Applicability of Data Protection Law in Ukraine: Filing System Criterion

The "Filing System Criterion" determines whether manual processing of personal data falls within the scope of data protection laws. It considers whether personal data is structured in a manner that allows for easy retrieval. In the context of Ukraine, this criterion is addressed under the Personal Data Protection Law (PDPL).

Text of Relevant Provisions

PDPL Art.1(1):

"This Law shall be applied to the activities associated with personal data processing by automated means in whole or in part, as well as with the processing of personal data contained in or to be entered into the filing system by non-automated means."

Original (Ukrainian):

"Цей Закон регулює правові відносини, пов’язані із захистом і обробкою персональних даних, і спрямований на захист основоположних прав і свобод людини і громадянина, зокрема права на невтручання в особисте життя, у зв’язку з обробкою персональних даних."

Analysis of Provisions

The Filing System Criterion in PDPL Art.1(1) specifies that the law applies to the processing of personal data by both automated and non-automated means, provided that the data forms part of a filing system or is intended to form part of a filing system. This provision ensures that personal data, even when processed manually, is subject to data protection regulations if it is structured in a way that allows for systematic retrieval.

Key elements of this provision include:

• Processing by automated means: This includes any processing done using digital or electronic systems.
• Non-automated means: This extends the law’s scope to manual data processing.
• Contained in or to be entered into the filing system: This implies that personal data must be organized in a structured set that can be accessed according to specific criteria.

By including manual data processing within its scope, the Ukrainian PDPL ensures comprehensive data protection coverage. This means that any manual records that are systematically arranged and can be retrieved based on specific criteria are covered by the law.

Implications

For businesses operating within Ukraine, the inclusion of the Filing System Criterion means they must ensure compliance with data protection regulations not only for digital data but also for manual records that are organized in a structured way. This broadens the scope of compliance requirements and highlights the importance of maintaining proper data management practices for all types of data storage systems.

Examples:

• Applies: A healthcare provider in Ukraine maintains patient records in a filing system where documents are organized by patient name and medical history. This system would be subject to the PDPL.
• Does not apply: A small business keeps random notes about customers without any structured organization. This would not meet the Filing System Criterion and thus fall outside the scope of the PDPL.

Understanding and adhering to the Filing System Criterion is crucial for data controllers and processors within Ukraine to ensure that they are fully compliant with data protection laws.