Personal data in criminal proceedings: where is the line between permissible and impermissible interference?

Protection of personal data in criminal proceedings – between constitutional guarantees and practical risks. This topic was the focus of a round table held on 19 June 2025 by the Personal Data Protection and Right to Access Information Section of the UNBA Human Rights Committee.

Participants in the event — advocates, academics, representatives of law enforcement agencies, the Ombudsman, and experts — discussed key issues related to the processing of sensitive information in the pre-trial investigation process and attempted to develop ways to address them. The event was moderated by Committee members Oksana Polotnyanko and Kateryna Kalachenko.

Challenges of the digital age

Criminal proceedings are increasingly faced with the question of how to ensure effective investigations without violating basic human rights to privacy. In the digital age, personal data has become one of the most vulnerable objects of legal protection, and this is particularly evident in criminal proceedings. Confidential information is at risk during investigative actions, temporary access, use of databases, or technical means of recording. At the same time, Ukrainian legislation still lacks clear mechanisms for controlling the processing of personal data, and preventive measures are weak or not applied in practice.

Special attention was paid to draft law No. 8153, which aims to update the rules for processing personal data in line with European standards. The speakers emphasized that the imbalance between the interests of the investigation and the right to privacy is deepening precisely because of the underdevelopment of procedures and the lack of personalized responsibility. Therefore, O. Polotnyanko expressed her hope that the participants of the event would not only draw the attention of the professional community to the problem, but also develop specific recommendations for legislative and practical changes.

Confidentiality without responsibility

Hanna Kolesnik, the chairman of the UNBA Committee on Human Rights Protection, drew attention to the fact that confidential information in criminal proceedings is often disclosed to a wide range of persons without sufficient legal restrictions and without any responsibility for its further disclosure. Of particular concern is the access of third parties to case files: for example, when witnesses or owners of seized property are familiarized with the contents of digital media containing not only evidence of a crime but also private data of other people—relatives, partners, persons living with the suspects.

The speaker noted that modern mobile devices and laptops store a significant amount of personal information, including photographs, correspondence, and personal notes, and often its content is completely unrelated to the subject of the proceedings. However, this information becomes available to all participants in the process, which creates serious risks of violating the right to privacy. At the same time, there are no legal mechanisms to prevent disclosure to third parties (e.g., experts) in such cases.

H. Kolesnik emphasized the need for a clear distinction between evidence in the case and materials containing personal data but having no probative value. According to her, criminal proceedings should not be a basis for total intrusion into personal space, and the legislation should be supplemented with appropriate prohibitions, warnings, and liability for breaches of confidentiality.

When data processing violates the Constitution

In her speech, O. Polotnyanko focused on the conflict between the provisions of the Constitution and the practice of pre-trial investigation bodies. According to her, criminal proceedings are often accompanied by the disclosure of information about a person's personal and family life without proper legal grounds. Of particular concern are situations where the processing of personal data of third parties takes place without their consent and without clear justification, contrary to the requirements of Articles 31 and 32 of the Constitution.

The speaker stressed that personal data may only be processed in cases expressly provided for by law, in accordance with the principle of proportionality of interference. Otherwise, this constitutes a violation of the right to privacy. She also drew attention to the provisions of the Law on the Protection of Personal Data, which give individuals the right to demand the cessation of unlawful processing, correction or deletion of data, and to appeal to the courts in the event of inaction by the controller.

However, the problem is compounded by the fact that even when there is a court decision authorizing interference, the limits of permissible processing are often not defined. Furthermore, references to national security or economic well-being are not always justified, especially when it comes to data not related to the crime itself. In this context, criticism has been raised about excessive data collection during searches, in particular from devices belonging not only to suspects but also to other persons living with or in contact with them.

The military aspect: the Ombudsman's view

Oleksandr Marchenko, the head of the Department for consideration of appeals and Interaction with personal data processors of the secretariat of the Ukrainian Parliament Commissioner for Human Rights, outlined the Commissioner's view of the problem. He emphasized that in a state of martial law, the protection of personal data is of critical importance, as it concerns not only privacy, but also the safety, health, and even the lives of citizens. This applies to data about victims or witnesses in criminal proceedings, the disclosure of which could create additional threats.

At the same time, the Ombudsman's representative noted that there are not many complaints related to personal data in the context of criminal proceedings. This is probably due to the fact that such cases are often classified as crimes under the Criminal Code, in particular regarding the disclosure of pre-trial investigation data.

Therefore, they are usually forwarded to law enforcement agencies for appropriate response. Among the priorities of the Secretariat, O. Marchenko named educational activities aimed at preventing violations and raising awareness. The institution's website has published a number of relevant recommendations, including on restrictions on rights during martial law. The representative of the Commissioner also expressed interest in proposals from the professional community that could be taken into account when developing further initiatives.

