Internet Regulation Index

General editorship: Vitalii Moroz

Project Manager: Yuliia Babko

Contributors: Tetiana Avdieieva Lidiia Volkova Vitalii Moroz Ihor Rozkladai Antonina Cherevko

Design and layout: Denys Baluba

Editor: Yuliia Moroz

This expert study was carried out by Internews-Ukraine NGO within the framework of the Promoting Internet Freedom in Ukraine project funded by the U.S. Department of State through the American Bar Association and its Fund for Justice and Education. Responsibility for the contents of this publication lies solely with Internews-Ukraine, and it does not necessarily reflect the official position of the American Bar Association. © NGO Internews-Ukraine, 2022

CONTENTS Introduction Key conclusions and recommendations for Draft Law № 6177 Challenges of Draft Law № 6177 Analysis of experts’ responses.

Draft Law № 6177 The Study Findings Detailed description of findings of the study of Draft Law № 6177 Figures in the study of Draft Law № 6177 Internet Regulation Index: What is new in the study’s methodology?

Conclusions and recommendations of the study of Draft Law № 6177 Experts involved in the study of the draft law

1

Introduction

Introduction In 2019, NGO Internews-­U kraine in partnership with the leading Ukrainian media lawyers launched a project for development of the Internet Regulation Index (hereinafter — the Index). This Index was conceived as a tool for monitoring the quality of suggested or approved normative documents and/or other regulatory initiatives in Ukraine influencing the development of the online sphere, i. e. free Internet in Ukraine. The Internet Regulation Index is aimed at assessing potential negative or positive impacts of regulatory initiations through the prism of responses of experts who took part in the study. With publication of the study’s results, the next stage is implemented — further advocacy effort for protection of free Internet in Ukraine by civil society and the technical community through interaction with government stakeholders.

Later, in 2021, the researchers chose legislative initiatives № 3196‑д, the Draft Law On Amending the Law of Ukraine on the Security Service of Ukraine concerning improvement of the organizational and legal principles of organization of the work of the Security Service of Ukraine (short title — the Draft Law on Security Service) (results), as well as the long-awaited draft law № 5628 On Personal Data Protection (results).

In 2020, NGO Internews-­Ukraine carried out the first two studies using the Index methodology. The researchers analyzed Draft Law № 2692 On Media (results) and the disinformation initiative (results), which never became a draft law and was relinquished as a result of public pressure.

Internet Regulation Index 2022

2

Key conclusions and recommendations for Draft Law № 6177

Key conclusions and recommendations for Draft Law № 6177 In November 2021 — April 2022, NGO Internews-­U kraine together with leading lawyers and experts on digital technologies from civil society organizations and the private sector studied the potential impact of Draft Law № 6177 On the National Commission for Protection of Personal Data and Access to Public Information on development of the online space in Ukraine.

Draft Law № 6177 on the National Commission is a logical continuation of Draft Law № 5628 On Personal Data Protection that clarifies the powers and authorities of the state regulator regarding protection of personal data.

According to the study’s methodology, the Internet Regulation Index, the project team engaged 20 experts asking them to assess provisions of Draft Law № 6177. Each expert gave scores and provided extensive comments to 34 substantive questions of the questionnaire. The results of the study and recommendations prepared by the project working group are provided below: A consolidated score of the study of the Draft Law № 6177 On the National Commission for Protection of Personal Data and Access to Public Information is positive and totals +0.59 within the expert assessment scale from –5 to +5.

Adoption of this draft law in the wording of October 18, 2021 will facilitate development of free Internet in Ukraine and have a positive impact on public legal relations in the online space.

Legislators should pay special attention to the provisions of the draft law under study block № 3. Quality of service provided (score –0.29) in terms of economic impact on activities of the providers. Scores given in other three blocks are moderately positive — № 1.

Impact on rights and freedoms (+0.47), № 2. Protection of legitimate interest (+1.28) and № 4. Legal technique (score +0.37). See further in the Analysis of experts’ responses section.

For Ukraine, creation of the National Commission for Protection of Personal Data and Access to Public Information is an important step toward harmonization of national legislation with the norms of international law, since a requirement to establish a regulatory body is present not only in the text of Draft Law № 5628 On Personal Data Protection, but also in international law, including the ECtHR conclusions on the national legislation concerning the need to establish a regulatory authority that with deal with the issues of personal data.

Exercising of its powers and authority by the National Commission will enable it to respond to violations of the legislation on personal data protection effectively and bring the violators to justice.

Internet Regulation Index 2022

3

Key conclusions and recommendations for Draft Law № 6177

An extremely important part of powers and authority of the National Commission will lie not just in imposing sanctions on violators, but also in the development of recommendations on ensuring personal data protection, provision of explanations in the sphere of personal data protection to the entities entitled to these rights, as well as influencing adoption of the legislation that would take the requirements for personal data protection and access to public information into account.

Additional guarantees and safeguards should be provided against possible abuses in the context of the National Commission’s access to information, telecommunication and reference systems, registers and data banks, in particular those containing information with limited access.

Mechanisms for personal data protection have to take into account the context of free Internet functioning in Ukraine and not to impose insufficiently justified sanctions on operators and providers of Internet access.

The duration of inspections of operators and providers of Internet access services should be reduced from 180 to 30 days, while repeating such inspections for an unlimited number of times should be prohibited.

The amount of sanctions should be regulated so that the penalty for noncompliance with a decision of the National Commission on elimination of the violation does not impose a much greater burden on the entities than the penalty for the violation itself.

The text of the draft law should contain a clearly defined level / percentage of funding for the National Commission to be allocated from the state budget of Ukraine.

Internet Regulation Index 2022

4

Challenges of Draft Law № 6177

Challenges of Draft Law № 6177 In summer 2021, within the framework of the Internet Regulation Index study, NGO Internews-­Ukraine carried out risk analysis for the Draft Law № 5628 On Personal Data Protection, which involved 20 experts.

This was the draft law that contained a significant number of provisions directly related to digital rights of users, freedom of the Internet, and regulation of the private sector activities. According to the study results, a consolidated experts’ score for Draft Law № 5628 totaled at +0.87, within the scale from –5 to +5. The majority of experts did not mention any serious problems that could not be corrected during examination of the draft law in the second reading. A rather high positive score of this initiative gave hope that the parliament would pass the draft law, and take several comments from representatives of civil society and the private sector into account.

One of the key recommendations concerning Draft Law № 5628 for legislators from NGO Internews-­Ukraine, as well as a number of other non-government organizations, was a suggestion to isolate provisions on the oversight body — the personal data regulator — into a separate law. This proposal was one of the key conclusions of the study carried out under the Internet Regulation Index.

Several months later, namely on October 18, 2021 the Draft Law № 6177 On the National Commission for Protection of Personal Data and Access to Public Information was registered at the Verkhovna Rada of Ukraine. Authors of the draft law were

the same people who initiated Draft Law № 5626, namely, MPs Taras Tarasenko, Yehor Cherniev, and others.

A requirement to establish a regulatory body is included not only in the text of the draft law On Personal Data Protection, but also in international law. In particular, the European Court of Human Rights (ECtHR) has repeatedly mentioned the need to create an oversight body that would deal with personal data issues. For instance, in the case of Gaughran v the United Kingdom, the Court deemed it was a violation that a person’s photo was stored in a local database with the possibility of uploading to the police database without a revision or oversight by a special independent agency.

Similarly, in recent cases of Big Brother Watch and Others v the United Kingdom and Centrum för Rättvisa v Sweden, the ECtHR ruled that mass data interception systems may only be used when human rights standards are observed, one of which implies establishment of an independent regulatory body. This institution should verify surveillance permits and oblige law enforcement agencies to assess the need for surveillance, specify the object and amount of information collected in each case.

At the same time, the requirement to establish a regulator is present not only in the ECtHR case law. A similar obligation to create an independent oversight agency is directly or indirectly mentioned in two other important documents: the Convention for the Protection of Individuals with Regard

Internet Regulation Index 2022

5

Challenges of Draft Law № 6177

to Automatic Processing of Personal Data (short title —Convention 108 +) and the General Data Protection Regulation (more commonly known as the GDPR). These regulations have been developed by the Council of Europe and the European Union, respectively.

Avoiding or postponing the process of establishing an oversight body in the sphere of personal data protection would violate international standards. Yet, the requirement to create one should not serve as a springboard for the emergence of a hastily created regulator: the powers of this body should be well-thought-out, and the right to data protection should be properly balanced with the right to access information. Therefore, for the balanced assessment of the draft law, it is important to pay attention to the following: the procedure for establishing a regulator; independence of the regulator (in financial, political and administrative dimensions); efficiency of the regulator’s actions (with regard to procedural issues, proportionality of liability for violations, etc.); the risks of abuse of power in political and business interests or inability to balance the right of access to information and data protection.

Let us analyze the advantages and disadvantages of the draft law together with the assessments provided by the 20 experts from civil society and the private sector engaged in the study, as well as the easy ways of closing the gaps in the

legislative initiative without undermining its importance.

Regulator’s independence One of the main requirements set forth by the GDPR for an oversight body in the sphere of personal data is ensuring the independence of this institution. Such independence includes organizational, political, material and financial components. As soon as the draft law is harmonized with the provisions of the EU Regulation in this part, one will be able to state that at least the normative guarantees of the regulator’s independence are in place.

