Ukraine Jurisdiction: Prospective Filing System Inclusion

The factor of Prospective Filing System Inclusion is explicitly addressed in Ukraine's Personal Data Protection Law (PDPL). This factor ensures that the law applies to data processing activities conducted manually if the personal data is intended to be part of a filing system.

Text of Relevant Provisions

PDPL Art.1(1):

"This Law shall be applied to the activities associated with personal data processing by automated means in whole or in part, as well as with the processing of personal data contained in or to be entered into the filing system by non-automated means."

Original (Ukrainian):

"Цей Закон регулює правові відносини, пов’язані із захистом і обробкою персональних даних, і спрямований на захист основоположних прав і свобод людини і громадянина, зокрема права на невтручання в особисте життя, у зв’язку з обробкою персональних даних."

Analysis of Provisions

• PDPL Art.1(1) clearly extends the scope of Ukraine’s data protection law to include non-automated processing of personal data, provided that the data "is contained in or to be entered into the filing system." This provision is designed to ensure that data processing activities are subject to the law even if the data is not yet fully organized but is intended to be included in a filing system.
• The inclusion of the phrase "to be entered into the filing system" is significant because it captures data that is not yet part of a formal filing system but is intended to be. This prevents data controllers from avoiding legal obligations by delaying the organization of data into a filing system.
• The rationale behind this inclusion is to prevent loopholes in data protection where manual processing activities could escape regulation if they are not yet part of a structured filing system. This approach ensures that data is protected from the moment it is collected with the intention of later being organized into a filing system.

Implications

• For businesses operating in Ukraine, this provision means that any manual processing of personal data is subject to the PDPL if there is an intention to later include the data in a filing system. Companies must be aware that even at the initial stages of data collection and processing, they are required to comply with data protection regulations.
• An example of this would be a healthcare provider manually recording patient information with the intention of later digitizing the records into a database. Even before the digitization occurs, the provider must ensure compliance with the PDPL because the data is intended to form part of a filing system.
• This provision emphasizes the need for businesses to implement data protection measures from the outset of any data processing activity, as the law's applicability is triggered by the intention to structure the data, not merely by its current state.