This Law establishes regulations for the protection of individuals regarding the Government's processing of personal data and other information, as well as regulations for the free movement of personal data. It also sets rules for the Government's acquisition and utilization of information technology, particularly electronic communication methods and means of obtaining such technology and related services. The Law creates institutions responsible for the development, maintenance, utilization, and support of these services. Additionally, the Law enshrines Liberland's orientation towards free and open-source software into its legal order.
controller - The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Information Technology (IT) - The use of computers to create, process, store, retrieve, and exchange various types of data and information.
information technology system (IT system) - An information system, communications system, or computer system, including all hardware, software, and peripheral equipment, operated by a limited group of IT users.
electronic communication - Any information sent between particular parties over a phone line, internet connection, or other means of electronic communication.
means of electronic communication - Phone calls, faxes, text messages, video messages, emails, internet messaging, and other means capable of accomplishing similar or better results.
personal data - Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or other factors specific to the individual's identity.
processing - Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, or disclosure.
- The Government shall collect and process, henceforth "control", information only for reasons and to fulfill aims listed in this Law, henceforth "lawful purposes", and only insofar and by means that this Law allows.
- Information shall only be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
- Collection and processing of information shall be adequate, relevant, and limited to what is necessary concerning the purposes for which they are processed (‘data minimization’).
- The Government shall control personal data of natural persons, henceforth "personal data", with an increased measure of care. Personal data shall be processed lawfully, fairly, and in a transparent manner concerning the data subjects.
- The Government shall keep personal data in a form that permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed. Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage.
The primary aim of Government communication shall be to enable members of the public to exercise their right to communicate with and receive information from the Government and to support a well-functioning democracy. To that end, the Government may control the information and personal data strictly required for efficient communication to be regularly enabled and practiced.
The Government may control information and personal data of citizens and other persons to enable the participation of citizens in governance, including: a) voting in elections and referendums; b) participating in political parties; c) contributing to public consultations; d) running for public office; e) petitioning the Government or other public institutions.
Where the information and personal data control is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, such control shall be permitted.
Government can control personal data where the data subject has given consent to the processing of his or her personal data for one or more specific purposes; the data subject shall always retain the right to take their consent back, at which point the personal data control shall cease; the data subject shall always retain the right to be forgotten and the response to the taking back of consent shall be immediate.
- Where data control is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language.
- Where the data subject is a child below the age of 16 years, data control shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
Where the Constitution or a law sets up a government function the correct exercise of which according to the best available practices and technology requires information and data control, such shall be performed with maximal care with respect to anyone who could be affected by this processing, above and beyond the standard of care prescribed for the other lawful purposes.
Processing of personal data revealing:
a) racial or ethnic origin,
b) political opinions,
c) religious or philosophical beliefs or trade union membership,
d) genetic data,
e) biometric data for the purpose of uniquely identifying a natural person,
f) information on criminal convictions,
g) data concerning health, or
h) data concerning a natural person’s sex life or sexual orientation
shall be permissible only when:
a) the data subject has given specific informed consent,
b) there is a specific legal license granted with respect to employment or safeguarding the fundamental rights of the data subject,
c) processing is necessary to safeguard the data subject's vital interests and the data subject is incapable of giving their informed consent due to physical or mental incapacitation, long-term absence, etc., or
d) processing is necessary to prevent a clear and present danger that may cause damage to an individual's or a group of individuals' life, liberty, or property.
e) processing is necessary to commence or proceed in a case before the justice system of Liberland or in a foreign justice system in a Rule of Law-based jurisdiction providing appropriate safeguards for the rights and freedoms of data subjects.
Processing confidential data, the further dissemination of which would clearly and substantially damage a person, their interests, or Liberland's interests, shall likewise be permissible only for the reasons listed in the the previous paragraph.
Information on foreign criminal convictions shall only be retrieved from sources under the control or supervision of the appropriate foreign official authority, providing appropriate safeguards for the rights and freedoms of data subjects.
- The Government shall maintain an open and transparent approach to its operations and decisions. The public has a right to access government-held information, subject to limitations specified in this Act and any other relevant legislation.
- The Government shall periodically and proactively publish information about its activities, policies, and decision-making processes, while respecting the privacy of individuals and the security of sensitive information.
