The Right to Be Forgotten: How Civil Code Draft No. 15150 Institutionalizes the Privacy of Legal Entities and Opens the Gate to Corrupt Revanchism

Legal Analysis in the Context of EU Acquis, the Case Law of the Court of Justice of the EU, and Anti-SLAPP Standards

On April 28, 2026, the Verkhovna Rada approved Civil Code draft No. 15150 in its first reading by 254 votes. The document, spanning more than 800 pages, which its authors describe as the result of “seven years of work by more than 300 lawyers,” passed through parliament in a manner that prompted hromadske to assign it the apt characterization of “in 22 minutes.” Less than three weeks elapsed from the registration of the draft law on April 9 to the vote in principle. The relevant committee managed to issue an expert opinion within a single day. The Ministry of Justice had not even published its position by the time of the vote.

This pace is itself the first legal anomaly. A codification act of this scale, in the European legal tradition, is prepared over decades and undergoes public discussion in stages measured in years, not weeks. The French Code civil of 1804 reshaped continental law; the Dutch Burgerlijk Wetboek of 1992 took more than forty years to write; the German BGB of 1900 was nurtured by two generations of Pandectists. Ukrainian draft No. 15150 passed its first reading in 19 days — with the explanation that “the working group had been working for seven years,” but without the public expert debate that would correspond to such a claim.

However, the pace of adoption is merely the cover of the problem. The content is considerably worse. Lawyers from YouControl, a specialized analytical system for verifying counterparties, published a detailed breakdown of those provisions of the draft that directly destroy the open data ecosystem in Ukraine. YouControl’s conclusion is categorical: the draft in its current wording will set Ukraine back 10 years in the field of transparency and anti-corruption efforts. Let us examine these theses through the prism of EU acquis, the case law of the Court of Justice of the European Union (CJEU), and Ukraine’s obligations in accession negotiations.

Article 328: “the right to be forgotten” without European safeguards

Article 328 of the draft enshrines a construction that its authors declare to be a reception of the European “right to be forgotten.” At the level of rhetoric — yes. At the level of legal technique — no.

The European prototype of this norm, Article 17 of Regulation (EU) 2016/679 (GDPR), is built on a closed list of six grounds for the erasure of data: the data are no longer necessary for the purposes of processing; the data subject has withdrawn consent; the processing was unlawful; compliance with a legal obligation; the protection of a child’s interests; the satisfaction of a data subject’s substantiated objection. None of these grounds operates with the undefined concept of “loss of public interest.”

Article 17(3) of the GDPR, by contrast, contains a carefully elaborated system of exceptions that neutralize the right to erasure in five situations: the exercise of the right to freedom of expression and information; compliance with a legal obligation; the performance of a task carried out in the public interest or in the exercise of official authority; purposes of public health; archiving in the public interest, scientific or historical research purposes, and statistical purposes; the establishment, exercise, or defense of legal claims. These exceptions are not decorative — they are the heart of the balance between privacy and freedom of information.

Ukrainian draft No. 15150, in Article 328, proposes a fundamentally different construction: a natural person may demand the erasure of information about themselves not only in the event of inaccuracy, but also if such information has simply “lost public interest.” At the same time, the draft contains no closed list of exceptions analogous to Article 17(3) of the GDPR.

The legal consequence of this gap is obvious to any specialist in comparative law: the key provision of the GDPR is imported without its shock-absorbing mechanism. This is not “a European standard” — it is its framework without the load-bearing beams.

The criterion of “loss of public interest” as a legal category is wholly unsuitable for application. It is not defined in the draft, has no tests or evaluation criteria, and provides no procedure for determination. In a civil law claim, this creates a classic situation of an undefined evaluative concept whose interpretation is left to the discretion of the court of first instance — meaning that, in the conditions of Ukraine, it is left practically to the discretion of local courts, whose independence from political and commercial influences remains the subject of a separate EU integration conversation.

