First request of Ukrainian authorities to Google to disclose personal data
According to Google's Report on Services and Data Accessibility1 for H2 2013 it is for the first time when Ukrainian authorities officially requested Google to disclose confidential information relating to its user. There is no information which exactly Ukrainian authority approached Google with such request, but there is information that Google rejected to disclose the requested information.
Supreme Court of Ukraine rules in favor of data subject
In April 2014 the Supreme Court of Ukraine (the "Supreme Court") satisfied the claim of one individual and found illegal the refusal of the housing and utility body to issue living space availability certificate because such individual did not give a written consent to process personal data by such housing and utility body. The Supreme Court pointed out that the individual's request complies with requirements of personal data protection laws with respect to access to his personal data processed by the housing and utility body.
Although the Supreme Court sent the dispute for repetitive consideration by the court of the first instance, the court ruling may have already implications for further implementation of personal data laws. In particular, the following conclusions can be made:
- An individual cannot be restricted in access to his / her personal data if such data are processed by another person.
- Refusal of an individual to give his / her consent to process his / her personal data as required by current data protection laws is a bad reason for data controller to refuse from granting access to personal data of such person he already processes. Oral consent given before effective date of the Personal Data Protection Law should suffice.
- Even applying for the issue of a document of the established form containing personal data may be considered by the courts as requesting access to personal data.
The Highest Court says content of the consent prevails over its form
The Highest Commercial Court of Ukraine (the "Court") recently met the claim of private entrepreneur who wanted to get access to personal files of his employee that was kept by the relevant state employment centre. By way of background, although the private entrepreneur provided a written application from the employee that he does not mind access to his data, the state employment centre refused from granting access to personal file of the employee. The reason for the refusal is that the requested information (i) is qualified as confidential and (ii) the employee's consent was not notarized.
Satisfying the claim the Court stressed that (i) non-notarized application of the employee to get access to his information should be sufficient to get access to his / her personal data and (ii) the employee's application should be understood as consent to get access to his / her personal data.
Though the ruling relates to the dispute that arose before effective date of the Personal Data Protection Law, this ruling may positively effect on requesting personal data from Ukrainian authorities according to current data protection laws.
Footnote
1 http://www.google.com/transparencyreport/userdatarequests/UA/
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.