- Any person has the right to request information from the Government, subject to the limitations specified in this Act and any other relevant legislation.
- Requests for information shall be submitted in writing or electronically, specifying the information sought and the requester's contact details.
- The Government shall respond to requests for information within a reasonable timeframe, not exceeding 30 days from the date of receipt of the request, unless an extension is justified due to the complexity or volume of the requested information.
- Access to information may be limited or denied if disclosure of the information would: a) violate the privacy of an individual or the confidentiality of sensitive personal data; b) endanger the security of the nation, public safety, or the integrity of ongoing criminal investigations; c) harm the commercial interests of a public or private entity; d) infringe on intellectual property rights; e) breach legal or professional privilege.
- Any decision to limit or deny access to information shall be based on a specific, legitimate, and clearly articulated reason, and the requester shall be informed of the reason for the decision.
- The Government shall maintain an open and transparent approach to its operations and decisions. The public has a right to access government-held information, subject to limitations specified in this Act and any other relevant legislation.
- The Government shall periodically and proactively publish information about its activities, policies, and decision-making processes, while respecting the privacy of individuals and the security of sensitive information.
- Any person has the right to request information from the Government, subject to the limitations specified in this Act and any other relevant legislation.
- Requests for information shall be submitted in writing or electronically, specifying the information sought and the requester's contact details.
- The Government shall respond to requests for information within a reasonable timeframe, not exceeding 30 days from the date of receipt of the request, unless an extension is justified due to the complexity or volume of the requested information.
- Access to information may be limited or denied if disclosure of the information would: a) violate the privacy of an individual or the confidentiality of sensitive personal data; b) endanger the security of the nation, public safety, or the integrity of ongoing criminal investigations; c) harm the commercial interests of a public or private entity; d) infringe on intellectual property rights; e) breach legal or professional privilege.
- Any decision to limit or deny access to information shall be based on a specific, legitimate, and clearly articulated reason, and the requester shall be informed of the reason for the decision.
- The Government and every government organ shall set up an online portal to provide information about its:
a) functional setup,
b) the organ's place in the Government hierarchy,
c) day-to-day workings, and
d) news. - The portal shall also enable Citizens and residents of Liberland to effortlessly communicate with the given institution.
- Referring to information provided on the portal shall be a valid response to a Public Access query.
- The Government shall adopt and utilize information technology (IT) systems and services to improve its efficiency, effectiveness, and transparency, and to enhance its interaction with the public.
- The Government shall prioritize the use of free and open-source software, except where proprietary software is necessary for specific, justified reasons.
- The Government shall establish transparent and competitive processes for the procurement of IT systems and services, and the development of IT infrastructure.
- The Government shall take measures to ensure the security, reliability, and interoperability of its IT systems and services, as well as their compatibility with international standards and best practices.
- The Government shall only enter contracts for proprietary information technology and information system-related services in ways that enable it to change the provider without excessive resource-spending within a maximum of 4 election terms.
- If any provisions in a contract bind the government for longer or create, in their effect, the requirement of excessive spending or transition costs, those shall be considered natural obligations for the Government. The Government shall only be responsible for compensating the provider if the provider can prove a knowing intent to deceive them using this provision at the time of closing the contract.
- The Government shall attempt to resource its information technology internally wherever possible and economically feasible.
- Where the use of contractors is necessary, the Government shall select entities owned or at least represented by Liberland citizens where possible. Only in cases of a clearly superior offer in price and quality can an outside contractor be hired.
- The Government shall ensure that its IT systems and services are accessible and usable by all members of the public, including persons with disabilities.
- The Government shall promote digital literacy and provide training and support to enable citizens to access and use its IT systems and services effectively.
There shall be one government AITIS within the Office of the Government responsible for all government information technology in Liberland.
Every ministry shall either set up its own AITIS or shall share AITIS with another ministry or the government where that should prove more efficient. If AITIS are shared, they shall nonetheless compartmentalize their processes, machines, data storages, etc., to conform to the best available security and professional practices.
Each AITIS shall be headed by a director, appointed by the respective minister. The director for each AITIS shall be responsible for setting the organizational structure and day-to-day management of the AITIS.
This Law shall gain Legal Force on … and it shall remain in force in perpetuity or until its legal effects should be terminated or until it should be replaced by another Law governing the same or similar subject matter.