In connection with the Draft Law on Personal Data Protection prepared by the Ministry of Justice, the Commissioner for Information of Public Importance and Personal Data Protection said that although the Action Plan for Chapter 23 passed within the framework of negotiations with the EU sets out that the Draft Law must be compliant with the Model Law prepared and made available to the Ministry of Justice and the Government by the Commissioner more than a year ago, this had obviously not been done so.
The Commissioner said that the Draft Law ignored the majority of problems observed in practice and if it was adopted as the law, not only would it make no contribution to improvement of the situation in the field of personal data protection, but could instead become the source of additional problems.
In his opinion submitted to the Ministry of Justice, the Commissioner listed numerous already well-known problems which are not addressed by the Draft Law.
For example, although lack of regulation of the so-called special forms of personal data processing (video surveillance, biometrics, processing of unique personal identification numbers on the Internet, use of personal identification documents, direct advertising etc.) has emerged particular reasons for concern in practice so far, the Draft Law still leaves them unregulated, envisaging that some of them "will be" regulated by some kind of special laws, while majority of them are not even mentioned. Each of them is very frequently used form of data processing which in absence of the single and consistent legal regulation results in unjustified, widely present invasion of privacy.
The draft Law still envisages that consent for data processing can be given only in writing and not by confirmatory actions (de facto actions), while giving consent by confirmatory actions proved to be necessary for modern living conditions and for the use of information technologies in communication.
The Draft Law delays passing of the Regulation on Protection of Particularly Sensitive Data for one year, while the Government should have passed it six and a half years ago.
The Draft Law regulates transborder transfer of data in such a manner that it is virtually free, without any control or approval. Specifying of some kind of duty to inform the Commissioner after transborder transfer of data has been made actually just makes an illusion of the existence of certain "protection", because it is quite clear that after data have been taken out of the country, the Commissioner can do virtually nothing to protect them.
The Draft Law ignores the need to improve knowledge of persons responsible for personal data handling and envisages no formal education duty. Since we every day face drastic examples of ignorance of responsible persons, which also result in very serious violations of human rights, this is beyond belief and gives rise to great concerns.
