Information Rights

8,027 petitions to the Commissioner

(including the right to petition — 33%, regarding violation of the right to access public information — 17%, the right to written response — 15%, the right to proper review of the petition — 14%, the right to submit a petition — 7%, the right to timely review of the petition — 6%, issues related to illegal personal data processing — 3%, the right to personal reception — 2%, the right to access information on yourself — 2%, organisation of personal data processing — 1% and recommendations and explanations on practical application of the legislation on personal data protection — 1%)

211 legal and normative acts processed and proposals submitted

605 proceedings instituted by the Commissioner

418 proceedings completed

38 administrative offence reports

(including 35 reports under Article 212-3 of the CUAO “Violation of the right to information and the right to petition” and 3 reports under Article 188-39 “Violation of the legislation in the field of personal data protection”)

353 monitoring visits made

75 orders to eliminate the violations detected during the reviews, in particular, to restore rights of personal data subjects

26 recommendations and explanations given to the power entities as regards practical exercise of the citizens’ right to petitions and application of the legislation on access to public information

5 Commissioner’s motions sent to the public authorities for corresponding measures to be taken

Right to access information and right to petition

Key events, challenges and tendencies

The martial law has been in effect in Ukraine since 05:30 on 24.02.2022, in connection with the military aggression of the Russian Federation against Ukraine; it was imposed by Decree of the President of Ukraine No. 64/2022 of 24.02.2022 “On the Imposition of Martial Law in Ukraine” approved by Law of Ukraine No. 2102-IX of 24.02.2022.

Certain rights and freedoms may be limited for a specific period of time during the martial law or state of emergency. However, the person’s constitutional right to petition and response under Article 40 of the Constitution of Ukraine may not be limited during the martial law.

The Commissioner received the report according to which the State Agency of Automobile Roads of Ukraine temporarily ceased to respond to the citizens’ petitions not associated with the martial law, military operations, medical assistance, evacuation of the population etc. starting from 25.02.2022, in connection with the issue of Decree of the President of Ukraine No. 64/2022 of 24.02.2022 “On the Imposition of Martial Law in Ukraine”. However, the constitutional right to apply to power entities guaranteed by Article 40 of the Fundamental Law of Ukraine is one of 18 human and civil rights and freedoms that cannot be limited even during the martial law or state of emergency in accordance with Article 64 of the Constitution of Ukraine. Therefore, the citizens’ constitutional right to submit individual or collective written petitions and receive response thereto cannot be limited even during the martial law.

In order to eliminate the violations of the human and civil rights and freedoms and prevent them in the future, being guided by Article 101 of the Constitution of Ukraine, Articles 13, 15, 16, 22 of the Law of Ukraine “On the Ukrainian Parliament Commissioner for Human Rights”, Article 10 of the Law of Ukraine “On Legal Regime of Martial Law”, Article 28 of the Law of Ukraine “On Petitions of Citizens”, the Commissioner sent the motion to the State Agency of Automobile Roads of Ukraine and asked to remedy the constitutional violations of the human and civil rights and freedoms and to consider them in future work.

According to the State Agency of Automobile Roads of Ukraine, the violations were remedied, the heads of the standalone structural subdivisions and independent senior specialists of the State Agency of Automobile Roads of Ukraine were informed thereof, and responses to the citizens’ petitions were resumed.

Also, according to Article 34(3), 64(2) of the Constitution of Ukraine, the right to access information during the martial law may be limited by the law, in particular, for the purposes of national security, territorial integrity or public order, in order to prevent riots or crimes.

Moreover, it is prescribed by Article 8 of the Law of Ukraine “On Legal Regime of Martial Law” that public authorities and local self-government bodies take the actions necessary to repel the threat, deter the armed aggression and ensure national security in the first place. These actions may make it difficult for citizens to exercise their right to information. For instance, such actions can include enhanced security and special operations of the public authority, local self-government body etc. to which a petition or request has been sent; introduction of the curfew in the specific territory; special conditions for entering/leaving, limitation of freedom of movement etc.

