Fines for providers and the Internet becoming more expensive: the SBU wants to monitor the traffic of Ukrainians without a trial, the telecom regulator expressed a warning

However, the idea of ​​European integration hides a radical expansion of the powers of law enforcement agencies and new strict obligations for the telecom market. The profile regulator, the National Commission for the Regulation of the State Electricity Market, approved the document only with significant comments, effectively destroying its key provisions.

The official position of the commission, signed by the head of the NKEC, Lilia Malyon, is available to dev.ua. We figured out what exactly the new law proposes and why the regulator requires it to be completely rewritten.

What exactly is proposed in the law: a detailed analysis of the novellas

The bill proposes a major reform of the Criminal Procedure Code and the Law «On Electronic Communications». If adopted in its current form, the mechanism for collecting digital evidence would operate as follows:

• Total preventive traffic retention (12 months): All providers of electronic communications services (internet providers and mobile operators) will be required to continuously accumulate and store data on the movement of information (traffic) of all users without exception for one year. The volume of data must be «sufficient to identify the subscriber, determine the source of origin of the traffic and the route of its transmission.»

• «Freezing» of data by order of the investigator (without a court): The investigator or prosecutor will be able, by their own order (i.e. without prior court sanction), to order the provider to immediately carry out «urgent preservation of information» that is in their possession or under their control so that the suspect does not have time to delete it.

• Partial disclosure of data without a court order: Investigators will be able to access urgently stored traffic information that is «not protected by the Personal Data Protection Act» solely on the basis of their order. In addition, operators will be obliged, upon the investigator’s decision, to provide the consumer’s identification data (who exactly used the IP address or number at a specific time) without disclosing the content of the communication itself.

• Criminal status for cryptocurrency: Instead of the outdated «computer data», the concept of «information in electronic form» is introduced. The CPC also prescribes a procedure for the arrest and confiscation of «digital things» — this definition includes virtual assets (cryptocurrency) and digital content, which were previously difficult to procedurally arrest during searches.

• New fines for providers: Providers will be financially punished for failure to comply with a legal requirement or an investigator’s order to «freeze» and preserve data — for this, the Code of Administrative Offenses will be supplemented with a new article 185-16.

Why the NCEC demands a complete revision of the draft law: 5 main comments

1. Risk of violation of the Constitution and secrecy of communications

The regulator directly reminds law enforcement officers of Articles 31 and 32 of the Constitution of Ukraine, which guarantee the confidentiality of telephone conversations and correspondence. Exceptions can only be established by the court.

«Providing access to such information solely on the basis of an investigator’s decision without proper judicial control may create risks of disproportionate interference with human rights and not fully comply with constitutional guarantees,» the NCEC emphasizes.

Even without access to the text of messages, traffic data alone allows law enforcement to see a person’s full circle of contacts, their location, the duration of conversations, and travel routes.

2. Internet and mobile communications may become more expensive

Implementing a total data storage system requires huge investments from operators. The bill obliges providers to purchase equipment to store terabytes of information, but does not provide for any compensation from the state or funding sources.

«The implementation of such provisions may require significant modernization of the infrastructure of providers, the creation of additional data storage systems and significant financial costs… Which may further contribute to an increase in the cost of electronic communications services for end users,» the regulator warns.

3. Legal chaos and «stretching» of deadlines

The legislators tried to include purely criminal procedural norms in the profile law «On Electronic Communications», which breaks the logic of the legislation. In addition, the authors of the draft invented a bunch of terms that do not exist in EU and Ukrainian law, such as «electronic communication chain», «size and duration of electronic communication» or «data flow data». At the same time, the basic concept of «service provider» turned out to be so vague that, in addition to Internet providers, cloud services, messengers, hosting and data center operators automatically fall under the attack of law enforcement agencies.

4. The uncertainty of «total surveillance»

The regulator notes that the law does not contain a clear list of categories of data that must be stored for 12 months. The wording is evaluative and vague: «in such a volume that is sufficient to determine the source of origin…». Who and how will determine this «sufficiency» is unknown, which gives law enforcement agencies room for abuse. It is also unclear whether providers should proactively record the data of all citizens in advance, or «freeze» only existing data after a request.

5. Lack of protocols for war and blackouts

The draft law completely ignores the reality that Ukrainian telecoms lives in. The document does not specify at all how law enforcement officers and operators should interact in conditions of martial law, large-scale cyberattacks, network destruction, or the banal lack of electricity and the technical ability to fulfill the request of security forces «here and now.»

Summary: return for revision

The NKEC recalls that similar attempts to «tighten the screws» already took place in 2020 (scandalous bills No. 4003 and No. 4004), but in September 2025, the Verkhovna Rada finally removed them from consideration due to a flurry of criticism.

The regulator demands to completely exclude from the sectoral Law «On Electronic Communications» the norms related to criminal proceedings (they should be exclusively in the Code of Criminal Procedure), clearly limit the categories of information subject to disclosure, and create a working group involving the Ministry of Digital Economy, the National Commission for the Control of Electronic Communications, law enforcement officers, and market representatives to completely rewrite the document.