As to the political independence of the National Commission, respective provisions are worded quite clearly. Formally, any form of external influence on the commissioners is prohibited. How is this implemented in more applied norms?

First, members of the National Commission have to comply with the requirements concerning incompatibility of their position with other paid work, except for the usual exemptions such as scientific, teaching and creative activities, coaching and refereeing in spots, and medical practice.

Second, a special procedure for selection, appointment to and dismissal from office for members of the National Commission guarantees their independence from political pressure or appointments “from the top”.

Third, another guarantee of political independence is collective decision-­

Internet Regulation Index 2022

6

Challenges of Draft Law № 6177

making by the body and the special procedural principles regulating its activities.

T h e r e a r e p r o v i s i o n s p ro h i b i t i n g intervention in activities of the National Commission or exercising pressure on it (by state authorities, local self-government bodies, political parties, civil society associations, etc.), as well as using it for party, group or private interests.

Instructions or requirements given to members of the National Commission, unless provided for by law, should not be followed. Furthermore, the draft law sets forth a special procedure for serving a notice of suspicion to members of the National Commission — this can be done only by the Prosecutor General or Deputy Prosecutor General.

Another guarantee of political independence is the procedure for creating the Selection Commission (the body for selecting the National Commission members): two persons are appointed by the parliament, one person by the Verkhovna Rada Commissioner for Human Rights, two more by the Cabinet, and four by civil society associations active in the National Commission’s sphere of activities — for a total of nine members.

At the same time, the National Commission has a right to carry out its activities as soon as five members are appointed, which is a fact that creates certain risks: if, for instance, the civil society sector’s quota is neglected, the Commission will still be considered legitimate and, formally, be able to work.

F i n a l l y, t h e N a t i o n a l C o m m i s s i o n submits an annual report on the status of compliance with the legislation on personal data protection and the legislation on access to public information to the Verkhovna Rada of Ukraine and the Cabinet of Ministers. Such reporting means there is parliamentary oversight of the commission’s activities, enabling legislators to detect gaps in the current regulation of the spheres of the National Commission’s activities.

Organizational independence of the National Commission is ensured, firstly, through the special procedure of its creation. Although membership of the commission is approved by the Cabinet of Ministers, all decisions have to be made in accordance with the principles of impartiality and objectivity, and its activities have to be open and transparent. In order to ensure a comprehensive analysis of each case, the National Commission has a right to address state authorities and local selfgovernment bodies, as well as economic and other entities, asking them to provide explanations concerning alleged violations in the sphere of personal data protection or access to public information.

In addition to this, the commission will be able to receive access to state information, telecommunication and reference systems, registers, data banks, which will enable it to monitor the performance of their duties related to personal data protection and access to public information by other administrators and controllers effectively.

Organizational independence is also

Internet Regulation Index 2022

7

Challenges of Draft Law № 6177

manifested in the prohibition of relations between a member of the Selection Commission and a candidate for the position of the National Commission member that may cause conflict of interest, such as close relatives, friends, colleagues, etc.

However, there is a weird requirement in the procedure for creating the commission, according to which a minimum of three members in the National Commission must be experts in the sphere of personal data protection. At the same time, there is no similar requirement concerning experience in the sphere of access to public information. In this case, all seven members of the newly established body will have competence in the sphere of data protection, and accordingly will work for the maximum protection of personal data, ignoring the standards and interests of information accessibility. Such situation can lead to an imbalance towards privacy and secrecy, and hinder free circulation of information that is relevant for the society, which is an important component of democracy. Yet, there is a positive side to it: independence of each member of the National Commission will be ensured by the fact that, in the event of disagreement, its member can submit a dissenting opinion that will be included in the final decision of the commission.

Organizational independence will be maintained with the help of the disciplinary commission of the National Commission formed for examination of disciplinary cases (which is supposed to encourage the

commissioners to carry out their activities in a responsible and ethical way). The disciplinary body will be formed with the involvement of the Public and Advisory Councils under the National Commission.

However, certain questions arise regarding the Public Council and the procedure for its creation. For example, it is suggested that an oversight body for public control should be created, which will consist of 15 people and will be formed on the basis of an open and transparent competition.

However, there are some problematic points, including the following: a proposal to carry out the competition with the help of a rating based on online voting by citizens. Although the process of such voting is mostly controlled by independent observers and the State Special Communication Service, recently, there was a significant increase in the number of cyber-­attacks on the private and public sectors. Therefore, it is unclear whether it will be possible to ensure independent and fair voting in such online system, and to protect the voting process from organized interference by bots or voting through the use of an organized swing method; entities entitled to nominate candidates will include civil society associations and creative unions working in the sphere of personal data protection and access to public information, with at least three years of active work experience (where active work means minimum two public events per year). Is it difficult to organize two evens on personal data protection

Internet Regulation Index 2022

8

Challenges of Draft Law № 6177

during one year? Not really, because even student organizations can meet this criterion, as well as organizations that do not have any experience or were created declaratively; a civil society association or a creative union nominating a candidate should have authoritative experts in the sphere of personal data protection and/or access to public information. It is not clear who will determine the authoritativeness and using which indicators. Thus, this can create precedents of refusing to register certain entities due to an alleged lack of expertise.

Therefore, the part related to creation of the Public Council and selection of its members needs to be finalized with regard to determining the “eligibility” of candidates nominated by organizations and unions.

The National Commission will receive certain formal guarantees of financial i n d e p e n d e n c e . I n p a r t i c u l a r, t h e commission will be provided with sufficient human and financial resources for performing its tasks, as well as with the ability to manage its funds independently, and to distribute them at its discretion.

Expenses for the National Commission will be included in the State Budget as a separate item, whereas other funding resources, except for the state and international technical assistance projects, will be disallowed in order to prevent outside influence or pressure. However, the language related to “sufficiency” of resources in the draft law is too vague and

requires identification of clear criteria for such “sufficiency”. One should also take into account the budget code provisions that negate this kind of guarantee.

This situation is fully commensurate with the requirements of the GDPR for an oversight body on personal data and its material, technical and financial support.

At the same time, the draft law envisages the use of earmarked state funds. Article 18 reads that expenses have to be directed at covering research on personal data protection and access to public information, campaigns on awareness raising and training within the competence of the National Commission, involvement of experts, specialists and translators for inspections and proceedings. Narrow interpretation of this provision means the body’s spending will be limited significantly, which will have a negative impact on numerous initiatives. It is also important to remember the norms of the Budget Code of Ukraine: Articles 7, 27, 54 refer to the budget balance principle, which de facto negates any guarantees of promised funding as, for instance, it happens regularly with underfunding of the Public Broadcaster.

There is a positive aspect regarding compliance with the transparency principle.

Meetings of the Selection Commission and the National Commission are open to the media and journalists, are broadcasted live, with video- and audio-­recordings preserved afterwards. The only exception is the process of voting in the deliberation room, which is closed to the press and audience.

Internet Regulation Index 2022

9

Challenges of Draft Law № 6177

In addition to this, one of the guarantees preventing abuse by the regulator is the existence of systemic guarantees — an efficient mechanism for appealing against a decision of the National Commission if the applicant disagrees with the adopted decision. The requirement to ensure the right to an effective remedy is enshrined, in particular, in Article 78 of the GDPR: every individual or legal entity can challenge a decision of the oversight body in court.

A similar standard is set forth in Article 8 of Convention 108 +. Moreover, the need for such mechanism has been repeatedly mentioned by the ECtHR in its case law (see Big Brother Watch and Others v the United Kingdom). Article 40 of the draft law directly envisages a possibility of appealing against decisions, action or inaction of the National Commission in court, thus providing appropriate remedies.

Regulator’s Efficiency Regarding the efficiency of the regulator, one should pay attention to such factors as its membership, procedural issues, as well as proportionality aspects. Article 7 of the draft law states that the National Commission is a collective body consisting of seven members, which becomes legitimate after appointment of more than a half of its total membership, i. e. four individuals, based on the results of an open competition. However, the efficiency of the commission’s work will be influenced, in particular, by the provisions of Article 13 of the draft law, according to which a meeting of the National Commission is

valid if at least five members are present at it. Therefore, the current wording of the draft law means that the National Commission, although being legitimate after four of its members are appointed, will not be able to carry out its activities until at least one more member is appointed. This discrepancy should be resolved in order to avoid possible blocking of the work of the National Commission on formal grounds.

Attention should also be paid to the status of inspectors of the National Commission.

In particular, Part 7 Article 46 of the draft law suggests that inspection can be held in the absence of “any special decision of the National Commission or an order on its holding upon presentation of an official ID by inspectors of the National Commission or authorized employees of the National Commission”. However, the status, powers and authority as well as the mechanism of appointment of the above-­mentioned “authorized employees of the National Commission” are not described in the draft law, which is a fact that will not only affect the efficiency of its work, but may also create space for arbitrariness and abuse.

In addition to this, the draft law creates risks for the independence of the National Commission in terms of organization and work of the leadership of the inspection service. For example, the head of the inspection service of the National Commission is appointed by the chair of the National Commission based on the results of an open competition as prescribed in Part 3 Article 16 of the draft law. At the same time, the deputy head of

Internet Regulation Index 2022

10

Challenges of Draft Law № 6177

the inspection service is appointed by the chair of the National Commission from among the inspectors of the National Commission, and he/she may act as the head of the inspection service in his/her absence. Such wording of the document may give rise to the cases where a deputy head can be the actual head of the inspection service, which means the latter is a person who has no need to go through an open competition, which is contrary to the principles of certainty, independence and openness.