The ability to process the citizens’ petitions and requests during the martial law also depends on the technical capacity for processing correspondence, proximity of the institution to the area of hostilities, actual threat for life or health of staff of the institution etc.

With account of the special legal regime in Ukraine, the citizens’ need to exercise their right to apply to power entities, associations of citizens, enterprises, institutions and organisations of any ownership form and right to information has increased. The summary of the monitoring of observance of the constitutional human and civil rights and freedoms, in particular, the rights to send a petition and receive a response from power entities, the rights to information, posting of public information on official websites of administrators in the context of the limitations associated with the legal regime of martial law has shown the low level of observance of the rights.

In July 2022, the Commissioner was approached by the citizen who complained against violation of the Law of Ukraine “On Access to Public Information” by the Dubno City Council (hereinafter the “Council”). The petitioner stated that she had filed an inquiry to the Council asking to disclose information on the salary accrued and paid to Dubno City Head and his deputies from January to June 2022. However, the petitioner was informed that access to the requested information was limited during the legal regime of martial law.

In order to restore the petitioner’s right to information, corresponding letters were sent by the Commissioner’s Secretariat to the Council in order to explain the clauses of the Law of Ukraine “On Access to Public Information”. However, the Council repeatedly dismissed the inquiry on the same grounds.

Given the above, the designated official of the Commissioner’s Secretariat drew up the administrative offence report on the Dubno City Head as prescribed by Article 2123(2) of the CUAO.

According to the decision of the Dubno City and District Court of Rivne Oblast, the Dubno City Head was found guilty of the administrative offence under Article 212-3(2) of the CUAO, and the fine was imposed.

Prompt information to public information (via official websites, social media) that is of major social interest and is connected with the exercise without limitation of human rights to life, health, liberty and security (including information on accidents, disasters and other emergency events that have occurred or might occur and threaten citizens’ security) is of paramount importance during the martial law.

Thus, during 2022, the Commissioner received the citizens’ reports that the power entities had temporarily ceased without limitation to respond to the citizens’ inquiries not associated not associated with the martial law, military operations, medical assistance, evacuation of the population etc.

In that regard, the power entities were sent the Commissioner’s motions to take the actions in order to remedy the constitutional violations of human and civil rights and freedoms and ensure adequate exercise of the citizens’ rights to information, petition and response during the martial law.

In addition to the martial law challenges, there is a number of other issues, some of which have often been described in the Commissioner’s reports. In particular, exercise of the constitutional right to petition by the persons who have been recognised by court to be legally incapable is not regulated by the legislation. Based on the constitutional submission of the Commissioner, the particular provisions of Article 8(2), the second sentence of Article 16(4) of the Law of Ukraine “On Petitions of Citizens” (the case on petitions of persons recognised as legally incapable by court) were found to be non-constitutional and ceased to be in force from the date of the corresponding decision of the Constitutional Court of Ukraine No. 8-р/2018 of 11 October 2018. The Verkhovna Rada of Ukraine registered the draft Law of Ukraine “On Amending the Law of Ukraine ‘On Petitions of Citizens’ regarding the Exercise of the Constitutional Right to Petition by Persons Recognised as Legally Incapable by Court” (registration No. 1186 of 29.08.2019), which still is being considered.

Despite the ratification of the Council of Europe Convention on Access to Official Documents in 2020 and the Commissioner’s recommendations, its clauses still have not been implemented in the Ukrainian legislation. It is extremely relevant to develop the draft law on amendments to the Law of Ukraine “On Access to Public Information” with account of the circumstances resulting from the legal regime of martial law.

In general, analysis of the citizens’ petitions received by the Commissioner and results of the reviews show that there are persistent violations of constitutional human and civil rights to information and petition by the public authorities, local self-government bodies, associations of citizens, enterprises, institutions and organisations in 2022, namely:

  • ceasing to consider requests for information, petitions of citizens during the legal regime of martial law;
  • administrators of information failing to publish socially important information related to exercise of human rights to life, health, liberty and security, in the first place, on the official websites;
  • closing public registers;
  • administrators of information unreasonably adjourning response to requests for information;
  • classifying information as the one with limited access without any grounds;
  • individual applicants abusing their right to access public information;
  • accepting citizens’ petitions only in electronic form;
  • responding to citizens’ petitions with a delay;
  • violating the requirements of Article 18 o the Law of Ukraine “On Petitions of Citizens” (to attend consideration of a petition or complaint, to examine materials of the review);
  • being unable to exercise the right to submit an oral petition, by telephone, hot line;
  • failing to respect the right of petition of the persons with the special social status.

