The right to be forgotten, digital privacy, and the protection of bona fide acquirers’ rights: an analysis of the draft Civil Code

What changes the draft new Civil Code proposes in the areas of access to information and the disposal of public property, and what risks come with them.

In late April, the information space was shaken by news that the Verkhovna Rada had adopted in the first reading the draft new Civil Code of Ukraine — a document meant to comprehensively update the approaches to regulating private-law relations. The legislative initiative immediately drew wide public attention: debate unfolded in the media, among human rights and civil society organizations, members of the legal community, and members of parliament. 

The authors and supporters of the draft insist on recodifying and systematically updating the current foundations of civil (private) law. They emphasize the need to de-Sovietize the body of legal concepts, modernize the legal status of participants in private relations and other institutions of civil law, strengthen the guarantees for protecting individuals’ civil rights and interests, and harmonize Ukrainian legislation with European Union law. 

At the same time, criticism of the draft centers not so much on the very idea of updating the Civil Code as on certain of its provisions, in which opponents see risks of excessive interference with freedom of speech, open data, self-expression, and family relations. Further reservations are prompted by the draft’s use of broad and evaluative categories — in particular, “good morals” — which may create grounds for inconsistent interpretation and discriminatory application. 

Transparency International Ukraine has also analyzed the draft Civil Code of Ukraine (the draft CC). Given the scale and complex nature of the document, we focused primarily on those aspects of civil-law relations that directly relate to our area of work — namely, openness and transparency, access to information, and the disposal of public (state and municipal) assets. Our analysis identified a number of provisions that raise concerns and require refinement as the draft CC is prepared for the second reading. 

We are aware that consultations and discussions have begun as part of preparing the draft CC for the second reading — in particular, on the possible refinement of certain provisions that have already become the subject of public debate, primarily regarding the right to be forgotten, the digital privacy of legal entities, and good morals. We therefore note at the outset that the concerns set out in this legal analysis relate to the draft CC in the version adopted in the first reading by the Verkhovna Rada of Ukraine on April 28, 2026. 

Brief conclusions and proposals

The draft new Civil Code of Ukraine represents an attempt to adapt private law to contemporary social challenges, particularly the development of digital technologies, electronic communications, and the circulation of information. However, certain provisions of the draft pose direct risks to access to information, freedom of speech, and the protection of public assets.

These provisions should be refined before the draft CC is considered in the second reading. We recommend that parliament:

• in Article 328, remove the possibility of removing, anonymizing, destroying, or deindexing information about a person from publicly available sources on the grounds that it is “outdated,” “incomplete,” or has “lost public interest”;
• clarify the provisions of Article 353 regarding the processing of data on a legal entity’s digital image without its consent in cases where such information is open under the law;
• reconsider the advisability of introducing good morals as a separate source for regulating civil relations, given the existence of already established and settled means of legal regulation (law, contract, custom);
• reconsider the advisability of restricting the state and territorial communities in reclaiming property from bona fide acquirers;
• supplement Article 367 with a restriction on reclaiming from a bona fide acquirer property obtained through the disposal of assets in respect of which a court decision has been issued applying the sanction provided for in Article 4(1)(1-1) of the Law of Ukraine on Sanctions.

The current situation 

In the area of access to information, the Civil Code of Ukraine primarily regulates the personal non-property rights of individuals and legal entities. Articles 200, 277, and 302 of the Civil Code define information as a distinct intangible good and enshrine a person’s right to information, as well as mechanisms for protection against the dissemination of false information. The Code grants every individual the right to protect their personal non-property rights against unlawful encroachment by others. If false information is disseminated about a person or members of their family, the individual has the right to a reply and to the refutation of such information. At the same time, current legislation does not establish a general obligation to remove or anonymize such information — except where a document is withdrawn by the legal entity that issued or adopted it. 

As for legal entities, the Civil Code likewise vests them with a number of personal non-property rights, in particular the right to the inviolability of business reputation, the privacy of correspondence, and information. However, the scope of such rights is narrower than that of individuals.

