On June 26, 2020, an online expert discussion on institutionalisation of the state control in the field of data protection and access to public information was held at the meeting of the Committee of the Verkhovna Rada on Human Rights, Deoccupation and Reintegration of Temporarily Occupied Territories in Donetsk, Luhansk Regions and Autonomous Republic of Crimea, National Minorities and Interethnic Relations.

The event was organized under support of the Joint Project "European Union and Council of Europe working together to strengthen the Ombudsperson’s capacity to protect human rights". MPs, representatives of the Office of the Ukrainian Parliament Commissioner for Human Rights and other public authorities, international organisations and projects, expert and civil society members took part in the discussion.

“The Council of Europe Office in Ukraine is ready to further support the process of institutionalisation of the state control in the field of data protection and access to public information within the framework of the Joint Project "European Union and Council of Europe working together to strengthen the Ombudsperson’s capacity to protect human rights" in order to facilitate that the national legislation in this field, on the one hand - corresponds to the Ukrainian realities, the Constitution of Ukraine, and on the other hand - takes into account the experience and standards of the Council of Europe and the European Union," said Olena Lytvynenko, Deputy Head of the Council of Europe Office in Ukraine.

Ukraine is a party to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108). However, in May 2018, the Council of Europe adopted CETS Protocol No.223, which amended the Convention 108. The modernised Convention 108+ takes into account most of the challenges posed by the development of information and communication technologies and strengthens the requirements for its implementation.

Thereafter, Ukraine was faced with the issue of ratification of the Protocol, which amended Convention 108, the provisions of which provide for establishment by the Parties of an independent supervisory authority in the field of personal data protection. The updated provisions of the Convention emphasise a need to give the oversight body effective powers and functions as well as to ensure its independence in carrying out its mission.

The participants of the expert discussion concluded that further institutionalisation and development of the state control in the field of personal data protection and access to public information in Ukraine is extremely necessary and can be carried out on the basis of legislative consolidation of one of the three models*.

Model 1 is based on the idea of a separate state authority with an autonomous legal status not belonging to any of the branches of government in Ukraine.

This model is rather widespread in many countries of the world. As the systematic analysis of the provisions of domestic law in various countries demonstrates, independent supervisory authorities in the relevant areas act as inspections, commissions or commissioners, etc., empowered to protect the right to information (protect data). Those types of national supervisory authorities differ also among themselves by the structure of their competence, that is, by whether they are invested exclusively with supervisory or regulatory powers or with a combination of both.

Model 2 envisages the establishment of the separate central executive authority within the executive branch of government and with additional guarantees of institutional independence. Such guarantees should provide the Supervisory Authority with personnel, technical and financial resources, premises and infrastructure necessary for its efficient performance independently of other executive bodies. In various countries, supervisory authorities are established as single-person authorities supported by special offices (secretariats) or independent collegial bodies. In some cases, such bodies are established under relevant ministries or other government agencies.

Model 3 is about the establishment of a system (a number) of supervisory authorities.

This model entails preservation and the in-depth comprehensive development of the currently existing model of supervision in the fields of personal data and access to public information. In practice, it means interinstitutional cooperation and comprehensive regulation of performance of subjects in the public and non-public areas.

According to this approach, several bodies united by a clear algorithm of interaction, decision-making and reporting, should exercise relevant powers related to state supervision in the areas of personal data protection and access to public information.

As a result, the participants mentioned that if any of the models is selected for the institutionalisation of the Supervisory Authority, the law should provide for the broad, consistent and efficient interaction of this new authority with the institutions (members of the civil society) involved in the civil supervision of the observance of the law in the areas of personal data protection and access to public information. Such guarantees could be of financial, procedural or jurisdictional, etc. nature. However, they in any case should be permanent and real, and the state should provide for the high standards of their implementation.

The European Union and Council of Europe Joint Project “EU and Council of Europe working together to strengthen the Ombudsperson’s capacity to protect human rights” aimed at ensuring better protection of human rights in Ukraine and enhancing operational capacities of the Ombudsperson’s Office in particular in the area of ensuring the protection of the right to privacy and personal data.

*Legal analysis of the main models of institutionalisation of the state supervision with regard to personal data and access to public information in Ukraine, prepared by Volodymyr Venher and Oleh Zaiarnyi, CoE national consultants within the Joint Project “EU and Council of Europe working together to strengthen the Ombudsperson’s capacity to protect human rights”