How this norm will function in practice is illustrated by the precedent of the Court of Justice of the EU in the case of Google Spain SL v. Agencia Española de Protección de Datos and Mario Costeja González (C-131/12) of May 13, 2014 — the very ruling from which the European “right to be forgotten” grew. The Spanish citizen Costeja González sought the de-indexing of a reference to the forced sale of his property for debts owed to social security authorities — a publication from 1998 in the newspaper La Vanguardia. The EU Court recognized his right to do so but immediately delineated its limits: this right is not absolute and yields when a person plays a role in public life of such a character that “interference with their fundamental rights is justified by the overriding interest of the public in having access to the relevant information.”

The CJEU applied a multi-factor balancing test: the nature of the information, its sensitivity for the private life of the data subject, the degree of public interest, the role of the person in the public sphere, the age of the publication, and the attitude of the data subject toward it. Article 328 of draft No. 15150 contains none of these criteria.

What does this mean in practice? A former member of parliament, a person featured in the “Derkach recordings,” or a participant in a scheme under “Velyka Budivnytsia” will be able, five years after the conclusion of criminal proceedings (and in the conditions of Ukrainian law enforcement practice, often even without such a conclusion), to bring a claim against investigative media outlets, OSINT aggregators, and analytical systems for verifying counterparties. The argument is simple: the public interest has “lost its relevance.”

The burden of proving the contrary falls on the defendant. The legal defendant becomes the journalist, the analyst, the operator of a due diligence service. The burden of proof shifts to the side that has no presumption in its favor. In practice, this means that the operators of YouControl, OpenDataBot, Clarity Project, “Slistvo.Info,” Bihus.Info, and Radio Liberty’s “Skhemy” program — each of them becomes a potential defendant in a claim where they must each time, anew, demonstrate why information about a corruption episode “has not lost its relevance.”

The European standard, by contrast: Article 17(3)(a) of the GDPR provides that the right to erasure does not apply at all “to the extent that processing is necessary for exercising the right of freedom of expression and information.” This exception functions as a legal immunity for journalism and academic activity. Article 85 of the GDPR expressly requires Member States to provide in national law for exemptions and derogations from the provisions on data processing “for journalistic purposes or the purpose of academic, artistic or literary expression.”

Article 8 of the Law of Ukraine “On the Protection of Personal Data” (in its current wording) formulates the restriction of the right to erasure narrowly and in the spirit of the GDPR: erasure is possible if data are being processed unlawfully or are inaccurate. Draft No. 15150 does not duplicate this provision — it replaces it, expanding the ground for erasure to the infinitely broad concept of “loss of interest.”

What YouControl proposes as a correction: to return to the model of Article 8 of the Law “On the Protection of Personal Data” and to limit the right to erasure of information from publicly available sources to cases of unlawful processing or inaccurate information.

Articles 345 and 353: “privacy of a legal entity” as a legal oxymoron

If Article 328 creates an imbalance, then Articles 345 and 353 of draft No. 15150 create a legal absurdity. These provisions concern the granting of legal entities the right to a “digital image,” with a requirement to obtain their consent to the processing of the corresponding data.

This provision has no analogues in the GDPR, the Convention 108+ of the Council of Europe, or in the legislation of any EU Member State. And the reason is simple: the concept of the right to privacy is inseparable from the concept of human dignity. Article 7 of the Charter of Fundamental Rights of the EU (“right to respect for private and family life”) and Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms operate precisely with the category of human rights. A legal entity is a legal fiction created for participation in commercial transactions, which by definition has no private life.

GDPR, recital 14, expressly establishes: “This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.”

Articles 345 and 353 of draft No. 15150 ignore this fundamental distinction. This is not “approximation to European standards,” as declared in the explanatory note — it is a construction that is alien both to European and to continental legal understanding of the legal entity.