Draft Law № 6177 also has a number of positive factors when it comes to procedural aspects and efficiency of the regulator. For instance, Article 4 that describes the forms of activities of the National Commission, its principal tasks, powers and rights envisages that this agency will provide explanations in the sphere of personal data protection and access to public information, which, in turn, will facilitate the development of homogeneous and consistent interpretation of various issues in these areas. To this end, the draft law vests the task to approve standardized conditions for personal data protection in the National Commission.

Another procedural aspect that should be taken into consideration is the conduct of proceedings by the National Commission.

Article 22 of the draft law defines a wide range of possible entities entitled to file a submission to the National Commission concerning a violation of the legislation on personal data protection and access to public information. Based on such submissions, the National Commission

may initiate proceedings. The following entities may file the submissions: 1) individuals, including minors and persons recognized by court as incapable or having limited legal capacity, and legal entities; 2) associations of citizens without the status of a legal entity. The National Commission may also initiate proceedings on its own.

Hence, the draft law provides the National Commission with comprehensive opportunities to respond to violations of the relevant legislation within the scope of its competence. Furthermore, it is interesting that the submissions provided for in Clauses 1 and 2 may also be sent in an electronic form in accordance with Article 23 of the draft law. This is likely to provide a more rapid response to complaints, as it ensures their guaranteed and timely receipt.

The draft law also allows for submission of oral complaints in the cases that require an urgent response.

A positive aspect is also the possibility to combine the cases pending before the National Commission, which is provided for in Article 28 of the document.

According to this provision, the head of the inspection service, as well as the National Commission, can combine proceedings both upon the applicant’s request and upon their own initiative. Such procedure is also possible for three types of cases — those that are initiated following a submission:

Internet Regulation Index 2022

11

Challenges of Draft Law № 6177

1) of one applicant concerning actions (inaction) of the same person;

points, which can lead to abuses and human rights violations.

2) of one applicant concerning various alleged violators;

First, Article 4 and Article 57 of Clause 11 Part 3 oblige the National Commission to approve normative legal documents (NLDs). According to Article 57, “the government entities must get an approval for draft normative legal documents, provisions of which are related to personal data processing and/or access to public information, from the National Commission” according to the procedure established by it. However, this provision needs to be clarified, as its literal meaning may contradict, among other things, the principle of separation of powers enshrined in the Constitution of Ukraine. Given that such actions must be carried out by the Verkhovna Rada of Ukraine within the limits established by the law governing the legislative process, the mandatory approval by the National Commission of draft documents as envisaged by the draft law is illegal. Thus, the National Commission may perform only the function of a so-called expert approval of draft NLDs as one of the components of the legislative process.

3) of different applicants concerning violations allegedly committed by one person.

A possibility to combine cases will allow the National Commission to work more systematically and coherently, as well as to optimize the use of its working time.

The possibility to participate in the proceedings via videoconferencing is provided for in Article 31 of Draft Law № 6177. This possibility is granted to all participants of the proceedings, provided the National Commission has the necessary equipment. Such approach ensures possibility and actual continuity of meetings of the National Commission, as it eliminates the urgent need to reschedule and postpone proceedings because of physical absence of the participants.

Furthermore, this mechanism ensures public health, safety, and compliance with the quarantine restrictions, under the conditions of which we have to exist for the third consecutive year.

Controversial aspects of Draft Law № 6177 In general, the draft law contains a lot of positive rules developed for approximating Ukraine to the European regulation in this sphere. However, of course, the text is not perfect and contains several contradictory

Second, with regard to possible violation of international and national norms, attention should be paid to Article 4 of Clause 24 Part 4 of the draft law, according to which the National Commission has to approve a standardized procedure for video surveillance. This aspect may be problematic, because, according to the draft law, a huge layer of legal regulation, on the basis of which human rights are interfered with or restricted, including the

Internet Regulation Index 2022

12

Challenges of Draft Law № 6177

right to privacy, will be regulated by bylaws without sound underlying Ukrainian legislation. According to the ECtHR, such issues require judicial review to ensure independence, impartiality and due process, as in Stołkowski v. Poland.

Besides, the lack of restrictions and legal regulation of video surveillance in law may lead to violations of general requirements of Article 8 of the Convention. Therefore, in order for this provision not to violate the national law requirements and the ECtHR rules, before its introduction it is necessary to amend the Civil Code or adopt special legislation governing video surveillance.

Third, the draft law grants the National Commission a right to have access to information, telecommunication and reference systems, registers and data banks that contain information with limited access and are administered by state agencies or local self-government bodies; to use state, including government, means of communication, special communication networks and other technical means.

Such proposals could potentially run contrary to the principles of legal certainty and predictability, which, however, can be remedied by providing additional guarantees and safeguards.

Fourth, there are debatable issues related to the timelines set for examination of appeals to the National Commission.

According to Article 23 of the document, complaints can be submitted to the National Commission in writing within six months from the moment of detection of the violation by the applicant, and, in

exceptional conditions, this period may be extended to one year. In addition to this, Article 2 of Part 2 of Draft Law № 6177 envisages non-application of the Law of Ukraine On Citizens’ Appeals to the procedure for examination of appeals by the National Commission, despite the fact that, as can be seen from analysis of the provisions of the draft law, a complaint to this commission is a type of appeal, and requirements for it comply with the general requirements set in the Law of Ukraine On Citizens’ Appeals.

Yet, a number of provisions regarding this matter are too broad and ambiguous, for instance, the language of Article 26 reads that the applicant “failed to explain the reasons for inability to attach the necessary copies of documents to the application”, yet the draft law does not stipulate a procedure for such an explanation.

However, the biggest problem is that by refusing to apply the Law of Ukraine On Citizens’ Appeals in its work, the National Commission takes on the exclusive right to differentiate complaints, statements and appeals, which is the fact that may ultimately violate the applicants’ right to full and comprehensive examination of the issues they address, and deprive them of a number of necessary guarantees.

Fifth, the issue of fines is quite sensitive.

Articles 43 and 44 of the draft law envisage imposing fines for non-implementation of a decision of the National Commission (failure to perform actions required in the decision):

Internet Regulation Index 2022

13

Challenges of Draft Law № 6177

for individuals — from UAH 20,000 to UAH 100,000; for legal entities — from 0.5% to 1% of the annual turnover for the previous year (for instance, for the Meta company, the maximum amount this year would total UAH 23,211,900,000, for the Silpo chain — UAH 644,000,000), but no less than UAH 51,000; each repeated violation entails imposition of a fine totaling 200% of the amount of the previous sanction.

A similar amount of fines was introduced for a refusal of the controlled entity or its officials to provide access for the National Commission to carry out inspection on the grounds not envisaged by law. In this case, the rule of increasing the penalty for repeat violation is not applied. Here, it is interesting to see the correlation of the penalty sanctions with those envisaged in Draft Law № 5628 On Personal Data Protection. It should be reminded here that the gravest violations can cost individuals up to UAH 20 million, whereas legal entities can be forced to pay up to UAH 150 million for the same actions. If the National Commission finds that a company with a Silpo-level income violated the legislation on protection of personal data and failed to implement the commission’s decision, the non-compliance fine will be almost five times higher than the fine for the violation itself.

One can let alone the cases of tech giants such as Meta, YouTube, Twitter, Uber and many other global corporations. Is such an approach proportionate? Hardly

so. Moreover, fines should not lead to bankruptcy of enterprises, which such a system of sanctions makes possible.

The point here is not that the fines themselves can be sky-high — the largest amount of sanctions envisaged by the already mentioned GDPR is more than UAH 640 million. Yet, even when high fines are imposed, the penalty for a failure to eliminate the violation should not be many times — occasionally hundreds of times — higher than the penalty for the violation itself.

Conclusions and recommendations Draft law № 6177 On the National Commission for Protection of Personal Data and Access to Public Information envisages the creation of mechanisms for efficient implementation of national legislation on protection of digital rights, in particular concerning protection of private data and ensuring access to information. The document offers a number of procedural safeguards for the protection of citizens’ rights provided for in the legislation on personal data protection and/or access to public information.

However, despite many positive norms, the d oc u m ent c ontains a nu mber of problematic issues that can be corrected with the help of the following recommendations:

Internet Regulation Index 2022

14

Challenges of Draft Law № 6177

Agree on the amount of sanctions so that the penalty for non-compliance with the decision of the National Commission requiring to eliminate the violation does not impose a burden on the entities that is much greater than the penalty for the violation itself.

Establish clearer criteria for candidates for the position of a member of the Public Council (in particular, define criteria for the authoritativeness of the expert and increase the threshold of the required specialized activities of organizations and unions).

Add a requirement to the draft law, according to which at least three members of the National Commission should be experts in the sphere of access to public information.

Improve organization of work of the leadership of the inspection service to avoid transfer of the actual long-term management function to the deputy head who is appointed outside the competition procedure. Otherwise, requirements for appointment of both the head and the deputy head of the inspection service can be brought into compliance with each other.

Improve the rule for getting an approval from the National Commission for draft normative documents developed by the executive branch, and grant a right to the National Commission to submit comments for non-compliance of the draft normative documents to the Parliament.

Abstain from including the obligation to approve a standardized procedure for video surveillance in the draft law as one of the powers of the National Commission before amending the Civil Code or adopting special legislation.

