No one will be able to approach you with a camera on the street if you object: pranks, streams, and TikTok videos will be controlled

A photo from a private celebration unexpectedly appeared on the internet, a mobile operator stores information about calls, and online services accumulate data about users' locations, purchases, and preferences. Most Ukrainians leave a digital footprint daily, but they do not always know who accesses this information and how it is used.

Against this background, Ukraine is preparing a large-scale update of personal data protection legislation, which aims to bring national rules closer to European standards and give citizens more opportunities to control their own information.

The bill No. 8153 "On Personal Data Protection," registered in the Verkhovna Rada in 2022, is under consideration. It has already passed the first reading in parliament and is now being prepared for the second reading. The bill aims to comprehensively update the rules for processing personal data in Ukraine and harmonize them with EU requirements. It proposes new approaches to privacy protection on the internet, the use of biometric data, video surveillance, electronic communications, and handling citizens' personal information.

Current legislation in this area no longer meets the modern challenges of the digital age. Since the last update, approaches to data processing have significantly changed, with the growing role of social networks, online services, e-commerce, and big data technologies.

Especially relevant are platforms like TikTok, where street surveys, pranks, live streams, and other content involving random passersby have become popular. Such formats increasingly raise questions about a person's consent to filming and the subsequent distribution of their image online.

What rules regarding photo and video shooting apply today

Despite discussions about the new bill, photo and video shooting are already regulated by Ukrainian law.

Article 307 of the Civil Code of Ukraine stipulates that a natural person can be photographed or filmed only with their consent.

The law does not establish a special form for such consent. It can be written or oral. Also allowed is so-called tacit consent—when a person sees they are being photographed or filmed, is aware of it, and does not object.

At the same time, consent to filming does not always mean consent to further distribution of photos or videos.

Photos and other works depicting a person can be publicly shown, reproduced, or distributed only with their consent. If a person believes that a photo or video was published without permission and violates their rights, they can demand the removal of such materials and file a lawsuit for compensation for material or moral damage.

What parents need to know about photos of children

Ukrainian legislation currently does not contain special provisions separately regulating the use of children's photographs.

However, the general principle of privacy protection applies. If filming is conducted outside a public place, consent for a minor or underage child must be given by their parents or legal representatives.

If parents object to filming the child, it must be stopped.

Moreover, even after giving consent, parents can demand the cessation of public display of photos or videos related to the child's private life.

An exception remains filming in public places—on streets, during meetings, conferences, rallies, and other public events.

Why there is a need for a new law

The explanatory note to the bill states that the current Law "On Personal Data Protection" is based on a 1995 European directive, which has since expired and been replaced by the EU General Data Protection Regulation (GDPR).

The authors emphasize that Ukrainian legislation does not cover many modern issues arising in practice. In particular, it concerns the processing of personal data on the Internet, joint data processing by several companies, data transfer to contractors, use of data in digital services and social networks.

Additionally, Ukraine has undertaken international obligations to harmonize legislation with EU law and Council of Europe standards in privacy protection.

The explanatory note also points out that the absence of modern rules may complicate international information exchange, cooperation with European partners, and the development of the digital economy.

What new rights Ukrainians will receive

One of the main goals of the bill is to expand individuals' ability to control their personal data.

The document provides the right to access one's data, the right to demand correction of inaccurate information, the right to object to data processing, the right to restrict its use, and the right to compensation in case of human rights violations.

Among new protection tools, the right to be forgotten is specifically provided, which has long been in effect in EU countries. It allows demanding the deletion of personal data in cases defined by law.

The bill also introduces the right to data portability, enabling the transfer of information between different services, as well as the right to protection from automated decision-making.

What will change regarding consent to data processing

The authors propose significantly detailing the requirements for consent to personal data processing.

The explanatory note states that new rules should make the procedure more transparent and prevent situations where a person does not actually understand what they are agreeing to.

It is expected that a person must be properly informed about what data is collected, for what purpose it is used, to whom it may be transferred, and how long it will be stored.

