Volodymyr Gurlov
Managing partner

Don't know how to get the license? I can help you with it!

Legal consultation
HomePublicationsComments on legislationProtection of personal data at a Ukrainian company: legal advice

Protection of personal data at a Ukrainian company: legal advice

Views: 596

Many believe that you should think about the protection of personal data only when your company's activity in Ukraine is covered by the GDPR Regulation. In fact, the local laws of Ukraine provide for liability for violation of the protection regime of such data. Usually it is a fine, or other sanctions applied to the company.  

We will tell you how to avoid negative consequences when working with personal data in Ukraine. 

Related article
: How to use GDPR in Ukraine?

What do we mean when we say "processing" and "personal data"?

The processing of personal data is considered practically any action taken by the enterprise) over such data, in particular: collection, storage, depersonalization, sorting, transfer to third parties, deletion, etc.

As for the concept of "personal data, there is no clear list and even a specific concept in the regulations of GDPR or the law of Ukraine on protection of personal data. There is only a rather abstract definition, which says that personal data can include information, which is:

  • directly identifies the particular individual;
  • does not directly identify the person, but contains such data from which it is indirectly possible to identify the person in question.

For example, at your company it was decided to issue a bonus to a specific employee, and the order to issue the bonus explicitly states his details: his surname, first name, existence of an employment relationship with the company, position, amount of remuneration, etc. Such an order falls under the concept of "containing the employee's personal data".

If the order does not contain information on specific persons, but proposes a bonus, for example, by the title of the position, it is considered that it does not contain personal data. On the other hand, if the position is "single" (e.g., the position of director), it is considered that the information contained in such an order allows indirectly identifying such a person, and therefore is his personal data. 

Any information can be considered a personal data, provided that it concerns a specific person.

Related article
: How to do business related to e-commerce in Ukraine

Sensitive data: why is it special?

There is a special subgroup of personal data - "special category of personal data". which includes, for example, information about: 

  • race; 
  • ethnic origin; 
  • gender; 
  • political and religious views; 
  • orientations; 
  • membership in political parties, trade unions and other organizations; 
  • data on health status; 
  • biometric data (fingerprints, blood type / rhesus, etc.).

Such data may only be processed if expressly permitted by law and subject to certain restrictions.

The data that can be processed at the enterprise should be conditioned by the specific purpose of the enterprise, and the volume of such data should be the minimum necessary to fulfill such purpose.

For example, if your company sells furniture, it can not collect data on the health of customers. But on the other hand, it may well collect information about the customer's place of residence, because this information is needed to deliver the goods.

Organization of personal data protection at the company in Ukraine

What is the threat of violation of the order of personal data processing? First of all by the fact that it can be the basis for bringing the enterprise to responsibility, as well as justified claims from the subjects of personal data. 

Our lawyers advise you to perform the following algorithm of actions at the start of business in Ukraine:

  1. Initially determine the data set that an enterprise needs in order to carry out individual goals in its activities; 
  2. to establish the correct order of processing and protection of AP, and thus to protect itself from possible claims.

If you want to avoid troubles related to violation of legislation on protection of personal data in Ukraine - please contact us. We will provide You with professional legal help You need.

Views: 596