Third parties: between the law and invisibility

The issue of processing personal data of third parties in criminal proceedings was highlighted by K. Kalachenko and Pavlo Makarenko, the head of the State service for special communications and information protection, member of the UNBA Committee. They drew attention to the fact that the current procedural legislation hardly uses the concept of a «third party», although it is precisely these subjects who most often find themselves at risk, without adequate guarantees. These include relatives of suspects, owners of property subject to search, persons whose correspondence or images are contained in digital media, or those who are simply mentioned in information processed during the investigation.

Due to the lack of procedural status, such persons have virtually no means of protection, even when it comes to highly sensitive information. The Law on Personal Data Protection defines a third party, but this definition does not provide for an adequate procedural response in criminal proceedings. The main sources of risk here are pre-trial investigation materials, which are accessible to other participants in the proceedings, as well as leaks due to imperfect information systems.

P. Makarenko also drew attention to the disproportionate nature of liability: in Ukraine, the maximum fine for illegal processing of personal data is 34,000 hryvnia, while in EU countries it is up to 2 million euros. This gap calls into question the preventive effectiveness of the legislation and requires a comprehensive review of both sanctions and protection procedures.

Searches and confidentiality: at the discretion of the executor

Kostyantyn Gozdup, prosecutor of the Vinnytsia regional prosecutor's office focused on the problem of respecting the rights of individuals during searches. According to him, even with a court order, the limits of permissible interference in private life are often not defined. As a result, investigators seize much more than is justified by the purpose of the investigation, including mobile phones, digital media, and personal belongings that may contain personal data of persons not involved in the offense.

The speaker noted that seized property often remains under arrest until a verdict is handed down, even if it does not contain information useful to the investigation. In such cases, the rights of third parties are not adequately protected, and the procedure itself is not clearly regulated. K. Gozdup drew particular attention to the need to develop guidelines for conducting searches, taking into account legislation on the protection of personal data.

A separate problem is the lack of regulation of video recording of searches and subsequent access to the recorded material by all participants in the proceedings. The prosecutor cited examples from his own practice where such access led to the disclosure of intimate information. At the same time, according to him, the legal culture of those involved in the process, in particular investigators, is often insufficient to ensure the proper handling of personal data. Therefore, this area requires clear regulatory definition and the introduction of control procedures.

ECHR standards: between privacy and public interest

The practice of the European Court of Human Rights regarding the protection of personal data in criminal proceedings was examined by UNBA Committee member Bogdan Fokiy.

He recalled that, according to Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms, the right to respect for private life includes the protection of personal data. Interference with this right may be justified only if there is a legitimate ground, a legitimate aim, and compliance with the principle of proportionality.

The speaker cited examples of key ECHR cases, in particular «Rotaru v. Romania» and «S. and Marper v. the United Kingdom», in which the court emphasized the importance of legal certainty, limiting the storage period for data, and preventing the storage of sensitive information without urgent need. The Court has consistently applied the following test: even if the interference is based on national law, it must be necessary in a democratic society and least burdensome for the individual.

The telephone as a source of risk

Svitlana Mazur, member of the Committee, devoted her speech to analyzing violations during the seizure of mobile phones in the course of searches. She emphasized that modern mobile devices store large amounts of personal data, ranging from personal correspondence and banking information to legal, medical, or commercial secrets.

However, in practice, investigators often seize phones without proper justification and without observing the guarantees provided by law. S. Mazur reminded that a search is only possible on the basis of a ruling by an investigating judge, which must clearly specify the items and documents to be seized.

If the telephone is not mentioned, its seizure is a temporary measure and access to its contents is possible only by court order. Separate attention was drawn to the rights of the person when the telephone is seized: to refuse to disclose the password, to demand that all actions be recorded in the protocol, and to insist on the presence of an advocate.

The speaker also emphasized the need to establish clear instructions for law enforcement officers on how to handle mobile devices during searches, and mentioned the advisability of introducing criminal liability for unauthorized access to confidential digital information.

Hidden risks in expert practice

Experts note that personal data is subject to scrutiny not only in criminal cases but also in civil cases. This was pointed out by Tetyana Deineka, head of the handwriting analysis department at the Poltava scientific and research expert-criminalistics center of the Ministry of Internal Affairs of Ukraine. This includes access to personal records, from diaries and private correspondence to passport details and home addresses. These materials are used as samples to identify the author of a written text or signature.

The speaker noted that although experts are not legally entitled to disclose information obtained during their investigations, the volume and sensitivity of this data require special attention. She stressed the need to be aware that expert activities involve the processing of large amounts of personal information, which is often of an intimate nature and which the individual would most likely not wish to disclose publicly.

Towards European standards through practice

The roundtable participants agreed that in the context of the digitalization of criminal proceedings, the issue of personal data protection needs to be systematically reviewed. The cases discussed revealed deep regulatory and practical uncertainty, both regarding the extent of permissible interference in private life and the protection of third-party information. Of particular concern are cases of unjustified seizure of mobile devices, insufficient safeguards during searches, and unregulated access to sensitive materials by other participants in the process.

Therefore, the key task is to create a transparent mechanism to balance the interests of the investigation and the right to privacy.

This material was prepared by Oksana Polotnyanko and Kateryna Kalachenko.