The forthcoming Law of Ukraine on Electronic Communications No. 3014 (‘the E-Communications Law’) will have wide implications for the sector, as well as on other pieces of national legislation. Oleg Klymchuk, Counsel at Sayenko Kharenko, discusses this new legislation and its nuances.
What does new Ukrainian Law on Electronic Communications mean for data privacy?
The Law of Ukraine on Telecommunications No. 1280-VI (‘the Telecoms Law’) was adopted in November 2003. This preceded the launch of Facebook (on 4 February 2004), as well as the before iPhone (released in 2007). Moreover, the Telecom Law predates the invention of the term Big Data for the first time (which was coined in 2005), not to mention many other things which nowadays are a part of our daily (technology-driven) life. Such technologies have tremendously changed the world since then, but the original Telecoms Law is still in effect.
However, the status quo of the now old-fashioned Telecom Law is set to change. On 16 December 2020, the Ukrainian Parliament finally adopted the much-awaited E-Communications Law, while on 12 January 2021, the President of Ukraine signed the same into law. The E-Communications Law will enter into effect on 1 January 2022, thus repealing the Telecom Law in the process.
The E-Communications Law introduces various new regulations (e.g. technological neutrality of radio spectrum use and simplifying access to infrastructure for deployment of broadband networks), but in this article we discuss only the upcoming key changes in the regulation for data privacy issues.
Electronic communications service
An overview of the privacy regulations under the E-Communications Law would be incomplete without a brief look at the scope of the new law, so to better understand for which e-services it is relevant.
By the definition given in the E-Communications Law, an e-communication service means a service that consists of receiving and/or transmitting information via electronic communications networks, with the exception of services with editorial control over content transmitted using electronic communications networks and services.
The definition does not appear to be fully in line with the European Electronic Communications Code (‘EECC’), as it does not indicate that e-communications services should be normally provided for remuneration. This essentially means that e-communications services provided for free are also subject to the provisions of the E-Communications Law.
When compared to the EECC, the definition does not specify the types of e-communication services which are instead scattered throughout the provisions of the E-Communications Law. Based on the complex understanding of the E-Communications Law and non-exhaustive list of the e-communications services in Article 18 of the same, the applicable e-communications services include the following:
The scope of the E-Communications Law does not exclude e-commerce. In Article 2 of the Law of Ukraine on E-Commerce No. 675-VIII (‘the E-Commerce Law’), the E-Communications Law is mentioned among the laws which regulate the e-commerce sector. The final and transitional provisions of the E-Communications Law introduce some amendments to the E-Commerce Law, but these amendments do not relate to the privacy regulations. Therefore, it remains to be seen how the privacy provisions of the new E-Communications Law will be used together with the privacy provisions of the E-Commerce Law. Based on the general principles of law, we are of the position that the privacy provisions of the E-Communications Law should prevail over of the conflicting privacy provisions of the E-Commerce Law. Below we highlight some examples.
Protection of personal information of the end-users
Article 119 of the E-Communications Law provides that suppliers of e-communications services should ensure and take responsibility for the safety of the end-user’s data which the supplier has received in the course of conclusion of an agreement on e-communications services, as well as the provision of e-communications services. Such end-user’s data include:
The above list of end-user’s data is non-exclusive. When considering to which end-user’s data Article 119 applies, the supplier should rely on the general regulations. In other words, it applies to all end-users’ data that the supplier has received in the course of the conclusion of an agreement on e-communications services, as well as the provision of e-communications services.
Information on the e-communications services consumed by the end-user can be provided to third parties on the basis of prior consent, either in written form or any other form that proves that such consent has been granted in the manner according to the Ukrainian Constitution and the laws of Ukraine. The consent requirements stipulated by Article 119 of the E-Communications Law appear more relaxed if compared to the effective Article 34 of the Telecom Law and Item 45 of the Rules on Rendering and Consuming Telecom Services approved by Resolution No. 295 of the Cabinet of Ministers of Ukraine, dated 11 April 2012 (‘the Telecom Services Rules’). In particular, Article 34 of the Telecom Law and Item 45 of the Telecom Services Rules stipulate that information concerning the subscriber and the telecom services consumed by them can be provided in cases and in accordance with the procedure prescribed by the law, otherwise this information may be shared with the third parties only upon receiving the written consent of the subscriber.