The Civil Code of Ukraine was formed at a time when digital platforms, search engines, large arrays of personal data, and the algorithmic processing of information did not yet play such a significant role in social life. As a result, the Code essentially contains no separate regulation of digital privacy, the right to control one’s own digital data, mechanisms for deindexing information in search engines, or guarantees regarding the processing of personal data. The existing rules on the protection of private life and information are general in nature and are largely designed for traditional forms of disseminating information rather than the modern digital environment. 

Issues of transparency and openness of information are regulated largely not by the Civil Code itself but by special legislation — in particular, the Laws of Ukraine on Information, on Public Electronic Registers, on State Registration of Legal Entities, Individual Entrepreneurs, and Civic Formations, and on Corruption Prevention. These and other acts define the openness regimes for state registers, access to information about individuals and legal entities, the use of budget funds, declarations, court decisions, and the like. If information is defined by law as open and subject to publication, it may be collected, analyzed, and used, provided this does not violate special restrictions on personal data or restricted-access information. 

As regards the disposal of state and municipal property, the current Civil Code sets out the general principles of the right of ownership, the legal status of state and municipal property, and the powers of the state and territorial communities as participants in civil relations. In particular, Articles 316–327 of the Civil Code enshrine the content of the right of ownership, the forms of ownership, and the specifics of exercising the right of state and municipal ownership. The Code proceeds from the premise that the state and territorial communities exercise the right of ownership through authorized bodies, and that the disposal of public assets must be carried out within the bounds of the law and in accordance with the public interest. 

The Code pays particular attention to protecting the right of ownership. Article 386 guarantees that the state ensures equal protection of the rights of all owners. At the same time, Article 388, which concerns an owner’s right to reclaim property from a bona fide acquirer, reveals an imbalance between protecting private property and the interests of the state and territorial communities in preserving public assets. Thus, the state or communities cannot reclaim their immovable property from a bona fide acquirer (a person who did not know and could not have known about the unlawful origin of the asset) if more than ten years have passed since the registration of the first acquirer’s ownership of the property, or since the date the property was transferred into their ownership (if it is not subject to registration).

What is proposed

The draft CC substantially expands the existing restrictions on the use of data and information about an individual, particularly in the digital environment. Unlike the current Code, which mostly operates with traditional categories of privacy and the protection of private life, the draft seeks to account for the development of social networks, messengers, and artificial intelligence technologies.

In particular, with a person’s consent, the use of their image and voice is permitted (Article 318), as is the creation of digital content that realistically imitates the image, voice, behavior, or other distinctive features of a specific individual, including through the use of artificial intelligence technologies (Article 321). Moreover, the use of content created with artificial intelligence technologies must be accompanied by clear and visible labeling of its synthetic origin. 

A novelty is the introduction of the rights of individuals and legal entities to a digital image and a digital personal space (digital privacy). A digital image encompasses any forms of representing and distinguishing a person in the digital environment — such as accounts, profiles, personal pages, personal data, avatars, and digital profiles, including in social networks and e-government systems, as well as images, video recordings, audio recordings, electronic signatures and seals, and the like. Copying, using, and processing data on a person’s digital image is possible only with their consent. 

In addition, the draft establishes restrictions on the publication and dissemination of personal digital information — in particular, email messages, telephone conversations and messages, electronic text and voice messages, images, and audio and video communication in messengers and social networks (Article 333), as well as personal notes in electronic form (Article 332) — permitting such use only with the person’s consent. 

Another novelty of the draft CC is the right to be forgotten. Under it, any individual may demand the removal, anonymization, or destruction of information about themselves from publicly available sources, and the cessation of the provision of links (deindexing) to such information under their name, if the information is false, outdated, incomplete, processed unlawfully, or has lost public interest, and its further processing harms that person’s personal rights. 

However, an individual’s right to be forgotten cannot be applied where the personal data: 

• is necessary for exercising the right to freedom of thought and speech and the free expression of one’s views and beliefs; 
• has archival and/or cultural value or forms part of historical, scientific, or statistical research; 
• relates to an official, civil servant, or other public figure and is connected with the performance of their official, professional, or public functions;
• is necessary for protecting the health of the public and of individuals; 
• is necessary for the data controller to fulfill a legally defined obligation to process such personal data. 