Envisage additional guarantees and safeguards against possible abuses in the context of access of the National Commission to information, telecommunication and reference systems, registers, data banks, in particular those containing information with limited access.

Provide for a mechanism of appointment, status and powers of “authorized employees of the National Commission”, whose powers and authority are provided for, among other things, in Articles 44 and 46 of the draft law.

Internet Regulation Index 2022

15

Analysis of experts’ responses. Draft Law № 6177

Analysis of experts’ responses.

Draft Law № 6177 On October 18, 2021 a group of members of parliament, including Taras Tarasenko, Yehor Cherniev, Mykhailo Laba and others, registered Draft Law № 6177 On the National Commission for Protection of Personal Data and Access to Public Information at the Verkhovna Rada of Ukraine.

This legislative initiative is the next logical step after inclusion of Draft Law № 5628 On Personal Data Protection from June 7, 2021 in the Ukrainian parliament’s agenda.

Draft Law № 6177 provides for establishment of a new executive body with a special status that will implement international standards in Ukraine in the sphere of protection of the right to access to information and the right to protection of personal data.

The Verkhovna Rada Committee on Human Rights, De-occupation and Reintegration of Temporarily Occupied Territories of Donetsk and Luhansk Oblasts and the Autonomous Republic of Crimea, the City of Sevastopol, National Minorities and International Relations was identified as the leading committee responsible for examination of the draft law.

With the beginning of the full-scale Russian invasion in Ukraine on February 24, 2022 most of the legislative activities of the Ukrainian parliament were reshaped to take the wartime conditions into account, and discussion of draft laws on personal data protection can be expected to take place in peacetime.

Draft Law № 6177 became the fifth normative document analyzed by experts under the Internet Regulation Index from NGO Internews-­U kraine. The first two initiatives (on disinformation and the draft law on media) were studied in 2020. In 2021, two more draft laws were scrutinized –Draft Law № 6177 On Amending the Law of Ukraine on Security Service of Ukraine concerning improvement of the organizational and legal principles of the organization of work of the Security Service of Ukraine (short title — the Draft Law on Security Service) and long-awaited Draft Law № 5628 On Personal Data Protection.

Since the previous analysis of the draft law concerned the legislative initiative on personal data protection, selection of the draft law on the National Commission for Protection of Personal Data under the Internet Regulation Index is a logical continuation of the Ukrainian experts’ effort. Study of this draft law once again draws attention of the public to the protection of digital rights of users, whichis part of the broader context of functioning of free Internet in Ukraine.

Internet Regulation Index 2022

16

The study findings

The study findings The overall score of the potential impact of legislative Initiative No. 6177 on the National Commission for Personal Data Protection and Access to Public Information on the development of cyberspace in Ukraine As part of the research Index of cyberspace regulation from the NGO "Internews-Ukraine" The impact rating scale ranges from -5 to +5

The overall score for legislative initiative № 6177 under the Internet Regulation Index totals at +0.59, representing a consolidated indicator of positive impact on public relations in the online space within the scale from –5 to +5.

This score demonstrates that in the process of expert assessment, 20 respondents from among media lawyers and technical community expressed predominantly positive opinions concerning the key provisions of the draft law that still require certain clarifications and additions.

Draft Law № 6177 received a moderately positive score in the Impact on rights and freedoms section, namely +0.47 points within the scale from –5 to +5. The weight of this block in overall assessment accounts for 35%.

In their extended comments, experts argue that the draft law envisages establishment of a state agency for protection of personal data for the first time. This agency “will have efficient powers to monitor compliance with the legislation on personal data protection and access to public information. It is important that the tasks of such agency will include not only monitoring and prosecuting, but also preparing recommendations, providing explanations in this sphere, and influencing the process of adoption of the legislation that would take into account the requirements for personal data protection and access to public information” (Vita Volodovska) Some experts are also optimistic about the exercising of powers by the new agency and

are convinced that “the draft law contains all necessary guarantees of independence and autonomy of this agency, which is critical for ensuring efficiency and effectiveness of performing its functions” (Olha Kyryliuk) Nonetheless, not all experts share such optimism, and some express concerns about independence of the National Commission: “Unfortunately, the mechanism envisaged by the draft law does not ensure independence of the agency, and it also contains a number of problems in the procedures stipulated by it” (Maksym Shcherbatiuk) The expert specifies the risks of the draft law and connects them to the following shortcomings:

Internet Regulation Index 2022

17

The study findings

the status of the National Commission; the procedure for approval of draft normative legal documents by the National Commission; definition of the status, powers and responsibility of inspectors of the National Commission; the procedure for examination of appeals to the National Commission; issues related to challenging decisions of the National Commission (Maksym Shcherbatiuk) For Ukrainian legislators, the risks of implementing personal data protection initiatives may also be related to the low culture of respect for personal data in society. Citizens are quite skeptical about creation of any new state agencies: “Experience in the sphere of personal data protection shows a lack of culture, and hence predominance of formalism over meaning. Any regulatory threats will be perceived as a risk, and in the spheres where uncertainty exists, a situation can emerge when it is better to hide something and thus avoid headache than to have contacts with inspection services. Establishment of a supervisory agency in Ukraine will definitely be perceived as a threat”. (Ihor Rozkladai) Experts also emphasize the potential risks of the draft law due to the broad powers granted to employees of the new state agency. “Members of the National Commission will have a right to access information, telecommunication and reference systems, registers, data banks, including those containing information

with limited access, that are owned (administered) by the state authorities or local self-government bodies” (Khrystyna Burtnyk) Some experts also mention potential collisions of the draft law with regard to the right to access to public information that is enshrined in the legislation: “The draft law shows a tendency toward greater protection of the right to personal data protection than the right to access to information. Moreover, activities of the National Commission itself will not be transparent. Article 54 of Part 10 of Draft Law № 6177 contains provisions that do not comply with the Law of Ukraine On Access to Public Information, namely: “Information received upon request of the National Commission or collected in the course of proceedings and/or inspection constitutes service information. Such data can be used by the National Commission, ensuring due compliance with the legislation on protection of service information”.

(Tetiana Oleksiiuk) Finally, implementation of the provisions of the draft law in practice will show whether the risks identified by experts will come true: “It is obvious that appearance of the regulator can cause the “something-­ might-go-wrong” chilling effect for some period. With proper functioning, this should cometo a zero. In a negative scenario, this can become an element of pressure”. (Ihor Rozkladai)

Internet Regulation Index 2022

18

The study findings

In the Protection of legitimate public interest section, a consolidated score given by the experts totals at +1.28 points within the scale from –5 to +5, which means a rather positive assessment. The weight of this block in overall assessment accounts for 35%. Such results indicate that the legislative initiative is in line with the urgent needs for protection of public interest in Ukraine.

Experts almost unanimously point out the existence of sufficient grounds for defending the public interest using the proposed draft law, while emphasizing the need for efficient protection of citizens’ personal data: “Currently, Ukraine does not have an effective mechanism for its (personal data — Ed.) protection, and, therefore, it is really necessary to create and launch such mechanism”. (Liudmyla Opryshko) The need to create state institutions guaranteeing protection is also mentioned: “Today, there are no agencies in Ukraine that would be able to respond to violations of the rights to personal data protection and access to public information quickly and efficiently”.

(Vita Volodovska).

The need to create a new state agency is also necessitated by inefficiency of the existing institutions, such as the Office of the Commissioner for Human Rights, to

protect the information rights of citizens: “Experience of applying the laws On Personal Data Protection and On Access to Public Information demonstrates that the capacity of the Human Rights Commissioner is limited, which causes the protection of information rights through the Ombudsperson’s Office to be inefficient”. (Ali Safarov) At the same time, in their assessments, experts expressed reservations about the scope of powers of the new state agency: “This draft law grants extremely broad powers to the National Commission.

An unbalanced mechanism for personal data protection has been created, which can be detrimental to the right to a fair trial and some other human rights”. (Liudmyla Opryshko)

In the section dedicator to impact on the quality of services, the initiative was mostly negatively assessed by the experts — –0.29 points within the scale from –5 to +5. The weight of this block in overall assessment accounts for 20%.

In terms of answers to specific questions, the majority of experts (55%) are convinced that the legislative initiative will not have a direct impact on providing the Internet access services for users.

At the same time, some experts point to the risks posed by the provisions of Draft Law

№ 5628 On Personal Data Protection: “The draft law is, in fact, an instrument for implementation of the requirements of the draft law On Personal Data Protection, which identifies a wide scope of responsibilities for personal data controllers, for example, regarding appointment of special officials.

Internet Regulation Index 2022

19

The study findings

With this in mind, Internet access services may become more expensive”. (Vita Volodovska) Another expert emphasizes the need for additional training costs for operators and providers to understand the provisions of the draft laws: “The legislative initiative will potentially affect the cost of a provided service because the supervisory entities will have to spend additional resources on training their personnel or for paying additional staff responsible for ensuring compliance with the legislation on personal data protection; furthermore, there is a risk of a fine that will also affect the cost of a service”. (Nadiia Shuvar) Most of the experts’ reservations concern the potential impact of the draft law on economic activities of providers — it is primarily about imposing fines on providers: “The draft law introduces a significant fine for a failure to implement decisions of the National Commission, and, moreover, such fines can be imposed on providers several times in a row or even constantly”. (Olha Bolshakova).

