Approximation of data protection and access to public information Waltraut Kotschy Ludwig-Boltzmann Institute for Human Rights, Vienna Round table, Kiev, 25 October, 2018

General clarification Add to Art. 2: “This Law does not impair the data subject’s right to access his/her own data according to Art. 15 of the Law of Ukraine on personal data protection” Delete Article 10 of the Law on Access to public information

How shall access be granted? By publication  „open data“ By giving information upon request Add to Art. 5: that „provision of information upon request“ can also be fulfilled by access to documents; decide, whether it must be explicitly requested

Restricted access Art. 6 foresees 3 categories of information for which access may be restricted: 1) confidential information 2) secret information 3) information for internal use only Add a 4th category: ‚4) personal information‘

Personal information Create a new Article 91 dealing with personal information 1) Define “personal information“: = data about identified or identifiable individuals (= congruent with Law on Personal Data Protection) 2) clarify that „data protection“ cannot be a reason for restricting access to public information if the data subject requires access!! (but access could be denied for other reasons than data protection)  proposal: restriction because of data protection can only pertain to „information which contains personal data about natural persons other than the requestor”

Specific problem How do you want to treat personal data about civil servants showing up in a document, involved in a case, ………….? Their legitimate interest in data protection should in principle not override the public interest in access to public information Possible solutions: No protection for data relating to the exercise of public functions, or De-personalize, unless explicit and reasoned request for disclosure …???

Access to a third person‘s data Data concerning another person than the requestor are protected under the Law on personal data protection vis-à-vis the requestor Access to such data can therefore be granted only in compliance with the Law on personal data protection:  either data are de-personalized  or a reason for legitimate disclosure according to the Law on personal data protection exists

De-personalization In the case of open data: names and other identifiers must be left out in publications (how to treat data about the civil servants involved?) In case of giving information about public information: names and other identifiers are not mentioned In case of access ot documents: names and other identifiers must be ‚blackened‘

Reasons for legitimate disclosure Law on personal data protection: Consent of the data subject(s) Vital interest of the data subject or of a third person A special legal provision allowing access Legitimate interests of the requestor or a third person in disclosure, overriding the data protection interests of the data subject(s) How shall ‚overriding‘ be determined? Could some criteria be given? Like ‚undue harm‘….

Procedure Request for access comes in Request must be examined; if the requested data contain personal information Is it information about the requestor? Is identity of the requestor certified? If it is not information about the requestor: is de-personalization feasible? if not: it there a reason for legitimate disclosure? Whenever personal information is involved, more time is needed for examination  timeframe for answering request should be harmonized with access-request under Data Protection Law