"Diia" changes form of ownership: what does the transition from a state enterprise to a joint-stock company mean and are Ukrainians' data safe?
Kyiv • UNN
The state enterprise "Diia" is changing its form of ownership to a joint-stock company, raising concerns about the security of personal data of 23 million users. The Ministry of Digital Transformation assures that "Diia" will remain 100% state-owned, but experts express fears about possible privatization and data trading.
The state enterprise "Diia" is changing its form of ownership to a joint-stock company. UNN decided to find out what will change and whether the personal data of 23 million "Diia" users will be protected after such a transition.
Six years ago, the Ministry of Digital Transformation presented the "Diia" mobile application and portal, which was the implementation of the "State in a Smartphone" program. All this time, "Diia" existed as a state enterprise. However, in January, data appeared on the YouControl analytical platform that the state enterprise "Diia" was in the process of termination. As explained by Valeria Koval, Deputy Minister of Digital Transformation of Ukraine, the state enterprise will transition to a joint-stock company format. The Ministry of Digital Transformation also assured that such changes will not affect the operation of the "Diia" application or portal in any way.
According to Koval, such a change is required by current Ukrainian legislation. Now all state enterprises in Ukraine must change their legal form.
I want to emphasize separately: Diia remains 100% state-owned. The word "joint-stock company" in the name does not mean privatization in any way. The state was, is, and will be the sole owner
Fears of privatization and trading of personal data
Lawyer Rostyslav Kravets suggested that changing the legal entity format would allow "freely trading Ukrainians' data."
However, now there are risks that the personal data of Ukrainians will be sold, transferred, and used by third parties without their consent, because a joint-stock company has been created. A state enterprise simply could not do this by law. A joint-stock company can do whatever it wants
He also drew attention to the fact that who owns the intellectual property rights to the "Diia" software also needs to be checked.
Ostap Stakhiv, the founder of the "Human Rights" movement, does not rule out that after "Diia" transitions to a joint-stock company, it may eventually be privatized.
You remember, many enterprises were transferred to joint-stock companies, and we were told a fairy tale that no, no, there would be no privatization, the state share would be one hundred percent, blah-blah-blah, we hear the same thing now
Stakhiv also does not rule out that, ultimately, the joint-stock company will trade the personal data of millions of Ukrainians.
Once again, I congratulate all those who have "Diia". You know, now it's very convenient to buy and sell people. As those who have the application said... Now, you press a button - and you sell data. Well, along with all that, people have put all their data there. From family, children, identification, passport
Cyber expert: personal data of Ukrainians is extremely poorly protected
Cybersecurity expert Kostiantyn Korsun, in a comment to UNN, noted that the re-registration of "Diia" from a state enterprise to a joint-stock company is purely formal and does not solve systemic problems with the protection of personal data of millions of Ukrainians who use the application.
These are just papers. In essence, nothing changes and this does not affect data security
At the same time, Korsun believes that the level of personal data protection in state digital systems is critically low, practically "for show." This, according to him, is confirmed by a number of incidents related to leaks.
Among them, the expert mentioned the hacking of the Ministry of Justice registers in December 2024, as well as the cyberattack on "Diia" in January 2022, the fact of which, according to him, was later confirmed by a decision of an American jury. At that time, data on 13.5 million Ukrainians was leaked from "Diia."
Korsun also recalled a large-scale incident with the mobile operator "Kyivstar," which, according to him, although it did not lead to a massive data leak, demonstrated the vulnerability of even the largest private companies.
This indicates that even the wealthiest commercial companies are not able to fully and effectively protect their networks, including those that store user data. And these are private companies with large budgets, with a large staff of employees, with decent salaries, and all that. In the public sector, everything is much worse, and it is not clear at all who is responsible for the security of our data at the national level, because this responsibility is dispersed among different institutions, and each of them wants a budget, some powers, but everyone refuses to take responsibility in case of any incidents
Korsun also stated that "Diia" remains vulnerable to both hacker attacks and fraud using personal data. "My experience, and I have been following this for 5 years, shows that yes, "Diia" is vulnerable to both hacker attacks and fraud using users' personal data," the cyber expert noted.
Moreover, the cybersecurity expert is convinced that in its current concept and architecture, "Diia" cannot be made secure.
"Diia" in this concept is an absolute complete mistake. It contradicts all world science on personal data protection and cybersecurity. In such an ideology, in such an architecture as it is built in Ukraine, it will be impossible to protect it in principle, because the foundation of this building is rotten. Everything is built on a rotten foundation
In his opinion, the problem also lies in the absence of effective legislation on personal data protection and independent control institutions in Ukraine, similar to those operating in Western European countries. Instead, the expert notes, the state itself promotes digital solutions that pose risks to both citizens and national security.
Thus, it becomes clear that regardless of the form of ownership of "Diia," which is used by millions of Ukrainians, it will remain vulnerable to hacker attacks and fraudulent actions. However, the transition to a joint-stock company may additionally open up the possibility of trading information.
Court checks if "Diia" could issue a loan after bank account was blocked16.12.25, 11:06 • 4206 views