PROSPECTIVE DIRECTIONS FOR IMPROVING THE REGULATION OF PERSONAL DATA PROTECTION IN UKRAINE

Section "Law": Тheoretical and Practical Issues of Development of the Law System of Ukraine

Abstract

The process of legislative settlement of issues related to the protection of personal data began in the European Union (EU) with the entry into force of Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals regarding the processing of personal data and on the free movement of such data (Directive). After adoption the Charter of Fundamental Rights of the European Union (2000), which Article 8 defined the protection of personal data as a human right, establishment of the sufficient principles in the Lisbon Treaty (2009), there were amended two key EU acts: the Treaty on EU and the Treaty establishing the European Community. As a result, everyone in the EU was guaranteed the right to protect their personal data. In 2016 the EU adopted Regulation 2016/679/EC of the European Parliament and of the Council on the protection of natural persons regarding the processing of personal data and on the free movement of such data (Regulation), which radically updated the methods of collecting and processing personal data, and not only in the EU. As a result, to comply with its requirements, both EU-based companies and those operating in the EU or working with consumers from the EU market were forced to update their privacy/personal data policies. In turn, in Ukraine, significant progress in the development of legal regulation of personal data protection occurred later. As of 2010, public relations regarding collection, storage, use and dissemination of information about a person were regulated by more than two dozen uncoordinated laws and secondary legislation. To specify and define the mechanisms for implementing the provisions of Article 32, Constitution of Ukraine, which proclaimed the right of a person to non–interference in its personal life and established a ban on the collection, storage, use and dissemination of confidential information about a person without its consent, the Verkhovna Rada of Ukraine in 2010 adopted the law of Ukraine “On Personal Data Protection”. Having played a vital role in the legislative codification of the rules for processing personal data, the law, like the Directive, failed to respond to technological changes and the processes caused by this in society, despite numerous amendments made by MPs. Since the Association Agreement between EU and Ukraine came into power, there is noticeable arising necessity to harmonize the Ukrainian legislative framework with EU, as though contexts of adoption of the Regulation and the Law are different, so are the ways of resolving personal protection issues in Ukraine and the EU. Therefore, it is necessary to establish the new legislative amendments, the degree of compliance of personal data protection standards in Ukraine with the relevant standards in the EU. In this paper, as an outcome of estimations of relevant international research, further analytical and comparative analyses, there are some proposals to future institutional features of such modernization, affecting such issues as: clarification regarding material effects in order to limit legal regulation and avoid excessive legal burden on individuals, as well as in some cases on state authorities; providing new definitions of concepts that are not yet available in domestic regulation; establishment of fundamental guidelines for the processing of personal data in accordance with international standards; fostering more sustainable standards for the processing of sensitive personal data; in-depth structuring the issue of processing personal data for a different purpose than the one for which they were collected; regulating the implementation of the rights of personal data subjects, in particular, the right to information, the right to access, the right to correct personal data, the right to be forgotten, the right to personal data mobility, the right to restrict the processing of personal data, the right to protection from automated decision-making, the right of the data subject to protection of their rights and compensation for damage; clarifications regarding the definitions of the duties and responsibilities of the personal data controllers and operator; sustainable regulations concerning the issue of cross-border transfer of personal data.

REFERENCES

1. First report on the implementation of the Data Protection Directive (95/46/EC). Official website of the European Union. URL: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A52003DC0265


2. Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). Official website of the European Union. URL: https://data.consilium.europa.eu/doc/document/ST-9565-2015-INIT/en/pdf


3. EU Member States notifications to the European Commission under the GDPR. Official website of the European Union. URL: https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu/eu-countries-gdpr-specific-notifications_en


4. Chris Jay Hoofnagle, Bart van der Sloot & Frederik Zuiderveen Borgesius. The European Union general data protection regulation: what it is and what it means. Information & Communications Technology Law. 2019. Vol. 28. No. 1. P. 65-98. https://doi.org/10.1080/13600834.2019.1573501


5. Satariano А. Europe’s Privacy Law Hasn’t Shown Its Teeth, Frustrating Advocates. The New York Times. 2020. URL: https://www.nytimes.com/2020/04/27/technology/GDPR-privacy-law-europe.html


6. Three years under the EU GDPR an implementation progress report. Access Now. URL: https://www.accessnow.org/ cms/assets/uploads/2021/05/Three-Years-Under-GDPR-report.pdf


7. Kuner, C. Territorial Scope and Data Transfer Rules in the GDPR: Realising the EU’s Ambition of Borderless Data Protection. University of Cambridge Faculty of Law Research Paper No. 20/2021. April 16, 2021. http://dx.doi. org/10.2139/ssrn.3827850


8. Daigle, B., Khan, M. EU GDPR: An Analysis of Enforcement Trends by EU Data Protection Authorities. Journal of International Commerce and Economics. June, 2020. URL: https://www.usitc.gov/publications/332/journals/jice_ gdpr_enforcement.pdf


9. Poiasniuvalna zapyska do proiektu Zakonu Ukrainy “Pro zakhyst personalnykh danykh” (reiestr. No. 5628 vid 07.06.2021) Ofitsiinyi portal Verkhovnoi Rady Ukrainy. URL: http://w1.c1.rada.gov.ua/pls/zweb2/webproc34?id=&p f3511=32124&pf35401=119742 [in Ukrainian].