Some see risks in the potential pressure on providers because of inspections: “Providers as personal data operators can be inspected by the commission, and this will put an element of pressure on them”.

(Maksym Tuliev)

Experts explain about corruption risks: “The draft law enables the National Commission and its inspectors to carry out inspection lasting up to 180 days, which they can use in their own interests, and extort bribes from entrepreneurs for shortening the period of such inspections and not creating obstacles for business”. (Tetiana Fomina) In the opinion of representatives of the Internet Association of Ukraine (InAU), corruption risks of the draft law can be divided into four major categories. “The biggest corruption risks are: 1) collective decision-­making, since it will be impossible to prosecute for the results of voting; 2) the right of any inspector to initiate inspection without any justification and to demand access to the premises, documents and databases of operators and providers; 3) the right of such inspector to carry out such inspection for 180 days and to repeat it an unlimited number of times in a row; 4) wide discretionary powers of the commission to determine the amount of fines”. (Svitlana Dudnik) At the same time, some experts emphasize that corruption risks concern the work of any state agency, and this is a theoretical assessment: “Corruption risks are inherent for the work of any regulatory body.

Everything will depend on the quality of law application”. (Antonina Cherevko)

At the same time, the issue of corruption risks for providers and operators with the implementation of the provisions of the draft law received most negative assessments: according to 55% of experts, the legislative initiative contains potential corruption risks.

Internet Regulation Index 2022

20

The study findings

The score given by experts to the Legal technique of the legislative initiative on the National Commission is positive: the quality of wording in the draft law received +0.37 points within the scale from Experts did not agree on unambiguous assessment of the quality of legal technique of Draft Law № 6177, and yet, the consolidated assessment is still positive.

Some experts mention the need to finalize provisions of the draft law precisely in terms of the clarity of wording and harmonization of certain provisions of the draft law: “The draft law is quite clearly formulated in general, but certain norms need to be harmonized and clarified. In particular, the relationship and procedure for conducting inspections (Article 46) and “preliminary inspections” (Article 24) is unclear”. (Vita Volodovska) “The text needs significant revision.

Individual norms of Draft Law № 6177 require synchronization of the terms used in them, and certain procedures should be worked out in detail and clearly described in the law”.

(Tetiana Oleksiiuk) Experts also point out that some provisions of the draft law can be interpreted differently: «Most provisions of the draft law are clearly formulated and are flexible to apply.

However, some of them can be interpreted differently. For instance, Article 25 of Part 4 of the draft law states that “the decision to initiate proceedings is not subject to appeal”.

However, the point is that it is impossible to appeal to the National Commission. The complainant still has the right to challenge the decision in court (Article 40 of the Draft Law)”.

(Khrystyna Burtnyk)

Experts also mention potential problems regarding the funding of the commission due to a lack of clear criteria for such funding in the state budget: “A serious shortcoming is the absence of a clearly specified level/ percentage of funding for the National Commission from the state budget. It can end up just like the Public Broadcaster — chronically underfunded. It is also somewhat unusual that specific sanctions are provided for directly in the text of the draft law”.

(Antonina Cherevko) In the Legal technique section, rather negative assessment of the experts (45% responses) was given because of the contradictions present in the text of the legislative initiative with the applicable national legislation.

“The automatic restriction of access to information received upon the request of the National Commission or collected within the framework of proceedings and/or inspection proposed in the draft law runs contrary to the procedure envisaged by the Law of Ukraine On Access to Public Information”. (Maksym Shcherbatiuk) “The name of the commission used in this draft law and in the draft law On Personal Data Protection needs to be unified: the former mention an exercising state oversight agency for adherence to the legislation on personal data protection and/or access to public information while the former — the agency responsible for oversight and control of compliance with the requirements of specific law”. (Alina Pravdychenko)

Internet Regulation Index 2022

21

Detailed description of findings of the study of Draft Law № 6177

Detailed description of findings of the study of Draft Law № 6177 Block 1. Impact on Rights and Freedoms (+0.47) In the first block, 20 experts were asked to answer 14 questions to evaluate the impact of the initiative on citizens’ rights and freedoms.

Experts’ assessment of the potential impact of Draft Law № 6177 on the National Commission on public legal relations in the online space was mostly positive — a consolidated score for this block totals at +0.47.

Draft bill No. 6177 1.1. What potential impact does this legislative initiative have on the freedom to receive, disseminate and process information, in particular cross-border data?

20% (4)

Positive impact negative impact

10% (2)

70% (14)

no impact

Draft bill No. 6177 1.3. What potential impact does this legislative initiative have on privacy?

5% (1) 5% (1)

positive impact negative impact no impact

90% (18)

The total number of expert evaluations is 20

In Question 1.3 concerning potential impact of the legislative initiative on privacy, experts almost unanimously mentioned positive impacts: 90% of respondents (18 experts) gave positive assessment (from +1 to +5).

One expert gave negative assessment, and another one mentioned the impact of the initiative on privacy issues was absent.

The total number of expert evaluations is 20

Answering Question 1.1 concerning impact of the draft law on freedom to receive, share and process information, including across national borders, 70% of respondents (14 experts) assessed the impact positively (from +1 to +5), 20% (4 experts) — negatively, whereas 10% (2 experts) said impact was absent.

Internet Regulation Index 2022

22

Detailed description of findings of the study of Draft Law № 6177

Draft bill No. 6177 1.5. What is the potential impact of this legislative initiative on freedom of expression?

20% (4)

Positive impact negative impact

30% (6)

no impact

50% (10)

The total number of expert evaluations is 20

In Question 1.5 concerning potential impact of the draft law on freedom of expression, half of the experts (50%) mentioned the impact was absent. At the same time, 30% of respondents (6 experts) assessed it negatively (from –1 to –5), while 20% of respondents (4 experts) are convinced that the impact is positive (from +1 to +5).

1.8. What is the impact of legislative Innovations on the ability of media outlets expressing opinions on issues of public interest?

20% (4)

positive impact negative impact no impact

45% (9)

80% of respondents (16 experts) speak about a neutral impact of the initiative on responsibility of the media for publications.

At the same time, 15% of respondents (3 experts) say the impact is negative, and one — that the impact is positive.

75% of respondents (15 experts) are convinced there is no impact of the initiative in terms of establishing new responsibilities for the media such as verification of sources, corroboration of information, etc. Other 15% of respondents (3 experts) mentioned a negative impact, whereas 10% said the impact is positive.

1.12. Can this legislative initiative lead to direct or indirect discrimination?

Draft bill No. 6177

35% (7)

1.9. Does the initiative establish a special responsibility for the media for publications?

The total number of expert evaluations is 20

1.8. What is the impact of legislative innovations on the possibility of media to express opinions on issues of public interest?

45% of respondents (9 experts) are convinced that the legislative initiative has no impact on this issue, whereas the other 35% (7 experts) believe the impact is positive, and 20% (4 experts) say the impact is negative.

80% of respondents (16 experts) pointed out that the initiative does not have any impact on the spread of discrimination, other 15% (3 experts) said that the initiative will facilitate prevention of or combating discrimination, while one respondent made a negative comment.

1.14. Does the legislative initiative impose restrictions or requirements on activities of state bodies on the Internet?

6 5 % o f re s p o n d e n t s (13 exper ts) mentioned a zero impact potential (score 0). 25% of respondents (5 experts) said the initiative sets forth positive requirements / restrictions.

Internet Regulation Index 2022

23

Detailed description of findings of the study of Draft Law № 6177

Block 2. Protection of legitimate public interest (+1.28) In this block of questions, experts were asked to answer 10 questions assessing the impact of the initiative on the protection of public interest.

Draft bill No. 6177

2.4. Is the proposed method of protecting such interest proportionate, and does it meet its purpose? positive impact

25% (4)

Draft bill No. 6177

negative impact no impact

5% (1)

of legitimate public interest?

5% (1)

70% (14)

positive impact

10% (2) 10% (2)

75% (15)

negative impact no impact

The total number of expert evaluations is 20

2.1. Does this regulatory initiative affect the protection of legitimate public interest?

75% (15 respondents) gave positive assessment — the initiative is aimed at protecting legitimate public interest, 25% (5 respondents) said the impact is negative.

2.3. To which extent is it urgent and necessary to protect such legitimate public interest in this temporal, historical and geopolitical context?

85% of respondents (17 experts) expressed a positive opinion as to the need to protect public interest, one respondent expressed a negative opinion, and two were neutral.

The total number of expert evaluations is 20

2.4. Is the proposed method of protecting such interest proportionate, and does it meet its purpose?

70% of respondents (14 experts) expressed a positive opinion, while 25% (5 experts), on the contrary, spoke negatively about the draft’s proportionality and ability to meet the purpose of protection of public interest.

Another respondent gavea neutral response.

Draft bill No. 6177

information security on the Internet?

5% (1) positive impact

20% (4)

negative impact no impact

75% (15)

The total number of expert evaluations is 20

2.7. Does the legislative initiative affect information security on the Internet?

7 5 % o f re s p o n d e n t s (15 exp er ts) mentioned positive impact, while 20% (4 experts) referred to a neutral impact of the initiative on information security on the Internet. Another respondent said the impact was negative.

Internet Regulation Index 2022

24

Detailed description of findings of the study of Draft Law № 6177

2.8. Does the legislative initiative protect users from hate speech?

95% of respondents (19 experts) said there is no impact, while 5% (1 expert) said the impact of the initiative in terms of protection from hate speech is positive.