Response to violations of human and civil rights

Right to petition

In 2022, 6,204 citizens filed reports with the Commissioner on violations of Law of Ukraine No. 393/96–ВР of 2 October 1996 “On Petitions of Citizens”. In 2021, 19,642 citizens filed reports, i.e. the number of petitioners decreased significantly.

The reports were related to the following groups of rights:

  • right to timely review of petitions;

In September, the Commissioner received three reports from citizen B. regarding no response to her request about house maintenance tariffs from the staff of the National Complex “Expocentre Ukraine”.

The Commissioner took actions to ensure consideration of the requests of petitioner B. within the proceedings by the National Complex “Expocentre Ukraine”. The petitioner’s right was restored.

  • right to personal reception;

In November, the Commissioner received the petition from citizen H. regarding violation of the requirements of the Law of Ukraine “On Petitions of Citizens” under Article 18 in terms of attendance of consideration of the complaint of citizen H., by the officials of the Ministry of Finance of Ukraine, the State Tax Service, the National Agency of Ukraine for Civil Service, the Main Department of the State Labour Service in Kyiv Oblast.

Within the framework of parliamentary control and in order to restore the petitioner’s right, the corresponding response measures were taken; in particular, the violating authorities were sent letters to ensure repeated consideration of the petition and exercise of the citizen’s rights under Article 18 of the Law of Ukraine “On Petitions of Citizens”. The petitioner’s right was restored.

  • right to proper review of petitions;

The Commissioner carried out the proceedings based on the application of citizen A. regarding probable violation of his right to petition and proper review of petition by the officials of the MSP and the MoH.

During the proceedings, the MSP considered and furnished citizen A. with information on the procedure for provision of services in the state rehabilitation facility.

The MoH also answered the questions asked in the petition of citizen A. In particular, it was stated that citizen A. could take a medical rehabilitation course based on the family doctor’s referral in the physical therapy and rehabilitation department of the communal non-commercial enterprise “2nd City Health Clinic of Lviv”.

Therefore, the Commissioner’s proceedings restored the right of citizen A. to proper review of his petition.

  • right to file petitions;

In August 2022, the Commissioner received the petition from the people’s deputy of Ukraine regarding violation of the right of citizen B. to send a petition and receive response thereto by the officials of the joint-stock company “Kharkiv Publishing House”.

The measures taken by the Commissioner did not confirm that the joint company “Kharkiv Publishing House” had violated the requirements of the Law of Ukraine “On Petitions of Citizens”, but it was established that the matter described in the petition of citizen B. was within the competence of law-enforcement authorities.

With the Commissioner’s support, the pre-trial investigation was started by the law-enforcement authorities in criminal proceedings.

  • right to written response;

In February, the Commissioner received two petitions from citizen P. regarding the violation by the private joint-stock company “TAS Insurance Group” and individual entrepreneur O. F. Kovalenko, which had failed to give written response to the petitions of citizen P.

The actions were taken within the proceedings to ensure comprehensive, complete and objective consideration of the petitions of citizen P. by the private joint-stock company “TAS Insurance Group” and individual entrepreneur O. F. Kovalenko.

Hence, the right of petitioner P. to file a petition and get a response was restored by the Commissioner.

  • other violations of the right to petition.

In October 2022, the Commissioner received the petition about the alleged violation of the right of citizen P. by Kehychivka Village Council of Krasnohrad Raion, Kharkiv Oblast, and by Krasnohrad Raion State Administration in terms of refusal to accept his oral petition on the hot line.

