At the request of the police, banks will disclose banking secrets and personal data of clients

At the request of the police, banks will disclose banking secrets and personal data of clients

In Ukraine, the rules for banks’ responses to police inquiries regarding possible funds misappropriations will be changed.

Soon, the Verkhovna Rada will consider in the second reading the bill 11043, which aims to improve the functions of the National Bank in the area of state regulation of financial services.

Several new provisions were added for the second reading of the bill.

Article 62 of the Law "On Banks and Banking Activities" will include a new ground for banks to disclose information that constitutes banking secrecy regarding legal and physical entities. In particular, banks will be required to provide this information to the National Police of Ukraine in cases and to the extent determined by Article 31 of the Law "On Payment Services".

Article 31 of this law will be supplemented with a new part 7, according to which, if a payment service provider receives a written (electronic) request from the National Police body implementing state policy in the field of combating cybercrime regarding a completed payment transaction that contains signs of a criminal offense stipulated by Articles 185, 190-192, 200, 361, 361-2, 362-363 of the Criminal Code of Ukraine, it must provide information within the shortest possible time (but no later than 24 hours after receiving the request) about:

1) the amount and currency of the payment transaction;

2) the date of the payment transaction;

3) the type of the payment transaction;

4) geospatial data, IP address, address of the remote communication means (including payment application) or the payment device used to execute the payment transaction (if available), and if the payment transaction is conducted through a cash desk - the address of the cash desk (if available);

5) identification data of the recipient: for an individual - last name, first name, and patronymic (if available), taxpayer identification number; for a legal entity - full name, identification code according to the Unified State Register of Enterprises and Organizations of Ukraine;

6) full name of the payment service provider;

7) unique identifier of the recipient and/or full number of the electronic payment instrument and/or recipient’s account number;

8) name and code of the acquirer (if available);

9) identifier of the payment device (if available);

10) code identifying the transaction in the payment system (if available);

11) unique identifier of the payer and/or full number of the electronic payment instrument and/or payer’s account number.

The main legal department of the parliament notes that this involves an extremely large volume of information without clear grounds for sending such requests.

"It is also unclear how a payment service provider will determine whether the transaction contains signs of a criminal offense," they added in the department.

According to experts, such an approach in the legislation does not take into account the requirements of the second part of Article 32 of the Constitution (regarding the protection of confidential information about a person) and does not meet the quality criteria of the law in the context of the requirements of this same article of the Constitution.

The text of the submitted bill does not contain provisions that would link the restriction on citizens’ rights protected by the Constitution of Ukraine to national security interests, economic well-being, and human rights.

"Introducing the dissemination of ’information about all owned property (assets) and liabilities of individuals’, which is confidential information, without the consent of the data owners, is unreasonable, disproportionate, and does not meet the requirements of Article 3 of the Constitution of Ukraine," the department believes.

The approach to determining which payment services provided by mobile operators will be considered limited is also being changed.