As for the protection of state and municipal property, the draft CC retains and elaborates the existing restriction on the ability of the state or territorial communities to recover property that has unlawfully left their ownership if ten years have passed since a bona fide acquirer obtained it.

In addition, the draft retains a special approach to determining when the limitation period begins to run in disputes over reclaiming property transferred from state or municipal into private ownership. Such a period is proposed to be calculated from the date of state registration of the first acquirer’s ownership, or from the moment the property is transferred to them if it is not subject to state registration.

Risks

1. The right to be forgotten

The problem with the right-to-be-forgotten concept proposed in Article 328 of the draft CC lies primarily in the fact that certain criteria for its application are formulated too broadly and are evaluative in nature. This concerns categories such as “incomplete information,” “outdated information,” or “information that has lost public interest,” the content of which has no clear statutory limits and may be interpreted arbitrarily.

In the absence of clear criteria for balancing a person’s right to privacy against the public interest in access to information, there is a risk that the right to be forgotten could become a tool for concealing socially important information. In particular, such mechanisms could potentially be used by bad-faith actors to delete, deindex, or restrict access to information in the media, journalistic investigations, and open data portals.

Formally, the right to be forgotten will not be absolute and will not provide for the automatic deletion of information; however, the proposed safeguards may prove insufficient. In particular, a person may lose the status of an official, civil servant, or public figure, but the public interest in information about corruption, reputational scandals, or other facts concerning that person will persist. 

As a result, journalists, open data aggregators, and even social network users will be forced to prove in court the existence of public interest in information about former officials, corrupt actors, or other persons. This will have a chilling effect on freedom of speech, as the media and the public will avoid disseminating or retaining such information for fear of litigation. 

A separate risk is that case law on such provisions will develop gradually and may be unpredictable. Until it becomes settled, the existence of such a rule may be used as a tool of pressure against journalists, civil society organizations, whistleblowers, analytical platforms, and other actors who work with open data. 

Clearly, the so-called “right to be forgotten” is an attempt by the authors to reproduce in the draft CC the right to erasure (“the right to be forgotten”) provided for in EU Regulation 2016/679 on the protection of personal data (the General Data Protection Regulation, GDPR). However, in implementing this approach, they did not take into account that, under Article 17(3)(d) of the relevant EU Regulation, the use of personal data to achieve public-interest purposes is a limitation on the erasure of data rather than a ground for such a request. 

Therefore, in preparing for the second reading, it is advisable to revise the provisions of Article 328 and remove the possibility of removing, anonymizing, destroying, or deindexing information about a person from publicly available sources on the grounds that it is “outdated,” “incomplete,” or has “lost public interest,” since such criteria are evaluative and create risks of restricting access to socially important information. Instead, the right to be forgotten should be limited to cases where the information about a person is false or has been processed unlawfully. 

2. The digital privacy of legal entities

Articles 345 and 353 of the draft CC vest legal entities with rights to a digital image and a digital personal space (digital privacy). A digital image encompasses any forms of representation in the digital environment — such as accounts, profiles, personal pages, and digital profiles, including in social networks and e-government systems, as well as electronic signatures, seals, and other forms of individualization in the digital environment. Copying, using, and processing data on a legal entity’s digital image is possible only with its consent. 

The proposed regulation gives rise to contradictions regarding its relationship with the principles of openness of public information, the functioning of state registers, journalistic activity, and the activity of services that aggregate open data. In particular, the broad and evaluative definition of a digital image could potentially cover a significant body of information that is already open under the law — including information about beneficial owners, data on participation in public procurement, court proceedings, and the use of budget funds. There is a risk that such rules could be used to restrict access to socially important information or create additional legal risks for journalists, civil society organizations, and analytical platforms that work with open data.

Moreover, the concept of digital privacy is by its nature primarily linked to protecting the private life and personal data of an individual. For legal entities, by contrast, there may be separate digital non-property rights related to protecting business reputation, trade secrets, electronic communications, or means of electronic identification. For this reason, the draft’s effective extension of the full construct of “digital privacy” to legal entities appears questionable. 