Following the response by the Commissioner, the Krasnohrad Raion State Administration and the Kehychivka Village Council of Krasnohrad Raion, Kharkiv Oblast informed the Commissioner’s Secretariat of the unconditional exercise of the human and civil right to petitions during the martial law, in particular, as to registration of citizens’ oral petitions, personal reception of citizens and work of the trust line at the hot line numbers.

Hence, the right of the petitioner to file a petition and get a response was restored with the Commissioner’s support.

281 proceedings were instituted based on the reports received by the Commissioner in order to respond and restore the citizens’ rights to petitions.

Right to access information

In 2022, the Commissioner received 1,370 citizens’ reports of violations of the right to access public information.

The monitoring conducted by the Commissioner in 2022 within parliamentary control over observance of the constitutional human right to information and processing of corresponding petitions of citizens identified the following violations of the right to information: a large number of administrators of public information refused to disclose it; limited access to the information published on the official websites; suspended consideration of requests for information due to the legal regime of martial law; unreasonably applied the tool of adjournment to requests for information; refused to disclose information on salaries of staff of the public authorities and local self-government bodies, in particular in the areas without active hostilities, as well as information on distribution and receipt of humanitarian assistance etc.

In July 2022, the Commissioner was approached by the chief editor of a local newspaper in Poltava Oblast, who complained that Poltava Oblast Prosecutor’s Office had violated his right to information in connection with the refusal to disclose the requested information on the amount of the salary accrued and paid in 2022 to the head of Kremenchuk District Prosecutor’s Office in Poltava Oblast, with the explanation that the requested information would be provided after the termination (cancellation) of the legal regime of martial law in Ukraine. Following the response measures, the chief editor’s right to information was restored, and the Prosecutor’s Office disclosed the requested information in full.

In July 2022, the Commissioner received the petition from the civil society organisation regarding violation of the requirements of the Law of Ukraine “On Access to Public Information” by the National Aviation University of Ukraine in connection with the refusal to disclose information on payment of the salary to the principal and vice principals of the NAU for the period from January to July 2022. Following the response measures, the right of the civil society organisation to information was restored, and the University disclosed the requested information in full.

In September 2022, citizen K. applied to the Commissioner in connection with violation of his right to information by the Main Department of the State Geocadastre in Ivano-Frankivsk Oblast (hereinafter the “Department”) in connection with failure to provide the job description of the employee of the Department. Thus, in response to the petitioner’s request, the Department informed that the requested copy of the job description could not be provided as it pertained to information with restricted access, namely the proprietary one.

During the review, the Department was sent the letter of the Commissioner’s Secretariat, where the requirements of the effective legislation as to lawfulness of limitation of access to information were explained.

The right of citizen K. to information was restored with the support of the Commissioner’s Secretariat, and the requested information was provided to the petitioner.

In August 2022, the Commissioner received the complaint from citizen S. regarding violation of her right to information by the Mukachevo Raion Military Administration (hereinafter the “Administration”) in terms of disclosure of data on vacancies in the Administration. In particular, the Administration adjourned consideration of the petitioner’s request until the end of the martial law in Ukraine.

Corresponding response measures were taken within parliamentary control in order to restore the petitioner’s right to information. In particular, the letter was sent to the Administration to explain the requirements of the Law of Ukraine “On Access to Public Information”, namely as regards application of the legal tool of adjournment during the martial law.

Following the response measures taken by the Commissioner’s Secretariat, the petitioner’s request was repeatedly considered by the Administration, and the requested information was provided.

Moreover, the petitioners complained that they could not get information from public registers, including the USRCD, which can also be treated as limitation of the right to information. However, the context of this matter should consider the balance between freedom of expression and guarantees of national security during the legal regime of martial law.

In August 2022, the Commissioner received the petition from the civil society organisation regarding the fact that the State Judicial Administration of Ukraine (hereinafter the “SJA”) had ceased to publish and update the set of open data “Unified State Register of Court Decisions” on the Unified State Open Data Webportal in connection with the martial law imposed in Ukraine.

