At the end of February, seven MPs Vyacheslav Medyanyk, Maksym Buzhanskyi, Maksym Pavlyuk, Serhiy Kuzminykh, Oleksandr Bakumov, Serhiy Shvets, Volodymyr Zakharchenko. from the “Servant of the People” party registered draft law No 11031 in the Verkhovna Rada, which proposes to introduce a “unified system for video monitoring of public security” in Ukraine. The document is included in the agenda of the 12th session of the IX convocation of the Parliament.
In this analysis, the Agency for Legislative Initiatives examines the draft law and why its adoption in the current version will not improve the security situation in the country, but rather create additional obstacles to public safety.
Why is this being discussed?
According to the text of the draft law, its goal is to enhance public and state security, introduce a single centralised video surveillance system that will operate at different levels and integrate all existing systems currently in use.
The MPs believe that this will bring Ukraine’s video surveillance systems up to the standards of the United States, the United Kingdom, or the EU countries. This is how they justify the need to adopt the document, as the current state of video surveillance systems does not meet the requirements of law enforcement in ensuring public and national security.
At the beginning of this year, the government announced that it would start working on the introduction of video surveillance systems. After the document was included in the parliamentary agenda, the leadership of the Ministry of Internal Affairs held a meeting with members of the relevant parliamentary committee to discuss the need to pass the draft law.
However, despite the obvious need to improve public safety in Ukraine, several issues may arise during this process. They relate to the advanced video surveillance system itself, the potential violation of citizens’ rights, and its ability to withstand cyber threats, especially given instances of using Russian or Chinese software.
Another concern is the unclear wording of the draft law and the motivation behind its adoption, as the objectives and methods for achieving them are outlined only in general terms.
Should we fear the prospects of the state sliding towards authoritarianism, or should we be concerned about the security of our personal data, and why is the proposed document unlikely to be a solution to the problem? Let’s delve deeper.
What does the draft law propose?
The draft law provides for the development of unified functional and technical standards for the system, with their approval delegated to the Cabinet of Ministers of Ukraine. At the same time, at the request of the security and defence forces, the placement of video surveillance systems may be restricted either temporarily or permanently.
The MoIA will own the system, which is proposed to be divided into central, regional/local, and departmental levels, all designed to interact with each other.
The draft law stipulates that cameras will be installed in all public places, will be able to record sound and process the data using AI technologies.
The proposed new system will have access to data from state registers In particular: the Unified State Demographic Registe, the Unified Information and Analytical Migration Process Management System, National System of Biometric Verification and Identification of Ukrainian Citizens, Foreigners and Stateless Persons, Unified State Register of Vehicles, the State Register of Taxpayers. , and it is thanks to AI processing that the Ministry of Internal Affairs will have a large amount of information about citizens, including name, gender, place and date of birth, as well as place of residence (stay) and digitised image of the person’s face, tax data, etc. At the same time, the MPs do not explain how the “digitised face” came to be at the disposal of the state. Although the Ministry itself denies the risks of “total surveillance”.
The draft law proposes to grant citizens the right to access the information stored in the system, but without the ability to request its removal. Article 13 of the draft law also stipulates that collected information may be retained for 15 years, but the same article grants the MoIA the authority to set different data retention periods.
Article 12 of the draft law also refers to Convention 108+ Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data is a framework document that defines the general principles of processing, storing and exchanging personal data. for the protection of personal data, but there is no specifics on how this process will be implemented. Notably, Ukraine has ratified only the original text of the Convention and not its subsequent amendments.
In the explanatory note, the parliamentarians specifically claim that the new law could improve national and state security, yet they do not provide a clear explanation of how video surveillance systems will contribute to achieving this objective.
The text of the draft law does not provide more specific details of all these processes, limiting itself at this stage to general wording. Similarly, the document does not clearly explain how the adoption of the law could affect security in the context of Russian aggression. Let’s examine the issues with Draft Law No 11031.
Why isn’t everything as good as it seems?
Despite the stated intentions to technologically improve and elevate security standards in Ukraine, strengthen the ability of law enforcement and special services to investigate or even prevent crimes, and bring Ukrainian legislation closer to the EU standards, this is not entirely true.
To address this, attention should be given to some of the main documents regulating the collection and processing of personal data and AI systems in the EU. First of all, these include the General Data Protection Regulation (GDPR) and the Artificial Intelligence Act adopted by the European Parliament.
The purpose of the GDPR is to protect the personal data of EU citizens and to establish rules and regulations by which organisations and institutions must collect and protect personal data.
Its key provisions include the minimization of data collection and processing, a clearly defined and limited data retention period, a specifically stated purpose for processing, and the ability for individuals to correct and delete information collected during observation. This is in stark contrast to what is proposed in Draft Law No 11031.
The VRU Committee on Digital Transformation, for example, pointed out that the text of the draft law refers to the compliance with GDPR standards, but the regulation itself However, Ukraine's implementation of the GDPR is ongoing, with draft law No. 8153 on personal data protection registered in Parliament. has not yet been implemented by Ukraine. It also highlighted the absence of any description in the text of the purpose for storing, processing and deleting the data obtained.
Meanwhile, the Artificial Intelligence Act is the world’s first comprehensive law Which applies to the territory of EU member states. regulating AI, aimed at minimising risks associated with its use. Its primary goal is to regulate AI technology based on its potential risks. One key provision of the Act, which is absent in the Ukrainian draft law, is the prohibition on the use of AI for the collection and processing of personal data.
The Parliament’s European Integration Committee added that although the draft law falls within Article 15 of the Agreement provides that the parties will work to improve the protection of personal data. the scope of the EU-Ukraine Association Agreement, the document currently does not meet several criteria and contradicts the objectives of the agreement and the European integration process. The biggest risks are associated with the process of personal identification: from the use of AI technologies to the collection of biometric data.
In its opinion, the Main Scientific and Expert Department of the Parliament also highlighted the risks of excessive state interference in the video surveillance system, and described conceptual inaccuracies in the legislative initiative.
In some cases, the legislators fail to provide clear definitions for the terminology used in the document, or terms that are entirely absent from related legislation. There are also no explanations of how the system should be implemented, what infrastructure should be involved, and what costs will be incurred by the state budget.
Conclusions
The need to improve the security monitoring system in Ukraine, especially against the backdrop of Russian aggression, is a pressing issue that requires resolution.
However, excessive data accumulation, unclear objectives and methods of implementing the draft law will open the way to unnecessary interference by law enforcement agencies in the lives of citizens. The proposed draft law may not solve the problems as intended, but only further provoke several legislative conflicts and push Ukraine away from the declared technological and legal standards of the EU.
Overall, the current version of the draft law requires revision to provide clear justification for its adoption, define which practical steps should be taken, and demonstrate whether it will indeed improve the security situation.