2.10. Does the legislative innovation impose restrictions/changes concerning promotion of inaccurate or manipulative information?

55% of respondents (15 experts) said the impact is absent, while 25% (5 experts) spoke about a positive impact of the initiative in terms of restricting promotion of inaccurate or manipulative information.

Block 3. Impact on quality and/or cost of provision of services (-0.29) In this block of questions, exper ts were asked to answer seven questions concerning impact of the initiative on activities of Internet providers and intermediaries.

3.1. Does this legislative initiative have the potential to influence provision of the Internet access services?

55% of respondents (11 experts) said that the initiative has no impact on the provision of Internet access services (score 0). Whereas 35% (7 experts) spoke about a negative impact, the other 10% (2 experts) provided positive responses.

Draft bill No. 6177

3.3. Does this legislative initiative have an economic impact on providers (in terms of

20% (4)

positive impact negative impact

25% (5) 55% (11)

no impact The total number of expert evaluations is 20

3.3. Does this legislative initiative have an economic impact on providers (in terms of taxation, fines for possible violations, etc.)?

55% of respondents (11 experts) provided negative assessment of the impact, while 25% of respondents (5 experts) spoke neutrally (no impact). The other 20% (4 experts) provided positive assessment of the initiative.

3.4. Does this legislative initiative impose restrictions / changes on the creation of certain resources, platforms, use of services from certain providers?

The absolute majority or 80% of respondents (16 experts) mentioned that the initiative will have no impact in terms of restrictions for creation of new resources or use of services from providers (score 0), and 15% of respondents (3 experts) spoke negatively.

3.5. Does the legislative initiative envisage liability for technical platforms, providers, etc. for violations of the legislation governing online space?

Internet Regulation Index 2022

25

Detailed description of findings of the study of Draft Law № 6177

60% of respondents (12 experts) said there is no liability for violation of the norm envisaged by the initiative (score 0). Other 25% of respondents (5 experts) mentioned a positive impact (from +1 to +5), meaning that the initiative envisaged the necessary and proportionate liability, while 15% of respondents (3 experts) pointed out to the negative impact — excessive and unjustified liability.

3.6. Does the legislative initiative identify a mandatory period, during which technical platforms are required to respond to certain content?

80% o f resp o n d e n ts (16 exper ts) mentioned that the legislative initiative does not regulate this aspect, 15% said the impact was positive: the initiative identifies a reasonable (sufficient) period for responding. Another respondent said the impact is negative since the initiative sets a too short or an excessively long period for responding.

3.7. Does the legislative initiative contain corruption risks, which will have a negative impact on the work of providers?

55% of respondents (11 experts) said the initiative contains corruption risks for providers (impact assessment from –1 to –5). At the same time, 25% of respondents (5 experts) maintained that such risks are absent. Other 15% (3 experts) said that, on the contrary, the initiative will facilitate overcoming corruption risks. One respondent said it was difficult to answer.

Block 4. Legal technique or quality of the legal text (+0.37) In this block, the experts were asked to answer three questions to assess the quality of preparation of the initiative.

Draft bill No. 6177 4.1. Is the text of the regulatory initiative worded clearly and unambiguously?

40% (8)

60% (12)

positive impact negative impact The total number of expert evaluations is 20

4.1. Is the text of the regulatory initiative worded clearly and unambiguously?

60% of respondents (12 experts) gave a positive answer (+1 to +5): in experts’ opinion, the text of the initiative is worded in a clear and understandable way. At the same time, 40% of respondents (8 experts) gave negative assessment to the draft law in terms of the clearness and unambiguity of its language.

Internet Regulation Index 2022

26

Detailed description of findings of the study of Draft Law № 6177

4.2. Does the text meet the legal certainty requirements?

55% of respondents (11 experts) gave a positive answer, which means that the text of the initiative meets the legal certainty requirements. At the same time, 40% of respondents (8 experts) gave opposite answers, and assessed the text negatively with regard to the legal certainty requirements. One respondent provided neutral assessment.

4.3. Does the text contain contradictions to the current regulation (national legislation)?

45% of respondents (9 experts) gave n e g a t i ve a n s w e r s , w h i c h re fe r to contradictions of the initiative to the applicable legislation in their assessment.

25% of respondents (5 experts) gave positive assessment. The other 25% (5 experts) provided neutral assessment, and one respondent said it was difficult to answer.

Internet Regulation Index 2022

Figures in the study of Draft Law № 6177

27

Figures in the study of Draft Law № 6177 Assessment summary of the potential impact of draft bill No. 6177 on the development of cyberspace in Ukraine Block 1 Impact on rights and freedoms

Block 3 Impact on quality and/or cost of provision of services

Block 2 Protection of legitimate public interest

Block 4 Legal technique or quality of this draft bill

In Block 1 Impact on rights and freedoms, consolidated experts’ assessment totals at +0.47 points within the scale from –5 to +5. The weight of this block in overall assessment accounts for 35%.

Draft bill No. 6177 on the National Commission for Personal Data Protection and Access to Public Information As part of the research Index of cyberspace regulation from the NGO "Internews-Ukraine" The impact rating scale ranges from ‑5 to +5

The total score of Draft Law № 6177 under the Internet Regulation Index is +0.59, being a consolidated indicator of positive impact on public relations in the online space within the scale from –5 to +5.

In Block 2 Protection of legitimate public interest, consolidated experts’ assessment totals at +1.28 points within the scale from –5 to +5. The weight of this block in overall assessment accounts for 35%.

In Block 3 Impact on quality and/or cost of provision of services, consolidated experts’ assessment totals at –0.29 points within the scale from –5 to +5. The weight of this block in overall assessment accounts for 20%.

In Block 4 Legal technique or quality of the legal text, consolidated experts’ assessment totals at +0.37 points within the scale from –5 to +5. The weight of this block in overall assessment accounts for 10%.

Internet Regulation Index 2022

28

Internet Regulation Index: What’s new in the study’s methodology

Internet Regulation Index: What’s new in the study’s methodology Work on the new study began with creation of a project working group and development of the study methodology.

After consultations with the expert community from the public and private sectors, the expert group approved the project methodology. Having developed a list of criteria for selection of experts in the form of Terms of Reference (TOR), the project team selected media lawyers and representatives of the technical community who had experience of working with the legislation for analysis of the proposed draft laws.

At the same time, during the implementation of the study, based on feedback from experts, the project working group always made minor updates to the methodology, especially with regard to clarifying the questions in the questionnaire.

Requirements for selection of study experts Thorough professional experience in the field of development, evaluation and / or legal analysis of draft regulations; At least three years of work experience in the media or IT industry; Higher education in the law sphere (preferably with specialization in media law and/or IT) or (for representatives of the IT community) relevant higher education and thorough experience in

evaluating or engagement in drafting normative legal documents; Absence of a conflict of interest related to implementation of the project.

Engaged experts were asked to study the text of the analyzed draft law and, on the basis of the study of details of the draft law, to evaluate it by answering 34 substantive questions in the questionnaire, access to which was provided for each expert.

Structure of the questionnaire The questionnaire consists of 34 substantive questions divided into four blocks according to the topic of questions: Block 1. Impact on rights and freedoms (14 questions); Block 2: Protection of legitimate interest (10 questions); Block 3. Impact on the quality of service provided (7 questions); Block 4. Legal technique (3 questions).

Certain “weight” was assigned to each block in overall assessment of the Index: two blocks — 35% each (Impact on rights and freedoms and Protection of legitimate interest), the third block — 20% (Impact on quality of service provided), and the fourth block — 10% (Legal technique).

Internet Regulation Index 2022

29

Internet Regulation Index: What’s new in the study’s methodology

Logic of the questionnaire The division of the questionnaire into four main blocks corresponds to the classical structure of SWOT-analysis (strengths, weaknesses, opportunities, and threats).

The names and content of the two main blocks are directly related to the classic three-part test for verifying the legitimacy of restrictions imposed on rights and freedoms. Any proposed restriction of rights and freedoms has to: 1) be prescribed by law; 2) pursue a legitimate aim (that is to protect a specified legitimate interest such as national security, territorial integrity, public order, reputation and rights of other persons, public health and morality, prevention of crime or ensuring respect for justice); and 3) be necessary in a democratic society.

The questionnaire pays special attention to Points 2 and 3. The first block specifies whether the respective regulator initiative has any impact on rights and freedoms, and, if so, then which exactly, and in which way. In the second block, the questions are aimed at determining whether the regulatory initiative is designed to protect any of the legitimate public interests, and, if so, whether the proposed restrictions can be considered necessary in a democratic society. The third block of questions is aimed at helping to assess various aspects of potential impact of the regulatory initiative on provision of the Internet access service: quality, cost, corruption risks, etc.

The last, fourth section of the questionnaire is devoted to legal technique, i. e. quality of the text of the regulatory initiative, which, as you know, also affects the quality of further implementation of such initiative in the event of its adoption.

Most of the questions seek to assess the impact on public relations — negative or positive; the impact is assessed using the following scales: positive — from +1 to +5 and negative — from –1 to –5.

There is an option of a neutral answer, i. e. no influence — 0. Every respondent can indicate “Difficult to answer”. Scores from +1 to +5 mean the impact of the initiative on public relations is positive, while scores from –1 to –5 mean the impact is negative.