Within the proceedings, the SJA informed that the USRCD contained more than 104 million electronic court decisions with data on names and address of the military units and formations of the AFU, law-enforcement authorities etc., infrastructural facilities: information on the judges who had carried out criminal proceedings in connection with crimes against the fundamentals of the national security of Ukraine, public order, protection of classified information, inviolability of state borders etc. Disclosure of such information could materially damage the national security, life and health of judges, staff of courts, litigants and other citizens of Ukraine. Therefore, the data set “Unified State Register of Court Decisions” ceased to be published on the Portal. At the same time, the SJA informed that after the work was performed to impersonalise some of the information in the electronic court decisions access to which had been restricted, the administrator would resume publication of the data set “Unified State Register of Court Decisions” on the Portal. The matter is under the Commissioner’s control.

Moreover, in connection with imposition of the legal regime of martial law and armed aggression, the MDT temporarily suspended operation of the Unified State Open Data Webportal pursuant to Resolution of the CMU No. 263 of 12 March 2022 as the Portal contained the data that could be of prejudice to the national security interests. At the same time, use of the open data published on the Portal enables analysing the public policy, controlling actions of the government, increasing civic participation] in decision-making, and helps take better decisions in the economic area etc.

After the Portal had resumed its operations on 1 August 2022, some administrations of the information fail to publish sets of open data subject to compulsory publication, contrary to the requirements of Article 10-1 of the Law of Ukraine “On Access to Public Information” and Resolution of the CMU No. 835 of 21 October 2015 “On Approving On Approving the Regulation on Datasets to Be Published in the Form of Open Data”.

In this regard, two motions were sent by the Commissioner to the National Health Service of Ukraine (hereinafter the “NHS”) and to the State Tax Service of Ukraine (hereinafter the “STS”) as regards elimination of the violated right to information. After the motion had been considered, the NHS published the corresponding data sets on the Portal; the second motion still is being considered by the STS.

258 proceedings were instituted based on the reports received by the Commissioner in order to respond and restore the citizens’ rights to access to information, and 11 administrative offence reports were made and sent to the local courts.

Monitoring inspections of observance of rights

Right to petition

The staff of the Commissioner’s Secretariat carried out 16 monitoring reviews in the central executive authorities in 2022 to check observance of the constitutional human and civil rights and freedoms, including the right to petition.

In February 2022, the staff of the Commissioner’s Secretariat conducted the monitoring of observance of the citizens’ rights to petition to the power entities via personal reception by their heads during the quarantine restrictions in the MIA and the MoD.

The respective reports on violations were made following the reviews and sent to the ministries in order to prevent possible defects in their further work.

As the legal regime of martial law had been imposed in Ukraine, the question of checking observance of the constitutional right to petition and response by the power entities during the martial law came up.

During the monitoring, the staff of the Commissioner’s Secretariat detected a number of violations, including temporary suspension of consideration of the citizens’ petitions and requests for public information not associated with the martial law, military operations, provision of medical assistance, evacuation of the population etc., suspension of personal reception of citizens, no working hours of the hot line on the website of the power entity, which prevented citizens from exercising their right to submit an oral petition, no online form on the websites of the power entities for citizens to submit electronic petitions by filling in respective fields, with mandatory specification of the full name, place of residence, summary of the matter, comment, proposal, application or complaint, request or claim.

Moreover, observance of information rights during martial law was monitored from the end of August until the beginning of November 2022 with the support of UNDP Ukraine. In particular, observance of the citizens’ right to submit an oral petition and to exercise the right to personal reception during martial law by the public authorities and local self-government bodies was assessed.

The power entities monitored in 2022 were selected with account of the current circumstances of occupation / deoccupation of specific communities and included 132 public authorities and local self-government bodies: oblast and raion military administrations, city councils of oblast centres. The findings of the monitoring of observance of the citizens’ information rights during the martial law demonstrated the need to organise consistent and responsible work of the public authorities and local self-government bodies in that field.

Right to access information

With account of the legal regime of martial law, occupation of certain settlements, internal migration of citizens in connection with hostilities and the citizens’ need of prompt communication with the public authorities, the citizens’ access to information on the basic relevant channels of communication with the administrators of information, their working hours and legal and normative acts adopted during the war is important. Moreover, there was an elevated interested of the public to information on the structure, principles of formation and labour remuneration, payments and additional benefits due to heads of the public authorities in 2022.