In this context, it can be considered well-founded to clarify the provisions of Article 353 regarding the processing of data on a legal entity’s digital image without obtaining its consent in cases where such information is open under the law. 

3. Applying good morals as a source for regulating civil relations

Alongside law, contract, and custom, the draft CC singles out another means of regulating private relations — good morals, by which it proposes to mean the body of moral norms and principles, standards of ethical conduct, and generally accepted notions of proper behavior that are established in society.

Good morals would directly affect key areas of private relations. In particular, the content of a contract may not contradict good morals; otherwise, a court may declare the contract invalid. An individual will be able to freely choose the forms and ways of expressing their individuality, determine their own conduct, and make decisions only in ways and within limits that, among other things, do not contradict good morals. In addition, when exercising the right of ownership and performing the related obligations, an owner will also be required to comply with the requirements of good morals. 

Introducing such a category effectively means that the regulation of civil relations may be influenced not only by statutory rules but also by rather subjective ideas about morality, ethics, or “proper” behavior. At the same time, the use of such a broad and indeterminate category raises concerns from the standpoint of the principle of legal certainty, since the boundaries of the concept of “good morals” remain unclear and may differ substantially depending on the social context, subjective perception, or case law. In the absence of clear criteria for its application, this may also create risks of a selective or discriminatory approach in assessing the conduct of participants in civil-law relations. 

In view of this, it is advisable to reconsider the appropriateness of applying good morals as a separate source for regulating civil relations, given the existence of already established and settled means of legal regulation — law, contract, and custom.

4. The specifics of reclaiming state and municipal property from a bona fide acquirer

The draft Civil Code enshrines the existing restriction on the ability of the state or territorial communities to recover property that has unlawfully left their ownership if 10 years have passed since its sale to a bona fide acquirer. This restriction effectively legalizes the unlawful alienation of state or community property through fraudulent schemes and abuses by officials. 

Setting time limits for reclaiming property may lead the state and the relevant territorial communities to lose assets that unlawfully left their ownership through fraudulent schemes, abuse of office by officials, or other unlawful acts, as it will limit the ability to recover them, even through the courts. Moreover, the provided list of exceptions to which the restrictions do not apply (critical infrastructure facilities, cultural heritage, and the nature reserve fund) is too narrow and does not account for other objects — for example, forestry land or coastal land around rivers and water bodies, which traditionally attract heightened interest from developers.

Even greater harm to the protection of the property interests of the state and communities comes from the change in the approach to calculating when the limitation period begins to run for filing a court claim to reclaim property. Instead of applying the general approach — under which the limitation period begins on the day the person learned or could have learned of the violation of their right — the start of this period is set at the date of state registration of ownership or of the transfer of the property to the bona fide acquirer. And since a party’s filing of a statement with the court on the expiry of the limitation period is grounds for dismissing the claim, in practice the state or community will have not 10 but only 3 years to recover unlawfully alienated property.

The change in the approach to when the limitation period begins to run in this category of cases may also contribute to a rise in the number of unlawful schemes for alienating others’ property in the future, since after ownership is re-registered, time will work against the lawful owner. It is effectively presumed that the state or community is aware of the change in ownership of the property from the moment the corresponding entry is made in the state register. This approach does not account for the real circumstances in which violations are discovered, which often become known only after a considerable time — in particular, following an audit, a journalistic investigation, criminal proceedings, or a change in the leadership of a government body. 

In addition, instead of placing the obligation to compensate the value of the property on the person guilty of its unlawful alienation, the current Code and the draft CC effectively oblige the owner (the state or community) to buy back its own property, and only then resolve the dispute with the guilty person.

This approach is also risky in view of the need to incur budget expenditures, as it imposes an additional financial burden that may be especially significant for local budgets. They may not provide for such planned expenditures at all, yet if funds are not deposited into the court’s account, the court will be unable to rule on the return of the property. Moreover, a bona fide acquirer may have purchased the property at an understated price, whereas the state or community would need to compensate its market value. 

