The provisions of Part IV of the Civil Code, which regulates the protection of personal information, are divided into several logical blocks:
- Articles 990–1000 contain general provisions on “personal rights”, which include the right of an individual to privacy;
- Articles 1032 and 1033 prohibit activities that infringe on an individual’s right to privacy; this includes espionage, unauthorized extraction of information, photographing and video recording of body parts or personal space, or sending messages without the express consent of the person concerned;
- Articles 1034–1039 regulate the processing of personal information.
Individuals have the right to use legal remedies to prevent violations of their personal rights or to obtain compensation if a violation has occurred. The Civil Code does not directly provide for cases of violation of personal rights, but Part IV contains recommendations on classifying as such cases activities prohibited under Articles 1032 and 1033, and the processing of personal information in violation of the provisions of Articles 1034 – 1039. An exception is information journalism in the public interest, but only to the extent that the use of the full name and other personal information of an individual is a justified measure.
“Personal information” means information recorded in electronic or other form that allows for the identification of a specific individual on an autonomous basis or in combination with other information, including full name, date of birth, identity document number, biometric information, address, telephone number, email address, health information and location. Key provisions on the processing of personal information include:
- the need to carry out the processing of personal information, which must be lawful, reasonable, necessary and must not be excessive;
- the possibility of processing personal information only with the express consent of an individual or in accordance with the requirements of the law, while Article 1036 provides that reasonable processing of personal information is also allowed if: (a) an individual voluntarily discloses his or her personal information and does not expressly object to the processing; or (b) the information is processed for the purposes of protecting public interests or the legitimate rights and interests of an individual;
- the existence of the right of individuals to access the personal information held by the data controller about them and the right to correct the information if it is inaccurate;
- the existence of the right of individuals to require the data controller to delete the information if the data processing is carried out in violation of the law or the agreement between the parties;
- the obligation of data controllers to take the necessary technical and other measures to ensure the security of the personal information they hold; and the obligation of data controllers to take timely compensatory measures in the event of a data security breach and to report the breach to the affected individuals and the relevant competent authority.
Most of these provisions are familiar to international players who comply with the EU General Data Protection Regulation or other privacy laws. As noted above, the relevant data protection provisions included in the Civil Code duplicate the provisions contained in the Decision on Strengthening the Protection of Network Information, the Cybersecurity Law and the Law on the Protection of Consumer Rights and Interests.
- The Decision on Strengthening the Protection of Network Information is limited to the protection of personal information provided in electronic form, while the Civil Code applies to all forms of personal data;
- The Cybersecurity Act applies only to network operators, while the Civil Code applies to all enterprises that process personal information, regardless of whether they manage computer networks; and
- The Consumer Protection Act protects the rights of consumers of goods and services, while the provisions of the Civil Code apply to all individuals.
The Civil Code explains that an individual has the right to apply to the court in order to prevent an actual or potential violation of his or her right to privacy and to receive compensation for damage incurred in connection with this (including moral damage). The court may also issue an order regarding the publication of an apology or other public statement. In the event of the death of the person whose relevant rights were violated, members of his or her family may apply to the court with a claim.
Purposes of data processing:
- Personal data is used for the following purposes:
- Processing requests and providing services;
- Improving the quality of our service;
- Informing about news and promotions;
- Conducting surveysand research;
- Communicating with you on issues related to your request.