As known, according to Article 307 of the Civil Code, a person can be photographed or filmed only with their consent. However, the same article states that consent is presumed if filming is conducted openly on the street, at meetings, conferences, rallies, and other public events.

Generally, established practice does not prohibit filming in public places and filming public figures performing their official duties.

At the same time, bill 8153 presents the legislation on handling personal data collected in public places and regarding public figures differently.

Specifically, Article 11 of the draft "Processing of personal data as a result of audio, video, or photo recording of public events" defines the rules for filming public events as follows.

When audio recording, video filming, cinematography, photography, or any other fixation of the image or voice of a personal data subject is carried out openly on the street or at public events (public meetings, conferences, etc.), the controller must take sufficient measures in advance to inform the personal data subjects about the recording and its purpose in a way that allows the subject to object to the processing of their personal data.

Publication, including public display of video, cinematographic, or photographic materials where personal data subjects can be identified, is allowed only if the publication is proportional to the legitimate aim pursued, consistent with the original purpose of the recording, respects the essence of the right to personal data protection, and provides appropriate safeguards for the fundamental rights and interests of the personal data subject.

Thus, to conduct filming, as follows from the draft text, persons who may appear in video or photos must be notified in a way that gives them the opportunity to object.

Interestingly, Article 15, which provides specifics for processing personal data for journalistic or creative purposes, does not exempt from the notification rules established in Article 11.

"The processing of personal data for journalistic and creative activities is not subject to the provisions of paragraph 1 of part one of Article 4 regarding the principles of fairness and transparency, paragraphs 4 and 6 of part one of Article 4, Articles 18-27, Article 34, Articles 36-40 of this Law," the article states.

In other words, journalists must also comply with the regulation established by Article 11 and notify about filming public events in advance, if this norm is read literally.

Video surveillance and video recording will be regulated for the first time

One of the most notable innovations will be separate regulation of personal data processing during video surveillance and video recording of public events.

The bill also contains provisions on processing personal data on the Internet, using information for direct marketing, and working with biometric data.

In particular, it proposes updating the approach to biometric data. These will include personal data related to physical, physiological, or behavioral characteristics of a person that allow their identification. For example, a digital facial image, electronic signature, or fingerprints.

New rules for mobile operators and internet providers

Significant changes will also affect the field of electronic communications.

The bill provides that operators and providers of electronic communication services must notify users about network security risks no later than 48 hours after becoming aware of such risks.

The document also details guarantees of the secrecy of private communication. Protection will cover not only the content of messages and conversations but also traffic data, user location information, and data about connection establishment or termination.

Any eavesdropping, recording, storing, or transmitting information about private communication without the consent of its participants will be prohibited unless otherwise explicitly provided by law.

Personal data breaches must be reported within 72 hours

The bill introduces a new system for responding to personal data breaches.

In case of a data security breach, the controller must notify the supervisory authority no later than 72 hours after detection.

The authors believe this will allow faster response to unauthorized access to personal information and minimize consequences for citizens.

Special data protection officers will appear in government bodies

A separate innovation will be the mandatory appointment of officials responsible for personal data protection.

They will monitor compliance with legislation, conduct internal audits, organize employee training, and interact with supervisory authorities.

Liability for violations may be increased

The bill provides a new system of financial liability for violations of personal data protection legislation.

According to the explanatory note, sanctions should be effective, proportionate, and deterrent. When determining fines, the nature of the violation, its duration, consequences, and measures taken to eliminate harm will be considered.

Thus, bill No. 8153 is designed not only to fulfill Ukraine's European integration commitments but also to significantly change approaches to privacy protection. If adopted, citizens will gain more opportunities to control the use of their data, and companies and government bodies will have more obligations to protect it.

Subscribe to our Telegram channel t.me/sudua and to Google News SUD.UA, as well as to our VIBER and WhatsApp, Facebook page Facebook and Instagram Instagram to stay updated on the most important events.