In that regard, the Commissioner’s Secretariat monitored compliance with specific requirements of Article 15 of the Law of Ukraine “On Access to Public Information” by 19 ministries in August 2022.

The findings of the monitoring demonstrate that the ministries mostly publish information on their activities (namely the location, mailing address, telephone numbers and e-mail), names of the head and deputy heads of the authority; legal and normative acts and draft resolutions to be discussed on the official websites.

At the same time, most ministries do not publish or partly publish information on the principal functions of their structural and regional subdivisions and contact details of their heads; contact details and e-mail addresses of heads and deputy heads of the ministries, and fail to specify the dates of publication or update of all the categories of the information published on their official websites.

Moreover, it was established during that monitoring that neither of the ministries had published information on the structure, principles of formation and labour remuneration, payments and additional benefits due to heads and deputy heads. Thus, pursuant to the Law of Ukraine “On Amending Certain Laws of Ukraine as to Open Information on Labour Remuneration in State and Municipal Companies”, which entered into force on 02.10.2021, such information shall be regularly published by individual administrators, including ministries.

After the ministries had processed the acts of response sent by the Commissioner’s Secretariat following the monitoring, most of the ministries eliminated the violations by publishing certain types of information under Article 15 of the Law of Ukraine “On Access to Public Information” on their websites.

Recommendations

The Verkhovna Rada of Ukraine should:

- modify the draft law “On Amending the Law of Ukraine ‘On Petitions of Citizens’ Concerning the Exercise of the Constitutional Right to Petition by Persons Recognised as Legally Incapable by Court” (registration No. 1186 of 29.08.2019) aimed at implementing Decision of the Constitutional Court of Ukraine No. 8-р/2018 of 11 October 2018 in the case of a constitutional petition of the Ukrainian Parliament Commissioner for Human Rights on compliance with the constitutionality of certain provisions of Article 8(2), the second sentence of Article 16(4) of the Law of Ukraine “On Petitions of Citizens” (the case on petitions of persons recognised as legally incapable by court);

- resume the work to develop amendments to the Law of Ukraine “On Access to Public Information” in connection with the ratification and entry into force of the Council of Europe Convention on Access to Official Documents and the circumstances resulting from the legal regime of martial law.

The Ministry of Infrastructure Ukraine, the Ministry of Internal Affairs of Ukraine, the Ministry of Defence of Ukraine, the National Social Service Ukraine, the Ministry of Environmental Protection and Natural Resources of Ukraine should approve and publish the schedule of personal reception of citizens by the head of the central executive authority in order to observe the citizens’ constitutional right to petitions and response.

The Ministry of Economy of Ukraine, the National Commission for State Regulation of Energy and Public Utilities, the State Customs Service of Ukraine should resume personal reception of citizens as guaranteed by Article 40 of the Constitution of Ukraine and the derivative right to personal reception by heads of power entities during the martial law.

Right to protection of personal data

Key events, challenges and tendencies

In 2022, the Verkhovna Rada of Ukraine made a number of amendments to the effective legislation on personal data protection, namely the Law of Ukraine “On Personal Data Protection” as to cloud services, personal data processing during the martial law, provision of medical services and statistical activities.

During the year, the Commissioner registered the following violations of personal data protection: unlawful processing of personal data, including their unlawful spread and use; failure to provide the personal data subject with complete information on the personal data owner, improper execution of consent to personal data processing, failure to provide access to your personal data (information on yourself), publication of personal data of the Ukrainian military and foreigners granting military assistance of Ukraine during the martial law online, excessive collection of personal data by providers of humanitarian, volunteer and other charitable assistance to the population.

New challenges in this field are associated with the armed aggression against Ukraine, which has increased the necessity of personal data protection. Under the given conditions, personal data leak can have effects not only as interference into the person’s private life, but also a threat for personal security.

According to the Security Service of Ukraine, the special services of the Russian Federation intended to fully destroy Ukraine’s entire cyber protection on 24 February 2022: the largest number of cyber attacks against the Ukrainian systems was registered then.