10. Pro zatverdzhennia dokumentiv u sferi zakhystu personalnykh danykh: nakaz Upovnovazhenoho Verkhovnoi Rady Ukrainy z prav liudyny vid 08.01.2014 No. 1/02-14. Ofitsiinyi portal Verkhovnoi Rady Ukrainy. URL: https://zakon. rada.gov.ua/laws/show/v1_02715-14#Text [in Ukrainian].


11. Uhoda pro asotsiatsiiu mizh Ukrainoiu, z odniiei storony, ta Yevropeiskym Soiuzom, Yevropeiskym spivtovarystvom z atomnoi enerhii i yikhnimy derzhavamy-chlenamy, z inshoi storony. Ofitsiinyi portal Verkhovnoi Rady Ukrainy. URL: https://zakon.rada.gov.ua/laws/show/984_011#Text [in Ukrainian].


12. Venher V., Zaiarnyi O. Pravovyi analiz osnovnykh modelei instytualizatsii derzhavnoho kontroliu u sferi personalnykh danykh ta dostupu do publichnoi informatsii. Council of Europe. 2020. URL: https://rm.coe.int/legal-analysis-data-ua/16809ee077 [in Ukrainian].


13. Kozlov S. Skandal! Tsyfra? Diia… Yurydychna hazeta. 2020. 2 chervnia. URL: https://yur-gazeta.com/publications/ practice/informaciyne-pravo-telekomunikaciyi/skandal-cifra-diya.html [in Ukrainian].


14. Shchorichna dopovid Upovnovazhenoho Verkhovnoi Rady Ukrainy z prav liudyny pro stan doderzhannia ta zakhystu prav i svobod liudyny i hromadianyna v Ukraini 2019 rik. Upovnovazhenyi Verkhovnoi Rady Ukrainy z prav liudyny. URL: https://ombudsman.gov.ua/files/Dopovidi/zvit%20za%202019.pdf [in Ukrainian].


15. Shchorichna dopovid Upovnovazhenoho Verkhovnoi Rady Ukrainy z prav liudyny pro stan doderzhannia ta zakhystu prav i svobod liudyny i hromadianyna v Ukraini 2020 rik. Upovnovazhenyi Verkhovnoi Rady Ukrainy z prav liudyny. URL: https://ombudsman.gov.ua/files/2021/zvit_2020_rik_.pdf [in Ukrainian].


16. Matola V. “Bahy” derzhavnykh reiestriv, abo yak zakhystyty personalni dani. LB.ua. URL: https://lb.ua/pravo/2020/05/19/457892_bagi_derzhavnih_reiestriv_abo_yak.html [in Ukrainian].


17. Postanova Verkhovnoho Sudu vid 30.01.2019 u spravi No. 308/5318/15-ts. Yedynyi derzhavnyi reiestr sudovykh rishen. URL: http://reyestr.court.gov.ua/Review/79744914 [in Ukrainian].


18. Rishennia Lvivskoho okruzhnoho administratyvnoho sudu vid 21.01.2019 u spravi No. 813/2804/18. Yedynyi derzhavnyi reiestr sudovykh rishen. URL: http://reyestr.court.gov.ua/Review/79279901?fbclid=IwAR3ghlUuzjsm88q kmjPlhloHwLa3-itR1Dd-2yzTalxiZcVZJze9qgASvXM [in Ukrainian].


19. Ukhvala Okruzhnoho administratyvnoho sudu m. Kyieva vid 18.10.2019 u spravi No. 640/19197/19. Yedynyi derzhavnyi reiestr sudovykh rishen. URL: http://reyestr.court.gov.ua/Review/85054313 [in Ukrainian].


20. Vyrok Zavodskoho raionnoho sudu m. Dniprodzerzhynska vid 25.07.2019 u spravi No. 200/6814/19. Yedynyi derzhavnyi reiestr sudovykh rishen. URL: http://reyestr.court.gov.ua/Review/83313961 [in Ukrainian].


21. Postanova Podilskoho raionnoho sudu m. Kyieva vid 07.022020 u spravi No. 758/14158/19. Yedynyi derzhavnyi reiestr sudovykh rishen. URL: http://reyestr.court.gov.ua/Review/87632133 [in Ukrainian].


22. “Surikov proty Ukrainy”: Zberihannia robotodavtsem medychnykh danykh spivrobitnykiv mozhlyve lyshe za umovy yikh strohoi konfidentsiinosti, postiinoho onovlennia ta vykorystannia vykliuchno z metoiu yikh zboru (st. 6 ta st.8 Konventsii, zaiava No. 42788/06 vid 26.01.2017). Protokol. Yurydychnyi internet resurs. URL: https://protocol. ua/ua/surikov_proti_ukraini [in Ukrainian].


23. Natsionalna ekonomichna stratehiia na period do 2030 roku, zatverdzhena postanovoiu Kabinetu Ministriv Ukrainy vid 03.03.2021 No. 179. Ofitsiinyi portal Verkhovnoi Rady Ukrainy. URL: https://zakon.rada.gov.ua/laws/file/text/88/ f503442n31.doc [in Ukrainian].


24. Open Digital Trust Initiative. Institute of International Finance. URL: https://www.iif.com/Innovation/Open-Digital- Trust-Initiative


25. de Carvalho, R.M., Del Prete, C., Martin, Y.S. et al. Protecting Citizens’ Personal Data and Privacy: Joint Effort from GDPR EU Cluster Research Projects. SN Computer Science. 2020. No. 1. Art. No. 217. https://doi.org/10.1007/ s42979-020-00218-8