It should be emphasised that most Ukrainian subscribers consume telecom services without registration (no electronic or written contract is concluded). Therefore, it is usually an onerous requirement to obtain proper consent. Article 112 of the E-Communications Law still the permits conclusion of e-communications services agreement in verbal form, so it will be interesting to see how suppliers of e-communications services will adhere to the consent requirements stipulated by the E-Communications Law.
Furthermore, the end-users’ location data, including device location data and SIM cards signal data, fall within the meaning of the location and travel routes data (so-called ‘extreme risk data’), the processing of which requires proper notification to the Ukraine Parliamentary Commissioner for Human Rights (‘the Commissioner’). Based on the publicly available information, a number of suppliers of telecom services (e.g. Kyivstar mobile operator or the MTS Ukraine mobile operator operating under the Vodafone brand) have already notified the Commissioner of the processing of such kind of the extreme risk data. To this end, in cases where a third-party service provider is engaged by a Ukrainian operator to process device location data, SIM cards signal data, and other end-users’ location data, such thirty-party provider will likely be classified as a data processor and, therefore, the respective supplier should notify the Commissioner of a new data processor.
New anti-spam regulation
The E-Communications Law aims to reduce the volume of spam in Ukraine. In particular, Article 120 of the E-Communications Law prohibits intentional mass distribution of electronic, text, and/or multimedia messages without the consent of the end-users to their electronic addresses or terminal equipment.
The new spam regulation excludes messages from suppliers of e-communications services, related to the provision of e-communications services and/or information services such supplier provides. It also excludes private messages of the end-users which do not have a mass character and are sent with a non-commercial purpose.
End-users are permitted to use the phone numbers and other subscriber’s network identifiers which are received by any means in the course of the sale of goods or provision of services for sending advertising for the purpose of soliciting goods or services only when the end-user’s consent is provided, including when in electronic form. The end-users must also have an opportunity to refuse the usage of their data at any time, free of charge, in a simple and understandable form.
In terms of e-commerce regulation, the new anti-spam regulation conflicts, to some extent, with the E-Commerce Law. In particular, Article 10 of the E-Commerce Law provides that commercial electronic messages (i.e. electronic messages in any form, the purpose of which is the direct or indirect promotion of goods, work, or services or business reputation of a person who conducts commercial or independent professional activity) must be delivered to the end-user only with their consent, unless the end-user has a possibility to unsubscribe from further receiving such messages. In other words, in cases where the ‘unsubscribe’ option is ensured, the E-Commerce Law permits sending messages that solicit goods or services without the end-user’s consent.
However, it is expected that, where relevant, the new anti-spam regulation will prevail over the provisions of the E-Commerce Law on sending commercial electronic messages. Specifically, obtaining prior consent is advisable to avoid qualification as spamming under the E-Communications Law.
Access to personal information without consent
Under paragraph 1 of Article 121 of the E-Communications Law, the access to information about the end-user, facts of provision of e-communications services, including data which is processed for the purpose of transmission of such information in electronic communication networks, is allowed only on the basis of a court decision or investigating judge in cases and in the manner stipulated by law.
The above regulation does not fully comply with Article 250 of the Code of Criminal Procedure of Ukraine, whereas the covered investigative procedures can be conducted before resolution of the investigative judge. When declining to sign the E-Communications Law for the first time in October 2020, the President of Ukraine remarked on this inconsistency and recommended the amendment of the first paragraph of Article 121. However, this was not removed from the adopted version of the E-Communications Law. As a result, it is expected that the conflict between Article 121 of the E-Communications Law and Article 250 of the Code of Criminal Procedure of Ukraine will be resolved at a later stage. In the meantime, it will be interesting to see how suppliers of e-communications services will satisfy requests of law enforcement authorities for covered investigative activity before resolution of the investigative judge.
Article 121 of the E-Communications Law also stipulates that suppliers of e-communications services/networks should define a point for the plugging in of special technical means and ensure an opportunity for connecting the special technical means for law enforcement authorities. Capturing of information from the electronic communications networks of suppliers of e-communications services is ensured by an integrated system of technical means which are used by all authorised law enforcement authorities under the terms of autonomous access to the information and in the manner prescribed by law.
Market players have one year to align their operation with the requirements of the E-Communications Law, including the relevant regulations which the Ukrainian Government should update and adopt during this one-year transitional period for the purpose of the full-fledged implementation of the E-Communications Law.
Traditional telecom services, internet-based services, and other e-communications services falling within the realm of regulation of the E-Communications Law need to understand and comply with these new regulations that are expected to enter into force in less than a year.