For each question, an expert is additionally asked to justify the provided response in an extended comment.

Novelties in the methodology In 2021, the project team updated the methodology based on feedback from experts who participated in the first two studies. The update covered only minor aspects of the methodology, in particular: all questions with scores were harmonized to a scale ranging from –5 to +5; the option “Not able to answer” was replaced with “Difficult to answer” in all questions; several questions were rephrased as general or clarifying without using the scale from –5 to +5. In particular, these were questions 1.11, 1.13, 2.1, 2.5, 2.9.

Internet Regulation Index 2022

30

Internet Regulation Index: What’s new in the study’s methodology

How the draft laws were analyzed Experts received a link with access to the text of the legislative initiative being studied. To make sure that the experts invited actually took part in the study, the questionnaire contained two questions for identification of the experts. The time limit for completing the study questionnaire for each expert was at least 15 days. Access to the questionnaire was provided through https://www.questionpro.com/.

Individual answers of the exper ts were not disclosed to the public, and, correspondingly, the study results were presented in a summary form. The project team received consent from the experts to disclose their names and surnames in the form of a general list as participants of the study.

In order to determine the findings of the study, the project team conducted qualitative and quantitative analyzes.

The qualitative analysis was based on expert comments, and taken the analytics for evaluation of legislative initiative into account. The quantitative analysis involved calculating the scores given by the experts, followed by determining the arithmetic mean for points given in each block. The Index for a specific legislative initiative was calculated using the following mathematical formula:

x=

x1f12+ x f23+ x f3n+ ... + x fn = f12+ f + f3n+ ... + f

where x is the value, and f is the weight.

In the study, the value of x corresponds to the arithmetic mean of each of the blocks, while the value of f corresponds to the weight of the block as percentage. The Index outcome is a numerical indicator ranging from –5 to +5 as measurement of the impact of the initiative on public relations. If this indicator is negative, the initiative is defined as such that, according to the results of the study, generally threatens the development of free Internet in Ukraine and has a negative effect on public relations in the online space. If this indicator is positive, the initiative is defined as one that generally promotes the development of free Internet in Ukraine and has a positive impact on development of public relations in the online space.

Internet Regulation Index 2022

31

Revised contents of the questionnaire

Revised contents of the questionnaire 1. Impact on rights and freedoms — 35% 1.1. What is the potential impact of this legislative initiative on the freedom to receive, share and process information, including across national borders?

No impact— 0.

Negative impact— assess the impact potential from –1 to –5 Positive impact — assess the impact potential from +1 to +5 Difficult to answer Explain your assessment.

1.2. What is the potential impact of this legislative initiative on access to foreign sources, sites, specific content?

Positive impact — assess the impact potential from +1 to +5 Negative impact— assess the impact potential from -1 to -5 No impact — 0 Difficult to answer Explain your assessment.

1.3. What is the potential impact of this legislative initiative on privacy? (Do legislative innovations affect the right of users to protection of private and family life, protection of honor and dignity? Do legislative innovations affect the right to protection of personal data? Are there any additional grounds established for their processing or transferring personal data?)

Positive impact — assess the impact potential from +1 to +5 Negative impact — assess the impact potential from -1 to -5 No impact — 0 Difficult to answer Explain your assessment.

1.4. What is the potential impact of this legislative initiative on freedom of assembly?

Positive impact — assess the impact potential from +1 to +5 Negative impact— assess the impact potential from -1 to -5 No impact — 0 Difficult to answer Explain your assessment.

Regulation Index 2022 Internet Internet Regulation Index 2022

32

Revised contents of the questionnaire

1.5. What is the potential impact of this legislative initiative on freedom of expression?

(Do legislative innovations envisage criteria or grounds for deleting certain content?

Do legislative innovations impose restrictions on freedom of expression for a certain period (restrictions on political advertising during the election period, state of emergency, etc.)?

Positive impact — assess the impact potential from +1 to +5 Negative impact — assess the impact potential from -1 to -5 No impact — 0 Difficult to answer Explain your assessment.

1.6. What is the potential impact of this legislative initiative on any other fundamental human rights and freedoms?

Positive impact — assess the impact potential from +1 to +5 Negative impact — assess the impact potential from -1 to -5 No impact — 0 Difficult to answer Explain your assessment.

1.7. What is the potential impact of this legislative initiative on freedom of media?

(In particular, restrictions on the right to distribute content, its forms, distribution procedures, etc.)

Positive impact — assess the impact potential from +1 to +5 Negative impact — assess the impact potential from -1 to -5 No impact — 0 Difficult to answer Explain your assessment.

1.8. What is the impact of legislative innovations on the media’s ability to express opinions on issues of public interest*? * Public interest concerns issues that affect the life of the public to the extent that it may have a legitimate interest in them (such as citizens’ wellbeing or community life).

Positive impact — assess the impact potential from +1 to +5 Negative impact — assess the impact potential from -1 to -5 No impact — 0 Difficult to answer Explain your assessment.

InternetRegulation RegulationIndex Index2022 2022 Internet

33

Revised contents of the questionnaire

1.9. Does the legislative initiative envisage special responsibility for the media to publish posts, news, messages, articles, etc. online (including responsibility for comments under publications)?

Positive changes are envisaged — assess the impact potential from +1 to +5 Negative changes are envisaged — assess the impact potential from -1 to -5 Not envisaged — 0 Difficult to answer Explain your assessment.

1.10. Do the legislative innovations envisage new responsibilities for the media (such as verification of sources, corroboration of information, a link to the original source of publication, etc.)?

Positive changes are envisaged — assess the impact potential from +1 to +5 Negative changes are envisaged — assess the impact potential from -1 to -5 Not envisaged — 0 Difficult to answer Explain your assessment.

1.11. In general, what can its impact on rights and freedoms be?

Positive Negative Difficult to answer Explain your assessment.

1.12. Does this initiative contribute to prevention and/or combating of direct or direct discrimination on any grounds?

The initiative will facilitate preventing and/or combating discrimination — assess possible positive impact from +1 to +5 The initiative will facilitate discrimination — assess possible negative impact from -1 to -5 The initiative will have no impact on discrimination — 0 Difficult to answer Explain your assessment.

Internet InternetRegulation RegulationIndex Index2022 2022

34

Revised contents of the questionnaire

1.13. Does this legislative initiative take into account the interests of vulnerable groups?

Yes, it does No, it does not Difficult to answer Explain your assessment.

1.14. Does the legislative initiative impose restrictions or requirements on activities of state bodies on the Internet (as to the subjects of such activities in the context of maintaining their own websites, disclosure of information, etc.)?

Positive requirements / restrictions are imposed — assess the impact potential from +1 to +5 Negative requirements / restrictions are imposed — assess the impact potential from -1 to -5 Not envisaged — 0 Difficult to answer Explain your assessment.

2. Protection of legitimate public interest — 35% 2.1. Does this regulatory initiative affect the protection of legitimate public interest (legitimate public interest includes national security, territorial integrity, protection of public order, trust in justice, protection of the rights of others)?

Yes, positive impact No, negative impact Difficult to answer 2.2. If you answered “yes” or “no” to the previous question, evaluate the impact of the initiative on one or more of the following areas. Scores from +1 to +5 mean the initiative will facilitate protection of the respective public interest. Scores from -1 to -5 mean the initiative will be detrimental to the respective public interest. No impact — 0.

National security Territorial integrity Protection of public order Trust in justice Protection of the rights of others Explain your assessment.

Internet InternetRegulation RegulationIndex Index2022 2022

35

Revised contents of the questionnaire

2.3. To which extent is it urgent and necessary to protect such legitimate public interest in this temporal, historical and geopolitical context?

Yes, it is urgent and/or necessary (assess the level of urgency from +1 to +5) No, it is not urgent and/or necessary (assess the level of urgency from -1 to -5) Difficult to answer Explain your assessment.

2.4. Is the proposed method of protecting such interest proportionate, and does it meet its purpose?

Yes, it is proportional (positive assessment) — assess from +1 to +5 No, it is not proportionate (negative assessment) — assess from -1 to -5 Difficult to answer Explain your assessment.

2.5. Is it possible to achieve the same level of protection of the legitimate public interest in another, less restrictive way?

Yes, it is possible No, it cannot be achieved Difficult to answer Explain your assessment.

2.6. If you answered “yes” to Question 2.5., select the option(s), through which the same level of protection of the legitimate public interest can be achieved in another way.

Self-regulation Co-regulation Education Introduction or narrower restrictions Other (specify) Explain your assessment.

2.7. Does the legislative initiative affect information security on the Internet?

Positive impact — assess the impact potential from +1 to +5 Negative impact — assess the impact potential from -1 to -5 No impact — 0 Difficult to answer Explain your assessment.

Internet InternetRegulation RegulationIndex Index2022 2022

36

Revised contents of the questionnaire

2.8. Does the legislative initiative protect users from hate speech (given the context of the publication, its nature and language, as well as the possibility of adverse effects)?

Yes, the initiative contains mechanisms of combating hate speech (positive assessment) assess from +1 to +5 No, the initiative, on the contrary, can facilitate the spread of hate speech (negative assessment) assess from -1 to -5 The initiative is neutral with regard to hate speech — 0 Difficult to answer Explain your assessment.

2.9. Does the legislative initiative regulate protection against bots (criteria for their definition and the possibility of limiting their impact)?

