THE PERSONAL DATA PROTECTION UNDER UKRAINIAN LEGISLATION AND GDPR. ЗАХИСТ ПЕРСОНАЛЬНИХ ДАНИХ ЗА ЗАКОНОДАВСТВОМ УКРАЇНИ ТА GDPR

Abstract

The focus of this study is a comparative legal analysis of the concept of “personal data” and the legal grounds for its processing under Ukrainian legislation and the General Data Protection Regulation (GDPR) of the European Union. Particular attention is given to the fact that the definitions of “personal data” under both national law and the GDPR are largely aligned, broadly referring to any information relating to an identified or identifiable natural person. The study thoroughly examines the legal grounds for processing personal data, which the author classifies into two principal categories: processing based on the data subject’s consent and processing based on alternative legal grounds that do not require consent. These include, among others: processing authorized by law for the performance of official duties by the data controller; processing necessary for the conclusion or execution of a contract to which the data subject is a party or in their interest; processing to safeguard the vital interests of the data subject; processing required to fulfill a legal obligation imposed on the data controller; and processing necessary to protect the legitimate interests of the controller or a third party, provided these do not override the fundamental rights and freedoms of the data subject. The legal framework for personal data processing is grounded in a clear delineation of when and how each of these legal bases may be applied. This structure is intended to strike a balance between the operational needs of data controllers and individuals’ rights to informational privacy. The research further explores judicial practice related to the application of these legal grounds, with emphasis on the requirement that consent must be voluntary and informed – specifying the purpose, duration, and scope of data use. Recommendations are made for improving Ukraine’s legal framework for personal data protection, especially in light of analyzed court decisions and ongoing European integration efforts. The methodology employed combines general scientific methods such as analysis, synthesis, induction, deduction, and comparative legal and formallegal approaches, with specialized techniques including interpretation and case study analysis. The goal of the study is to identify key patterns in the legal regulation of personal data processing through a comparative analysis of Ukrainian legislation, the draft Law of Ukraine “On the Protection of Personal Data,” the GDPR, and judicial practice. This analysis aims to support legislative reform and enhance the protection of the individual’s right to privacy. In conclusion, the current system for protecting personal data in Ukraine requires significant reform. This includes harmonization with European standards, increasing public legal awareness, and enhancing the accountability of data processors. Adhering strictly to the legal grounds for data processing fosters responsible data use and empowers individuals to maintain control over their personal information – thereby ensuring more effective realization of the right to privacy in the digital age.