be held on Friday, 04.06, at 17-00 at the business forum " Direct Marketing Days in Ukraine ".
The first impression is full of delirium. But due to my modest legal knowledge, I’m not fully aware of the consequences that might hurt me as the owner of an online store, respectively, the owner of the BAP. One thing is gratifying that there is NO WHAT for responsibility, but I am sure that this is temporary, otherwise there would be no need to adopt a law with loopholes.
* do not be intimidated by the “law of the Russian Federation” mentioned in the comments - the legislation of the Russian Federation is given as a comparison
I propose to community members who are directly connected with the collection and use of the BAP to discuss this law
Hello colleagues!
As you know, the day before yesterday, BP adopted the Personal Data Protection Act (effective from 01/01/2011).
According to the link text (in * doc format, as edited earlier on the BP website in the original language) with some comments *
')
While briefly about what awaits us:
1. You and I will be controlled by a special authorized state. a body (not yet clearly new or existing, see art. 23) in which we will all have to register existing personal data bases (BAPs). In essence, this is a notice about the owner of the BAP, its managers, processing purposes, place of processing. Registration is declarative principle, but authorized state. the authority may refuse to register (art.9, p.2, p.5).
2. Representatives of the authorized body will have the right to enter any room where the BAP is processed or located (possibly, it is processed or is located, according to the auditor) (Article 23, item 4)
3. From the definition of what “personal data” is, it follows that any enterprise and entrepreneur have a BAP. In some enterprises the number of BPDs (advertising business, call centers, data centers) will be measured in the hundreds. Accordingly, the body will have a lot of work. These works will be financed, among other things, “... at the expense of the subjects of relations connected with personal data (art. 26) ...” - i.e. you and me
4. The law confirms the norms that previously existed in the legislation (the Constitution, the Law “On Information”), on the inadmissibility of using PD without the consent of the owner of the PD. At the same time, the Law provides for the possibility of obtaining the consent of the owner of PD in other ways than written (Article 2, the definition of the term “consent of the subject of PD”), which allows for the legal existence of the BAP created during telephone marketing or on the Internet.
5. The most unpleasant and difficult to implement norm of the Law is the need to notify "only in writing" the owner of the PD about his rights, the purposes of collecting the PD, the persons to whom his PD will be transferred "for ten slaves. days from the date of its inclusion in the database of PD "(art.12, p.2). Such a requirement is not logical, since any processing of PD (including the collection of PD) and so becomes possible only after obtaining the consent of the owner of the PD (Article 11, Clause.).
6. The law provides that professional associations can develop “corporate codes of conduct” (Article 27, paragraph 2), taking into account the specifics of individual industries (for example, marketing). Such a rule makes it possible to develop industry standards for working with PD.
7. As often happens in our country, “the severity of the Law is compensated by the possibility of its non-compliance”. The law does not establish separate responsibility for violation of legislation in the field of protection of PD, besides confirms that responsibility for violation of legislation on the protection of PD (not only of this Law) is established by the Law (Article 28). This eliminates the possibility of imposing direct sanctions for violations of the Law by the decision of the “special authorized state body "or other executive authorities.
A piquant detail of the text of the bill posted on the BP website (posted before the vote) is that it simply does not have (according to numbering) the penultimate article (Article 30). Is this a typo or hidden in this place some surprise will be known after the official publication of the adopted Law.
In general, in spite of some “imbalances”, we believe that the adoption of such a Law will positively affect the development of direct marketing and related industries.
We invite everyone who is interested in this topic at the round table on the protection of personal data, which will be held on Friday, 04.06, at 17-00 at the business forum " Direct Marketing Days in Ukraine ".
Personally, my opinion on this Law
The first impression is full of delirium. But due to my modest legal knowledge, I’m not fully aware of the consequences that might hurt me as the owner of an online store, respectively, the owner of the BAP. One thing is gratifying that there is NO WHAT for responsibility, but I am sure that this is temporary, otherwise there would be no need to adopt a law with loopholes.
* do not be intimidated by the “law of the Russian Federation” mentioned in the comments - the legislation of the Russian Federation is given as a comparison
I propose to community members who are directly connected with the collection and use of the BAP to discuss this law
Source: https://habr.com/ru/post/95366/
All Articles