According to the State Service of Special Communications and Information Protection of Ukraine, the Computer Emergency Response Team of Ukraine (CERT-UA) has registered and studied more than 1,500 attacks since the beginning of the full-scale military invasion of Ukraine by the Russian Federation. Most of them were launched by the Russian Federation.

In 2022, the target of the cyber offenders was civil servants who received e-mails with the malware capable of getting access, namely to their personal data. In this case, access to personal data can result in interference with operation of the information systems, work of public authorities, stealing of funds etc.

It was found out from the mass media reports that a hacker attack against a number of the governmental websites was launched at night on 14 January 2022. The provocative message about personal data leak was published on the main page of those websites. In that regard, the Commissioner sent the acts of response to the MDT, the SSU, the Cyber Police Department of the National Police of Ukraine, and the Administration of the State Service for Special Communication and Information Protection of Ukraine.

In response, the public authorities informed the Commissioner that the criminal proceedings had been instituted based on the cyber attack under Article 361 of the CrCU (Unauthorised interference with operation of information (automated), electronic communication, information communication, and electronic communication networks). Following the investigation within the corresponding criminal proceedings, the authorised bodies established the details of the cyber attack, including its sources and possible damages.

Spread of personal data can be of material prejudice to the defensive capacity of the state in the context of martial law. Publication of personal data of the persons participating or assisting in defence of Ukraine was registered during the reporting period.

It was found out by the staff of the Secretariat that the personal data of the Ukrainian military and foreigners granting military assistance to Ukraine during the martial law had been published online on one of the websites by the unidentified persons. The Commissioner applied to the SSU and the National Police of Ukraine as a part of his response. The Pecherskyi Police Directorate of the MD NP in Kyiv instituted criminal proceedings based on the fact of personal data publication.

Introduction of the European standards and approximation to full membership with the EU require to update the Ukrainian regulatory framework for personal data protection with account of the European standards. The Law of Ukraine “On Personal Data Protection”, which was developed in 2010 and is based on Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which has been repealed and replaced with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR) needs to be updated. For this very reason, the Commissioner recommends to expedite the consideration by the Verkhovna Rada of Ukraine and adoption of the draft Laws of Ukraine “On Personal Data Protection” (registration No. 8153 of 25.10.2022) and “On the National Commission for Personal Data Protection and Access to Public Information” (registration No. 6177 of 18.10.2021).

Response to violations of human and civil rights

The same way as during the previous years, violations in the field of unlawful processing of personal data remain the key problem although the quantity of reports is materially lower than in 2021. 844 petitions were received in 2022, and there was response to violations of human and civil rights as to:

  • 60% of the reports associated with unlawful processing of personal data;

In July 2022, the Commissioner received the citizen’s petition about telephone calls with threats and text messages sent to the petitioner’s phone number from representatives of the financial company as to repayment of the debt under the loan contract he had not concluded. Following the response, the petitioner’s mobile phone contact number was removed from the database of the financial company. The petitioner’s right was restored.

In July 2022, the Commissioner received 2 petitions from the citizens regarding unlawful spread and use of their personal data. In one of the petitions, the petitioner complained that his and his wife’s personal data had been disclosed in a publication of medical records on Facebook. It was noted by the second petitioner that while she was registered with the employment centre, she found out that her personal data had been unlawfully used by the limited liability company by registering sham employment relations with her. Following the Commissioner’s response, the corresponding police departments instituted the criminal proceedings under Article 182(1) of the CrCU (Violation of inviolability of private life).

The Commissioner was approached by person V. regarding the alleged violation of the legislation on personal data protection by the law-enforcement authorities in connection with the fact that the automated information and search system of the law-enforcement authorities contained unreliable (erroneous) information on the petitioner (the petitioner’s photo was shown together with details of the other person who was hiding from the public authorities and was on a wanted list).

The petitioner emphasised that the actions of the law-enforcement authorities, entry of the unreliable data as well as presentation of the unreliable information in the search data bases resulted in the illegal processing of the petitioner’s personal data (confidential information) and caused interference with his private life.