Yes, it regulates protection against bots No, it does not regulate protection against bots Difficult to answer.

Explain your assessment.

2.10. Does the legislative innovation impose restrictions/changes concerning promotion of inaccurate or manipulative information?

Positive changes are envisaged — assess the impact potential from +1 to +5 Negative changes are envisaged — assess the impact potential from -1 to -5 Not envisaged — 0 Difficult to answer Explain your assessment.

Internet InternetRegulation RegulationIndex Index2022 2022

37

Revised contents of the questionnaire

3. Impact on quality and/or cost of provision of services — 20% 3.1. Does this legislative initiative have the potential to influence provision of the Internet access services?

Yes, it has positive impact potential — assess from +1 to +5 Yes, it has negative impact potential — assess from -1 to -5 No, it does not — 0 Difficult to answer Explain your assessment.

3.2. If in the question above you assessed the positive / negative potential of the impact, choose what will be affected by the initiative: cost, quality or other characteristics of a respective service? You can choose from several options.

Increase / decrease of the service price Increase / decrease of the quality of Internet connection Increase / decrease of the cost of laying cable networks or ground stations The suppliers’ / consumers’ need to upgrade or purchase new equipment (underline what applies) Strengthening control over the user’s behavior (loss of a possibility to remain anonymous) Explain your assessment.

3.3. Does this legislative initiative have an economic impact on providers (in terms of taxation, fines for possible violations, etc.)?

It has positive impact — assess from +1 to +5 It has negative impact — assess from -1 to -5 It has no impact — 0 Difficult to answer Explain your assessment.

3.4. Does this legislative initiative impose restrictions / changes on creation of certain resources, platforms, use of services of certain providers?

It envisages positive changes — assess the impact potential from +1 to +5 It envisages negative changes — assess the impact potential from -1 to -5 Not envisaged — 0 Difficult to answer Explain your assessment.

Internet InternetRegulation RegulationIndex Index2022 2022

38

Revised contents of the questionnaire

3.5. Does the legislative initiative envisage liability for technical platforms, providers, etc. for violations of the legislation governing online space?

It envisages necessary and proportionate liability — assess from +1 to +5 It envisages excessive and unjustified liability — assess from -1 to -5 No, it does not envisage any liability — 0 Difficult to answer Explain your assessment.

3.6. Does the legislative initiative identify a mandatory period, during which technical platforms are required to respond to certain content (delete / block, etc.)?

It identifies a reasonable (sufficient) period for responding — assess from +1 to +5 It identifies a too short or too long period for response — assess from -1 to -5 Not identified — 0 Difficult to answer Explain your assessment.

3.7. Does the legislative initiative contain corruption risks, which will have a negative impact on the work of providers?

Yes, the initiative contains corruption risks — assess from -1 to -5 No, on the contrary, the initiative will facilitate overcoming corruption risks — assess from +1 to +5 The initiative is neutral with regard to corruption risks — 0 Difficult to answer Explain your assessment.

Internet InternetRegulation RegulationIndex Index2022 2022

39

Revised contents of the questionnaire

4. Legal technique or quality of legal text — 10% 4.1. Is the text of the regulatory initiative worded clearly and unambiguously?

Yes, the text is clear — assess from +1 to +5 No, the text is not clear — assess from -1 to -5 Difficult to answer Explain your assessment.

4.2. Does the text meet the legal certainty requirements?

Yes, it does— assess from +1 to +5 No, it does not — assess from -1 to -5 Difficult to answer Explain your assessment.

4.3. Does the text contain contradictions to the current regulation (national legislation)?

Yes, it does — assess from -1 to -5 No, it does not — assess from +1 to +5 Difficult to answer Explain your assessment.

Internet InternetRegulation RegulationIndex Index2022 2022

40

Conclusions and recommendations of the study of Draft Law № 6177

Conclusions and recommendations of the study of Draft Law № 6177 For Ukraine, the creation of an oversight body in the sphere of personal data protection is a logical continuation of the legislators’ work on Draft Law № 5628 On Personal Data Protection. Creation of a regulator in Ukraine is also in line with international standards of personal data protection. At the same time, when creating the National Commission, it should be ensured that powers and authority are wellthought-out, and the right to data protection is properly balanced with the right to access the information.

A lot of provisions of the draft law that form the basis for functioning of the new state body on personal data protection are acceptable and well written. However, some of these provisions should be finalized (see below). According to the results of the study of Draft Law № 6177 under the Internet Regulation Index, a consolidated score is positive and totals at +0.59 within the expert assessment scale from –5 to +5.

Correspondingly, possible adoption of Draft Law № 6177 On the National Commission for Protection of Personal Data and Access to Public Information in the wording from October 18, 2021 will facilitate the development of free Internet in Ukraine and have a positive impact on legal public relations in the online space. Advantages of the draft law and recommendations for improving its provisions are described in more detail below:

Implementation of efficient mechanism of personal data protection in Ukraine is one of the most important aspects of protection of digital rights of the Ukrainian Internet users.

Creation of the National Commission for Protection of Personal Data and Access to Public Information is an important step for Ukraine towards harmonization of the national legislation with the norms of international law, since a requirement to establish a regulatory body is present not only in the text of Draft Law № 5628 On Personal Data Protection, but also in international law, including the ECtHR conclusions on the national legislation concerning the need to establish a regulatory authority that will deal with the personal data issues.

Exercise by the National Commission of its powers and authority will enable it to respond to violations of the legislation on personal data protection effectively and bring the violators to justice.

An extremely important part of powers and authority of the National Commission will be not just imposing sanctions on violators, but also developing recommendations on ensuring personal data protection, providing explanations in the sphere of personal data protection to the entities entitled to these rights, as well as influencing the adoption of legislation that would take the requirements for personal data protection and access to public information into account.

Internet Regulation Index 2022

41

Conclusions and recommendations of the study of Draft Law № 6177

Norms of the draft law envisage guarantees of independence and autonomy of the commission, which is crucial for ensuring effective and efficient performance of the functions vested in it. At the same time, availability of safeguards for independence and autonomy of this agency depends on sufficient funding of the National Commission from the budget.

Recommendations: Take into account the context of free Internet functioning in Ukraine and avoid imposing insufficiently justified and/or excessive sanctions on operators and providers of Internet access services.

Shorten the duration of inspections of operators and providers of Internet access services by inspectors from 180 to 30 days, and prohibit repeating such inspections for an unlimited number of times.

Agree on the sum of the sanctions so that the penalty for non-compliance with the decision of the National Commission requiring to eliminate a violation does not impose a burden on the entities that is much greater than the penalty for the violation itself.

Specify a clearly defined level / percentage of funding for the National Commission to be allocated from the state budget of Ukraine in the text of the draft law.

Envisage additional guarantees and safeguards against possible abuses in the context of access of the

National Commission to information, telecommunication and reference systems, registers, data banks, in particular those containing information with limited access.

Establish clearer criteria for candidates for the position of a member of the Public Council (in particular, define criteria for the authoritativeness of an expert and increase the threshold of the required specialized activities of organizations and unions).

Add a requirement to the draft law, according to which at least three members of the National Commission should be experts in the sphere of access to public information.

Improve organization of work of the leadership of the inspection service to avoid transfer of actual long-term management function to the deputy head, who is appointed outside the competition procedure. Otherwise, similar requirements can be envisaged for appointment of both the head and the deputy head of the inspection service.

Provide for a mechanism of appointment, status and powers of “authorized employees of the National Commission” whose powers and authority are provided for, among other things, in Articles 44 and 46 of the draft law.

Improve the rule for getting an approval from the National Commission for draft normative legal documents (NLDs) developed by executive authorities, and grant a right to the National Commission to submit comments to the Parliament for non-compliance of NLDs with the

Internet Regulation Index 2022

42

applicable legislation on personal data and access to information; Agree on the terms used in different parts of the draft law.

Abstain from including the obligation to approve a standardized procedure for video surveillance as one of the powers of the National Commission in the draft law before amending the Civil Code or adopting special legislation.

Internet Regulation Index 2022

43

Experts involved in the study of Draft Law № 6177

Experts involved in the study of Draft Law № 6177 Olha Bolshakova National Media Association, lawyer

Tetiana Oleksiiuk attorney-at-law

Khrystyna Burtnyk DEJURE Foundation CSO, lawyer

Liudmyla Opryshko Human Rights Platform CSO, lawyer

Vita Volodovska Digital Security Laboratory, head, lawyer

Alina Pravdychenko media lawyer

Maksym Dvorovyi Digital Security Laboratory, lawyer

Ihor Rozkladai CEDEM, lawyer

Svitlana Dudnyk Internet Association of Ukraine, lawyer

Ali Safarov Institute of Mass Information CSO, lawyer

Olha Zolotar State Research Institution Institute of Information, Security and Law of the National Academy of Legal Sciences of Ukraine, lawyer

Maksym Tuliev Net Assist, Internet Association of Ukraine

Yuliia Kazdobina Ukrainian Foundation for Security Studies, head Olha Kyryliuk SEEDIG, head, international lawyer Oksana Maksymeniuk Regional Press Development Institute CSO, lawyer

Tetiana Fomina National Media Association, lawyer Antonina Cherevko Media expert, lawyer Nadiia Shuvar CEDEM, lawyer Maksym Shcherbatiuk UHHRU, Program Director

Pavlo Moisieiev lawyer

Internet Regulation Index 2022