The Automated Means Criterion in Ukraine's Personal Data Protection Law (PDPL) extends the law's applicability to data processing activities that involve automated means, either "in whole or in part" ("повністю або частково"). This provision is significant as it ensures that the law covers a wide range of data processing activities, including those that may only partially rely on automated systems.

The criterion is not limited to fully automated processing but also encompasses partially automated processes. This broad approach reflects the lawmakers' intention to address the various ways in which personal data can be processed using technology.

Additionally, the provision extends the law's applicability to non-automated processing of personal data that is contained in or intended to be included in a filing system. This extension ensures that the law covers both digital and physical data processing methods, providing comprehensive protection for personal data.

Implications

The inclusion of the Automated Means Criterion in Ukraine's PDPL has several implications for businesses and organizations:

1. Wide coverage: Companies using any form of automated data processing, even if only partially, must comply with the law. This includes the use of digital databases, computer systems, or any electronic means of data processing.
2. Partial automation: Organizations that combine manual and automated processes in their data handling activities are still subject to the law's requirements.
3. Future-proofing: The broad language of "automated means" allows the law to remain relevant as new technologies emerge, without requiring frequent updates to the legislation.
4. Non-automated systems: Even traditional paper-based filing systems are covered if they are structured in a way that makes personal data readily accessible.
5. Compliance considerations: Companies must assess all their data processing activities, including those that may only partially involve automated means, to ensure full compliance with the PDPL.
6. Technological neutrality: The law applies regardless of the specific technology used for data processing, focusing on the nature of the processing rather than the tools employed.