The practical consequences of such an import are catastrophic for the financial monitoring system. KYC (Know Your Customer) and AML (Anti-Money Laundering) requirements, implemented in Ukraine by the Law “On Prevention and Counteraction to Legalization (Laundering) of Proceeds of Crime” of December 6, 2019, No. 361-IX, are based on the ability of primary financial monitoring entities — banks, insurance companies, notaries, lawyers — to aggregate open data on a legal entity, its ultimate beneficial owners (UBOs), related persons, the history of judicial proceedings, and tax behavior.

If the processing of data on the “digital image” of a legal entity requires its consent, the entire infrastructure collapses. A bank conducting a counterparty check is effectively forced to ask a potentially suspicious company for “consent” to compile a dossier on it. This is an absurdity that renders impossible the very idea of a risk-based approach.

More fundamentally, this is a blow to the 4th and 5th EU Anti-Money Laundering Directives (Directive 2015/849 and Directive 2018/843), the implementation of which forms part of Ukraine’s obligations under Chapter 4 of the EU membership negotiations (“Free Movement of Capital”). The 6th AML Directive, which is currently in the final stage of agreement, further strengthens the requirements for beneficial ownership transparency.

A precedent worth noting: it was the Court of Justice of the EU, in the case of WM and Sovim SA v. Luxembourg Business Registers (joined cases C-37/20 and C-601/20) of November 22, 2022, that declared invalid the provision of Article 30(5) of the 5th AML Directive, which granted “any member of the general public” unrestricted access to beneficial ownership registers. The Court found that such access constituted a disproportionate interference with the rights guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the EU.

However — and this is critically important — the CJEU did not abolish access to beneficial ownership registers altogether. The Court clearly established that journalists, civil society, and persons working in the field of anti-money laundering have a legitimate interest in accessing such information. Spain, Estonia, Latvia, Sweden, and Ireland implemented this ruling through a “legitimate interest” system with a presumption in favor of media and anti-corruption organizations.

The Ukrainian norm in Articles 345 and 353 moves in the opposite direction: instead of the delicate balance of “privacy — legitimate interest,” it introduces an absolute requirement of the legal entity’s consent to the processing of its digital image. This is not a response to the WM and Sovim ruling — it is its opposite. This is not the implementation of acquis — it is the creation of a legal regime worse than the one that existed before the Costeja González ruling of 2014.

What YouControl proposes: to clearly establish in the text that the processing of data concerning the digital image of a legal entity (with the exception of electronic signatures and seals) does not require the consent of the legal entity. This is the minimum necessary correction, without which the provision remains dangerous.

Articles 321, 332, 336: the death of automated analytics through the “digital profile”

The third block of provisions in the draft — the articles on “digital personal space” and “digital privacy” — formally concerns natural persons, but destroys the OSINT analytical system that forms the instrumental basis of investigative journalism and anti-corruption oversight.

Article 336 defines a person’s “digital image” as encompassing “any forms of their representation in the digital environment, including digital profiles,” and makes their processing conditional on the person’s consent.

Legally, this means the following. Modern analytical systems — YouControl, OpenDataBot, Clarity Project, 007 — operate on a single principle: they aggregate data from open state registers (the Unified State Register of Legal Entities, Individual Entrepreneurs and Public Organizations; the Unified Register of Court Decisions; NACP declarations; the register of sanctioned property; the register of encumbrances on movable property; the register of rights to immovable property; customs statistics; Prozorro procurement platforms) and compile from them a structured dossier — the very same “digital profile.”

Article 336 of draft No. 15150 includes such a profile, without exception, within the sphere requiring the data subject’s consent. This means: compiling an analytical dossier on a corrupt official, a high-risk counterparty, or a public official-declarant without their consent becomes a violation of the Civil Code.

The fundamental difference from the European approach: the GDPR operates with the concept of “lawful bases for processing” (Article 6) and expressly provides that processing is lawful where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the rights of the data subject (legitimate interest under Article 6(1)(f)). In addition, recital 47 of the GDPR and the established practice of data supervisory authorities of EU Member States recognize that the processing of personal data from open sources in the interests of journalism, anti-corruption oversight, and due diligence by financial institutions is precisely such activity on the basis of legitimate interest.

