Upon coming into effect on 20 December 2012 the changes to the Law of Ukraine "On protection of personal data" (the "Law") have simplified procedure of personal data processing in Ukraine since these changes released the owners of personal data from necessity of adherence to numerous "impracticable" procedures in the process of personal data handling. In particular, the changes introduced substantially facilitate the process of processing personal data of subjects operating in Internet, aid the development of e-commerce, cancel the requirement to register the databases of employees etc. Also the list of rights of the subjects of personal data was extended and additional powers to State Service for Protection of Personal Data were granted.   

In particular, the following changes have been introduced to the Law:

·         scope of the Law has been expanded. Prior the changes the Law extended its effect on activity related to creation of personal data databases and personal data processing in such databases, but with the changes made the Law now extends its effect on  personal data handling activities regardless of whether or not they have been included into a database; 

·         the list of grounds for processing of personal data has been expanded. Currently, in addition to the consent on processing of personal data given by a subject of personal data and legislative permission for processing of personal data, the grounds for personal data processing are as follows:

a)     conclusion and execution of a transaction, in which the subject of personal data is a party or which has been concluded in favour of the subject of personal data or for taking actions, which preceded conclusion of a transaction at the request of the subject of personal data;

b)    protection of vital interests of the subject of personal data;

c)     need to protect legitimate interests of the owner of personal data, third parties, except where a subject of personal data demands to stop processing of his/her personal data and the need in protection of personal data prevail over such interest;

·         pursuant to the changes in the Law, obligatory obtainment of the documented, particularly written consent of the subject of personal data on processing of its data was annulled. In this regard, the Law establishes that the consent of the subject of personal data is its expression of will to allow the personal data processing in the form that enables a conclusion on granting of such consent. Thus, the legislative requirement that was effective previously with regard to receipt of the consent of the subject of personal data exclusively in a documented (particularly, written) form is viewed from now on as alternative and non-obligatory;

·         according to the new wording of the Law, personal data owners which maintain their databases to secure and effect labour relations, as well as maintain personal data databases of the members of non-government, religious organizations, professional associations and political parties are released from mandatory registration of such personal data databases. Thus, according to the Law personal data databases of employees currently are not subject to mandatory state registration;

·         the list of rights of the subjects of personal data has been expanded. Particularly, a subject of personal data is now entitled to revoke its consent to be aware of the mechanism of automatic processing of personal data, to appeal violations in the course of personal data processing not only to the State Service for Personal Data Protection but also to the court;

·         the requirement to notify exclusively in writing the subject of personal data on the owner of personal data, composition and content of personal data, its rights, purpose of data collection and the persons receiving personal data within ten days of inclusion of the subject's personal data into the personal data database was excluded from the Law. Thus, according to current wording of the Law a subject of personal data is notified on the above at the moment of collection of its personal data and the written form of such notification is not required by the Law;    

·         changes to the Law expand the sphere of powers of the State Service for Protection of Personal Data, which is now entitled, in particular, to hold onsite and off-site inspections of the owners and/or administrators of personal data;

·         the period for the State Service for Personal Data Protection to take a decision on registration of a personal data database was extended from 10 to 30 working days from the day of submission of a relevant application for registration of a personal data database;

·         it is established that personal data may be transferred to foreign counterparties only on condition of ensuring appropriate level of protection of personal data by the state. According to the Law, such states include member-states of the European Economic Area and signatories to the EC Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data. The list of the states ensuring appropriate level of protection of personal data will be determined by the Cabinet of Ministers of Ukraine. The transfer of personal data to foreign counterparties may also be performed in case of availability of other grounds envisaged by the Law.

Should you have any questions please do not hesitate to contact us:

Natalia Pakhomovska
Legal Director, Head of IPT
T +380 (44) 490 95 75
F +380 (44) 490 95 77
E natalia.pakhomovska@dlapiper.com

Galyna Zagorodnyuk
Legal Director
T +380 44 490 95 75
F +380 44 490 95 77
E galyna.zagorodniuk@dlapiper.com

DLA Piper ukraine llc is part of DLA Piper, a global law firm.

The matters covered in this newsletter are intended as a general overview. This newsletter is not intended, and should not be used, as a substitute for taking legal advice in any specific situation. DLA Piper Ukraine LLC will accept no responsibility for any actions taken or not taken on the basis of this newsletter. If you would like further advice, please contact our Kyiv Team at +380 44 490 9575.