On December 20, 2012 became effective amendments to the Law of Ukraine “On Protection of Personal Data” (hereinafter – the “Law”), which are foreseen by the Law of Ukraine “On Introduction of Amendments to the Law of Ukraine “On Protection of Personal Data” No. 5491-VI dated November 20, 2012, adopted by the Ukrainian Parliament with consideration of theproposals of the President of Ukraine.

The new edition of the Law is aimed at improvement of legal regulation in the sphere of personal data protection. Although the introduced mendments do not completely eliminate all existing drawbacks ofthe Law, certain amendments can be evaluated as positive.

In particular, the Law now establishes that the consent of the individual may be granted not only in written form, but also in other form, which allows concluding that the consent was granted. In fact, now the consent of an individual will be sufficient, if provided in electronic form (e.g. per e-mail, fax, etc.) or by putting a “tick” on the company’s website, subject to the availability of sufficient resources/facilities for storage of electronic documents so that the company could prove in future that the consent had beenprovided.

In addition, the Law also foresees release from the necessity to register personal data filing systems, the conduction of which is related to ensuring and realization of labour relations, and that of the members of non-governmental, religious organizations, professional unions and political parties. It should be noted, however, that in this case the release from the obligation to register a personal data filing system does not relieve its owner of any other obligations related to the personal data processing and protection as provided by the Law (e.g. the development and approval of internal regulations on personal dataprotection, stating the clear purpose of personal data processing, etc.).

The rights of individuals in the Law were supplemented with the following rights:

• to withdraw consent for processing of his/her personal data;
• to make reservations regarding restrictions on personal data processing at the time of granting the consent;
• to know the mechanism of automated processing of personal data;
• to be protected from automated solutions, which may have legal consequences for the relevant subject; and
• to address the court with claims related to processing of his/her personal data.

The list of grounds for personal data processing was significantly extended. In addition to the previously existing two grounds (consent of the individual and processing based on the law), the following groundswere added into the Law:

• conclusion and execution of the agreement, to which the individual, whose personal data is processed, is a party, or which is concluded in favor of such individual or for execution of actions, preceding the conclusion of an agreement upon the request of such individual;
• protection of vitally important interests of individuals, whose personal data is processed;
• necessity of protection of legal interests of owners of personal data, third parties, except for cases when the individuals, whose personal data is processed, require the processing of personal data to be stopped and the necessity of protection of personal data overwhelms such interest.

The new wording of the Law also grants the right to challenge in court the decision on postponement ordenial of access to personal data.