The Ukrainian construction of Article 336 does not provide for an analogue of “legitimate interest.” It builds protection of the digital profile on consent — that is, on the ground for processing that is the weakest in the GDPR and is directly recognized as unsuitable for journalism, scientific research, and compliance.

The Constitution of Ukraine, in Article 34, guarantees the right to freely collect, store, use, and disseminate information. The Law “On Access to Public Information” of January 13, 2011, No. 2939-VI, in Article 1, defines public information as “information reflected and documented by any means and on any media that was received or created in the course of the exercise by subjects of authority of their duties.” Article 5 of that Law establishes the presumption of the openness of public information.

If Article 336 of draft No. 15150 is adopted in its current wording, we will face a collision between the Civil Code and the Law “On Access to Public Information.” Under the application of lex posterior derogat legi priori (the later law repeals the earlier one), the Civil Code, as the later and codified act, will prevail — at least until the Constitutional Court (if it is in a functional state at all) decides otherwise.

What YouControl proposes: to clarify that a person’s digital image encompasses only those accounts, pages, and digital profiles that have been personally created by that person. This is a critically important correction that distinguishes what a person creates for themselves (their social media profiles, personal blogs, authored pages) from what the state generates about them in the form of open data, or what analytical systems aggregate from open sources.

Article 337: “informational peace” as a license for SLAPP lawsuits

The fourth and perhaps most sophisticated in its harmfulness element of the draft is Article 337, “The Right to Informational Peace.”

Conceptually, this provision is borrowed from the labor law of some European countries, where it protects the right of an employee not to respond to work-related messages on days off (known as the “right to disconnect” — enshrined in the French Labor Code since 2017 and in Belgian legislation since 2022). In the narrow context of the balance between work and personal time, this is a justified construction.

However, draft No. 15150 transposes this provision into the domain of general civil rights — making the “right to informational peace” as legally protected a category as the right to a name, to honor, to dignity, and to business reputation.

The legal consequence: any person to whom a journalist addresses an inquiry, an OSINT analyst sends a request for comment, or an anti-corruption organization submits a demand for explanations, formally acquires grounds for a claim alleging violation of their right to informational peace.

This is a guaranteed recipe for SLAPP lawsuits — strategic lawsuits against public participation, a phenomenon that the European Union has been systematically regulating through a separate directive since 2024.

Directive (EU) 2024/1069 of the European Parliament and of the Council of April 11, 2024 “On protecting persons who engage in public participation from manifestly unfounded claims or abusive court proceedings in civil matters” — the so-called Anti-SLAPP Directive — establishes a number of mechanisms mandatory for EU Member States: the possibility of early dismissal of manifestly unfounded claims; the imposition of the defendant’s costs on the claimant in cases of abuse; the right of civil society organizations and trade unions to appear in support of the defendant as amicus curiae; security payments for the claimant; and recognition of the SLAPP nature of a claim as grounds for refusing recognition of a judgment from a third country.

Ukraine, as a candidate country for EU membership, is obliged to implement Directive 2024/1069 by 2027. A special working group under the Verkhovna Rada Committee on Freedom of Speech is working on the relevant draft law. This is confirmed in the European Commission’s 2025 Enlargement Report, which expressly states: “cases of strategic lawsuits against public participation (SLAPP), linked to investigative journalism, remain a concern in Ukraine.”

Article 337 of draft No. 15150 moves in the opposite direction. It does not merely fail to implement Directive 2024/1069 — it creates a new, additional instrument for SLAPP claimants. Instead of protecting investigative journalists, anti-corruption activists, the authors of YouControl and Bihus.Info, OpenDataBot and “Slistvo.Info” from judicial pressure, the new provision gives a sanctioned oligarch, a corrupt official, or a “high-risk counterparty” a separate cause of action: the journalistic inquiry violated their “informational peace.”

