The Law of Ukraine on Personal Data Protection (the “Law”) became effective from 1 January 2011. However, the Law was not fully enforceable due to the lack of secondary legislation concerning clarification of the provisions of the Law and the practical regulation of the data protection system.
One of the mandatory requirements set out by the Law is the registration of any personal data database with the State Register of the Personal Data Databases (the “State Register”). The State Register should be separately created by the regulatory authority in data protection area, i.e. by the State Service for Personal Data Protection (the “SSPDP”).
According to the Decree on the Approval of the Regulation on the State Register of the Personal Data Databases (the “Decree”) adopted by the Cabinet of Ministers of Ukraine on 25 May 2011 and effective since 21 June 2011, the State Register should be created and become functional from 1 July 2011. The Decree also requires that the SSPDP starts to register personal data databases from that same date.
Further, the Decree appoints the “Information Centre” of the Ministry of Justice of Ukraine (a state enterprise which is also in charge of administering other public databases, such as the Register of Rights of Ownership to Real Estate, the Unified Register of the Powers of Attorney, etc.) as administrator of the State Register.
The administrator will be in charge of, inter alia, provision of the access to the State Register to registrars and storage and protection of the data placed in the State Register. The administrator will be also responsible for maintaining the web-site where the data from the State Register is stored, access to which will become available from 1 January 2012.
The State Register is to be maintained in the Ukrainian language. The records regarding each database to be registered in the State Register will contain the information specified by the Decree, including:
- information about the applicant;
- name and location of the personal data database;
- information concerning the issued state registration certificate;
- information about any changes to the registered database; and
- certain other data specified by the Decree.
It should be borne in mind that according to the recently adopted changes to the Code of Ukraine on Administrative Offences, personal database registration evasion entails a fine of up to UAH 8,500 (ca. EUR 800). This fine is to be imposed on the managers of the relevant company and such liability will become effective from 1 January 2012.
Law: Decree of the Cabinet of Ministers of Ukraine on Approval of the Regulation on the State Register of the Personal Data Databases dated 25 May 2011 No. 616.