Among omnipresent economic troubles and protracted anti-terrorist operation, registering the Bill 2504a in the Parliament on August, 13, has been largely unnoticed by Ukrainian citizens. However, it seems that this yet-to-come regulation might affect their lives more significantly than the mentioned difficulties. To say the least, extensive data about the citizens will be combined and regularly updated in a unified information registry.
Setting the stage
The official name of the document is ‘Regarding unified state registry of citizens bound to military service’. This concise 10-page read is mostly devoted to basic information about the registry, bodies responsible for managing it, as well as data types and their collection. First of all, main justification for creating the database is twofold: recruitment of citizens that are obliged to serve in the army and support of retired military servicemen. It is quite significant that the registration is obligatory and the data about a person is expected to be full. Coming to responsible bodies, Headquarters of Armed Forces of Ukraine is declared an owner of the registry, whereas daily administration and managing are under responsibility of local military commissariats. Up till this point in the document, the registry seems to be an acceptable idea.
On the next page, it is not anymore. The full list of personal data about citizens aged 18 to 60 in the registry includes:
- Name, surname and father’s name;
- Date and place of birth;
- Place of registration and place of residence;
- General data about parents;
- Passport details;
- Information about death or being missing;
- Information about legal capacity;
- Employment data (company, position);
- Tax number;
- Digital image of face;
- Criminal record;
- Dates of leaving and returning to Ukraine;
- Education level and specialization.
The list of citizen rights and obligations is quite succinct in comparison to this data: requesting information from the registry, applying to change incorrect information, and being obliged to provide correct information. Actually, the last obligation might be not required, because the database will be initially formed by merging all existing data about the citizens from several state bodies: electoral, migration, education and science agencies, etc. As a little sweetener, the state takes responsibility for protecting and keeping the registry updated.
2504a belongs to a kind of documents that make one open their eyes wide after reading. Many aspects of this Bill are raising concerns. To begin with, though the document mentions state bodies that administrate and access the registry, it does not mention that other governmental offices are prohibited to use this registry. It seems that the databases of many state offices, especially those pooling their data for this one, will become irrelevant and obsolete. Then, an access policy is required in the document, or the statement that such access is prohibited and other agencies continue relying on their own registries. To a large extent, it remains unclear whether this database will be (mis)used by other state agencies and how they will be penalised in case of misuse.
Coming to the second point, extensive mandatory data collection is suggested by the state, with no control over use of their data being granted to the citizens. In this regard, one should take into account that the trust of Ukrainians to their state has remained stably low since 2005. It is vital to provide citizens with some means of controlling the actions of their officials when creating a unified registry. Among good practices, Estonian information system keeps logs of all data accesses, the citizens can see these logs, and they also have a right to sue governmental employees in case the data was accessed without a legitimate reason. However, many countries are still not ready to adopt Estonian experience because of privacy concerns in the society. In case of Ukraine, having a right to request the information from the registry is hardly enough to gain citizen trust.
Another problem is that the law has no date of expiry. It seems that the registry is here to stay, whereas its relevance is largely justified by the anti-terrorist operation in the eastern regions. Probably, it would be appropriate to destroy this database after the operation is finished, but nothing in the Bill suggests that this will be the case. Meanwhile, the data provides patterns of personal life. For instance, travelling and residence records allow to continuously track a citizen. Nothing else comes to mind, but notorious US Patriot Act in terms of granting authorities unprecedented possibilities to surveil a person.
Finally, if coming closer to European standards still matters to Ukraine, such law would clearly fail the test of Articles 7 and 8 of Charter of Fundamental Rights of the European Union. These articles protect personal life from state interference and guarantee that personal data is processed under clearly specified conditions. Particularly, officials are required to sufficiently justify their actions and abstain from using intrusive means to reach their goals. Can the same military needs be satisfied with existing databases? Is it necessary to create a unified registry? Will having this database be proportional to the aim after the finish of anti-terrorist operation? These questions remain as rhetorical as the one whether this law would bring Ukraine closer to the EU.
By and large, the Bill 2504a is dictated by a militarised situation in the country. Under existing conditions, the state is willing to strictly regulate military service. However, creating a unified registry will have long-term consequences that go beyond the current situation and mark the beginning of mass surveillance. With no clear restrictions and misuse penalties for governmental bodies, no possibilities for citizens to check how their information is used and to protect their rights, no time limitations for extensive data collection, and, if it is still important, no proportionality to the aim if such registry were to be created in the EU, the Bill is published on the Parliament website. The explanation note to the document mentions that ‘the draft law does not require public discussion’. Or does it?