Ukrainian SLAPP litigation practice already contains sufficiently telling cases. The lawsuits of Andrii Portnov against the CHESNO Movement for its inclusion in the Register of State Traitors. The Bihus.Info case — the investigation concerning Oleksandr Semochko, at the time deputy head of the Security Service of Ukraine — ended with the freezing of the editorial office’s bank accounts by court order. Numerous lawsuits against “Slistvo.Info,” including a lawsuit by businessman Serhii Semeniuk against journalist Yanina Kornienko over a report on the connections of cleaning companies with Russian business. Lawsuits against journalist Olena Mudra over an investigation into the environmental violations of a company in the Carpathians. The case of journalists from Radio Liberty’s “Skhemy” program concerning former judge Liudmyla Arestova.

In each of these episodes, the mechanism is the same: the lawsuit is filed not to defend a reputation that has been genuinely harmed, but to exhaust the resources of the editorial office, to freeze accounts, and to create a precedent for self-censorship. Article 337 of draft No. 15150 adds a new weapon to the arsenal of such claimants.

What YouControl proposes: either to remove the concept of the “right to informational peace” from the draft entirely, or to limit its application exclusively to the sphere of labor relations. Under no circumstances should it be permitted to be used as a ground for claims against journalistic and analytical activities.

The EU integration context: why No. 15150 in its current wording is a step backward from acquis

Ukraine formally commenced EU membership negotiations in June 2024. One of the 35 negotiating chapters — Chapter 23 “Judiciary and Fundamental Rights” — directly encompasses issues of personal data protection, freedom of expression, and anti-corruption measures. Chapter 24 “Justice, Freedom and Security” touches on anti-money laundering. Chapter 4 “Free Movement of Capital” requires the implementation of the AML Directives.

Draft No. 15150 in its current wording creates a simultaneous collision with three fundamental blocks of acquis communautaire.

First, with Regulation 2016/679 (GDPR), since it extends the scope of data protection to legal entities (Articles 345 and 353), narrows the exceptions to the right to erasure (Article 328), and does not provide for the mechanism of “legitimate interest” as a ground for processing (Article 336).

Second, with the 4th and 5th AML Directives and with the CJEU ruling in WM and Sovim, since the requirement of a legal entity’s consent to the processing of its digital image renders impossible the functioning of the KYC and due diligence system — the central element of the European financial architecture.

Third, with Anti-SLAPP Directive 2024/1069, since it creates a new cause of action (“right to informational peace”) that directly falls to be classified as a SLAPP instrument within the meaning of Article 4 of the Directive.

This triple rupture with acquis is not a coincidental confluence but a structural feature of the document. If the authors’ objective truly lay in “approximation to European standards,” as declared in the explanatory note, the document should have contained, in Article 328, the full list of exceptions from Article 17(3) of the GDPR; in the articles on legal entities — the exclusion of the “digital image” from the sphere of mandatory consent; in the provisions on the “digital profile” — the introduction of the concept of legitimate interest; and finally, “informational peace” should either not have been introduced into the Civil Code at all, or should have been strictly confined to labor relations.

None of these solutions are contained in the draft. Instead, it contains provisions each of which individually creates a raw material base for SLAPP lawsuits and for restricting access to information, and collectively amounts to a systemic blow to the transparency infrastructure.

The question the authors must answer: cui prodest?

Legal analysis must not shy away from the question that in the Latin tradition is denoted by the classical expression “cui prodest.” Who benefits?

The provisions we have examined are not the product of the European legal tradition. They do not arise from the logic of the balance between privacy and freedom of information — because it is precisely this balance that they destroy. They do not follow from the need for harmonization with acquis — because they contradict it. They solve no real legal problem faced by the ordinary citizen — because Article 8 of the current Law “On the Protection of Personal Data” already provides for the erasure of unlawfully processed or inaccurate data, and the right to honor and dignity is already protected by Articles 297–299 of the current Civil Code.

What, then, does this construction make legally possible?

