Duty LXD-1407
Processes biometric data, in Ukraine
Each law's tag says when it binds: since in force proposed proposed
Law of Ukraine On the Protection of Personal Datasince 6 lines
Zakon Ukrainy Pro zakhyst personalnykh danykh No. 2297-VI, in force (Law of Ukraine No. 2297-VI) · Read the law's page
- Establish a lawful basis before processing personal data of a person in Ukraine under Law No. 2297-VI.
- Tell a data subject in Ukraine who the controller is, what personal data was collected, the data subject's rights under the Law, the purpose of collection and who receives the data, at the moment of collection where the data is collected from the data subject and otherwise within thirty working days from collection, except where a law provides otherwise, under Article 12(2) of Law No. 2297-VI.
- Do not process biometric or genetic data of a person in Ukraine unless a case listed in Article 7(2) of Law No. 2297-VI applies, such as the data subject's unambiguous consent to that processing.
- Notify the Ombudsperson of processing of biometric data, genetic data, health data, or another category the Ombudsperson lists as posing a special risk, within thirty working days from the start of that processing, under Article 9 of Law No. 2297-VI; this law does not define biometric data anywhere, including in its Article 2 definitions.
- Transfer personal data of a person in Ukraine to a foreign party only where the receiving state ensures adequate protection, which the law deems met by European Economic Area states, Convention 108 signatories and states whose capital-market regulators signed the IOSCO Multilateral Memorandum of Understanding.
- Expect a person in Ukraine to be able to complain about the processing of their personal data to the Ombudsperson or to a court under Article 8 of Law No. 2297-VI.
Draft Law No. 8153 on Personal Data Protection (GDPR-Aligned Reform)proposed4 lines
Draft Law of Ukraine No. 8153, first reading passed (processing principles, legal bases, data protection by design, DPO, art. 39 DPIA) · Read the law's page
- Process personal data of a person in Ukraine only on a ground listed in Article 5 of the draft, which includes the legitimate interests of the controller or of a third party under Article 5(1)(6), and apply the processing principles in Article 4 of the draft.
- Implement data protection by design and by default under Article 29 of the draft.
- Designate a data protection officer where the core activities of the controller or processor consist of or relate to processing personal data of a person in Ukraine on a large scale, which reaches biometric and genetic data, under Article 41(1)(3) of the draft.
- Carry out the data protection impact assessment that Article 39 of the draft provides for, and consult the supervisory authority under Article 40 where it indicates a high risk for data subjects.