Given the above, the MIA was sent the request to check the information and take actions to remove the unreliable personal data (photograph).

The petitioner’s right was restored with the response measures taken, and the petitioner’s photograph and data on him being on a national wanted list were removed from the information and search system.

  • 28% reports on violation of the right to access information on yourself;

In August 2022, the Commissioner received the citizen’s petition regarding violation of the petitioner’s right to get information on himself in connection with payment of the one-time monetary assistance and calculation of the pension by the officials of one of the departments of the Pension Fund of Ukraine. In that regard, actions were taken to ensure that the petitioner’s requests would be considered in a comprehensive, complete and objective manner, and grant the petitioner access to his personal data. The petitioner’s right was restored.

  • 12% of the reports about organisation of processing of personal data.

In August 2022, the Commissioner received the citizen’s petition regarding lack of information on the economic operator (seller) collecting, using and storing personal data on the website of the e-pharmacy, and regarding improper form of consent. Following the response measures taken, information on the economic operator on the website of the e-pharmacy was updated, and proper form of user’s consent was used. The rights of users of the e-pharmacy were restored. The website of the e-pharmacy has more than a million visitors a month.

66 proceedings were instituted by the Commissioner based on the reports, and the response measures were taken to restore rights of the citizens (personal data subjects).

Monitoring inspections of observance of rights

During the reporting period, the staff of the Commissioner’s Secretariat conducted 85 inspections of compliance with the legislation on personal data protection. The inspections were conducted in the ministries and other central executive authorities, state agencies and services, local self-government bodies, social protection authorities, administrative services centres, air enterprise, housing and utility enterprises, healthcare institutions, charitable foundations, credit history bureaus, Internet providers, translation agencies etc.

The inspections studied observance of human rights to personal data protection, analysed the internal processes of personal data work organisation and means of protection of the personal data fully or partly processed by automated means as well as the personal data that are kept or are to be entered into the card register by non-automated means.

Following the inspections, 75 binding orders were issued to eliminate the violations.

To sum up the findings of the inspections, the following standard violations of the legislation on personal data protection can be classified:

  • the administrative document on general requirements for personal data processing and protection has not been approved, or the administrative document has been approved, but it fails to meet the legislative requirements, in particular, to specify categories of personal data subjects; elements of the personal data collected as to personal data subjects; procedure for personal data processing and protection;
  • improper legal grounds for personal data processing;
  • failure to inform all the personal data subjects of the personal data owner, elements and content of the personal data collected, their rights prescribed by the legislation, the purpose of personal data collection, and the persons receiving their personal data;
  • no action plan in case of unauthorised access to personal data, damage to technical equipment and emergency situations;
  • no procedure for disposal/deletion of the personal data the period of storage of which has expired;
  • no registration of operations associated with personal data processing.

Explanatory, awareness-raising and legislative drafting work

In connection with the mass cyber attacks, spread of hazardous e-mails and in order to prevent personal data loss and violation of citizens’ rights, the applicable warnings have been published, and recommendations have been given to citizens and other parties to the relations in the field of personal data. Thus, the staff of the Commissioner’s Secretariat conducted training for the public authorities and judges on relevant matters of personal data protection in 2022.

Recommendations

The Verkhovna Rada of Ukraine should consider and adopt the draft Laws of Ukraine “On Personal Data Protection” (registration No. 8153 of 25.10.2022) and “On the National Commission for Personal Data Protection and Access to Public Information” (registration No. 6177 of 18.10.2021).

The entities in the national cyber security system: The State Service of Special Communications and Information Protection of Ukraine, the National Police of Ukraine, the Security Service of Ukraine, the Ministry of Defence of Ukraine, the General Staff of the Armed Forces of Ukraine, the intelligence authorities and the National Bank of Ukraine should develop and implement the preventive, organisational, educational measures in the field of cybersecurity, cyber defence and cyber protection in order to prevent unauthorised access to personal data, namely in connection with the armed aggression of the Russian Federation against Ukraine.

The Cyber Police Department of the National Police of Ukraine should publish recommendations for citizens online security and protection from fraud.