First: legal protection for those who have reasons to wish to be forgotten. Not on the coast of a Spanish town sixteen years after the conclusion of debt enforcement — but here, in Ukraine, two, three, or five years after appearing in the “Pandora Papers,” in an investigation into schemes under “Velyka Budivnytsia,” in materials about Operation Midas, or in NABU reports. The “loss of public interest” provision opens a direct path for the de-indexing of such materials.

Second: a legal shield for companies whose beneficial trail leads to Moscow or to offshore jurisdictions. If the processing of a legal entity’s “digital image” requires its consent, then aggregating data on the Russian trace in the ownership structure of a Ukrainian enterprise, identifying connections with sanctioned persons, and compiling a dossier on a public procurement contractor with a suspicious chain of control — all of this enters a legal grey zone.

Third: an instrument of pressure against those who compile such dossiers. Article 337 is a legal mirror for the SLAPP claimant, in which they see themselves not as a claimant but as a defender of a violated right.

This conclusion is not conspiratorial — it follows directly from legal analysis. The provisions of draft No. 15150 in the part examined by YouControl, objectively and regardless of the authors’ intent, create a legal regime that serves the interests of persons for whom transparency is a risk. In any legal system, such an objective result demands an explanation.

What must be done before the second reading

Parliament voted to extend the preparation period before the second reading. This means 21 days during which the articles of the draft may still be amended. This is not sufficient for a systemic revision of an 800-page document, but it is sufficient for correcting several of the most critical provisions.

On Article 328: replace the criterion of “loss of public interest” with a closed list of grounds analogous to Article 17(1) of the GDPR; add a closed list of exceptions analogous to Article 17(3) of the GDPR (journalism, academic activity, artistic and literary expression, compliance with legal obligations, public interest, archiving, scientific research, the establishment and defense of legal claims).

On Articles 345 and 353: expressly establish that the processing of data concerning the digital image of a legal entity (with the exception of electronic signatures and seals) does not require the consent of that legal entity; harmonize with recital 14 of the GDPR.

On Articles 321, 332, 336: limit the definition of a natural person’s “digital image” exclusively to those accounts, profiles, and pages personally created by that person; expressly provide that this article does not restrict the processing of data from state registers and other open sources within the activities of journalists, researchers, analytical systems, and primary financial monitoring entities; add the concept of “legitimate interest” as a ground for processing in the spirit of Article 6(1)(f) of the GDPR.

On Article 337: either remove entirely, or strictly confine to the sphere of labor relations, expressly excluding application to journalistic inquiries, academic research, and the activities of primary financial monitoring entities.

In lieu of a conclusion

The codification of private law is an event that occurs once in a generation. The current Civil Code of Ukraine, adopted in 2003, was the result of a decade of work by the group of Anatolii Dovhert and defined the country’s legal landscape for more than twenty years. What the Verkhovna Rada adopts in its second reading will define the rules of the game for the coming decades.

The pace at which draft No. 15150 is moving through parliament contrasts with the historical weight of the act. The relevant committee in a single day, the first reading in 22 minutes, the absence of a position from the Ministry of Justice at the time of the vote, the absence of a public expert consensus. This is not a codification procedure — it is a legalization procedure.

The lawyers of YouControl, the experts of hromadske, “Slistvo.Info,” human rights organizations, and business representatives are all addressing parliament with one and the same appeal: not to allow the Civil Code to be turned into a code for the protection of shadow capital. This is not a rhetorical figure — it is a legal finding. In the wording of April 28, 2026, draft No. 15150 does precisely that.

European integration does not consist in the formal borrowing of the terms “right to be forgotten” and “digital image.” European integration consists in the complex balance between privacy and transparency, in the safeguards of Article 17(3) of the GDPR, in the Costeja test, in the WM and Sovim precedent, in Anti-SLAPP Directive 2024/1069. This is the substance without which the form ceases to be European — and begins to be an instrument that can be turned against any journalist, analyst, or activist.

Less than a month remains before the second reading. The responsibility for what the Civil Code becomes — an instrument for protecting the rights of citizens or a legal shield for shadow capital — now rests with those who will revise it. History will record their names.