In March last year, TI Ukraine called for vetoing Draft Law No. 12089, which was similar in content, but it ultimately entered into force. Therefore, before the second reading, it is necessary to reconsider the advisability of retaining the restrictions on the state and territorial communities in reclaiming property from bona fide acquirers.

5. Establishing additional guarantees for purchasers of sanctioned assets

In our study on the disposal of confiscated Russian assets, we highlighted the problem of investors’ reluctance to take part in auctions to acquire such property due to distrust of its background, which is associated with the risks of challenges by former owners. Potential buyers need additional guarantees from the state so that, whatever happens, they will not be left without the property. At present, legislation provides them with only one type of guarantee — the restriction on a previous owner’s recovery of property sold to a bona fide acquirer through privatization at an electronic auction, provided for in Article 388 of the Civil Code.

But part of the assets, in particular residential housing, were sold by the State Property Fund at electronic auctions under a procedure for alienating objects of state property other than privatization. Furthermore, in January 2026 the government approved a new, separate procedure for disposing of sanctioned assets. As a result, the guarantees for bona fide acquirers will not extend to property sold under these procedures. 

Consequently, a need arose to expand such guarantees. In January 2025, parliament adopted amendments to the Civil Code of Ukraine providing for a restriction on reclaiming property from a bona fide acquirer if they obtained it through an electronic auction. But they did not take effect because of technical and legal inconsistencies between the existing and the adopted provision. Nor did such a provision appear in the draft Civil Code.

In view of this, it is advisable to provide for appropriate guarantees by restricting the possibility of reclaiming from a bona fide acquirer property obtained through the disposal of assets in respect of which a court decision has been issued applying the sanction provided for in Article 4(1)(1-1) of the Law of Ukraine on Sanctions.

Conclusions and recommendations

The draft new Civil Code of Ukraine represents an attempt to adapt private law to contemporary social challenges, particularly the development of digital technologies, electronic communications, and the circulation of information. However, certain provisions of the draft pose direct risks to access to information, freedom of speech, and the protection of public assets.

In particular, the provisions on the right to be forgotten and the digital privacy of legal entities, in their proposed form, may create preconditions for restricting access to socially important information and complicating the work of journalists, civil society organizations, and services that work with open data. Evaluative criteria such as the “outdatedness” of information or the “loss of public interest” have no clear limits and may be applied arbitrarily, which creates risks of abuse and a chilling effect on freedom of speech, as the media and the public will avoid disseminating or retaining such information for fear of potential litigation.

Concern is also raised by the introduction of good morals as a separate source for regulating civil relations. Granting moral and ethical categories independent regulatory significance may expand the scope for subjective interpretation and the inconsistent application of rules, which potentially contradicts the principle of legal certainty and creates risks of a selective or discriminatory approach in law enforcement. 

The provisions on reclaiming state and municipal property from a bona fide acquirer require particular attention. The proposed approach effectively narrows the ability of the state and territorial communities to recover assets unlawfully alienated through fraudulent schemes or abuses, and also creates additional financial risks for budgets due to the need to compensate the value of the property to the bona fide acquirer in advance. 

The draft does not eliminate the problem of insufficient guarantees for purchasers of sanctioned assets, which could improve the effectiveness of their disposal. 

These provisions should be refined before the draft CC is considered in the second reading. We therefore recommend that parliament:

• in Article 328, remove the possibility of removing, anonymizing, destroying, or deindexing information about a person from publicly available sources on the grounds that it is “outdated,” “incomplete,” or has “lost public interest”;
• clarify the provisions of Article 353 regarding the processing of data on a legal entity’s digital image without its consent in cases where such information is open under the law;
• reconsider the advisability of introducing good morals as a separate source for regulating civil relations, given the existence of already established and settled means of legal regulation (law, contract, custom);
• reconsider the advisability of retaining the restrictions on the state and territorial communities in reclaiming property from bona fide acquirers;
• supplement Article 367 with a restriction on reclaiming from a bona fide acquirer property obtained through the disposal of assets in respect of which a court decision has been issued applying the sanction provided for in Article 4(1)(1-1) of the Law of Ukraine on Sanctions.