Comparative legal study of the definition and content of personal data in the legislation of Ukraine, the European Union, and other states

Abstract

In the context of the rapid digitalization of management processes, the issue of developing the institution of legal regulation of personal data protection aimed at protecting confidential information and private life acquires exceptional importance within modern information law. The effective Law «On Personal Data Protection» of 2010 is, in our opinion, technologically outdated; therefore, the adoption by the Verkhovna Rada of a new law in the first reading is a step in the right direction. However, the draft law requires careful analysis regarding its compatibility with European and global practices before its full adoption. The article is devoted to the study of the definition and content of «personal data» in Ukrainian legislation, European Union law, and other jurisdictions, in particular the United States, Canada, and the United Kingdom. During the examination of this topic, in addition to the comparative legal method, the historical-legal method was used to consider the evolution of the concept of privacy, alongside the analysis of case law of key decisions of the Court of Justice of the European Union and regulatory acts of various jurisdictions, which allowed for an analysis of the approaches of different legal systems to the topic. The comparative analysis demonstrates that the Ukrainian definition is formally similar to the GDPR; however, it lacks the institutional weight required for the modern digital space. This term is closely linked to the constitutional human and civil rights and freedoms enshrined in the Constitution of Ukraine and to the evolution of the right to privacy. The study revealed the absence in Ukrainian legislation of proper legal regulation of digital identifiers and data generated through artificial intelligence, as well as the absence of regulation of biometric and genetic data as a separate category. It is proven that the gap in privacy protection between Ukrainian and European legislation is structural rather than cosmetic. The article identifies the main gaps in Ukrainian legislation and formulates specific proposals for its reform. The expediency of establishing a separate personal data protection authority is substantiated, which will possess the necessary capacity to implement European GDPR standards and ensure control over the processing of personal data. Additional attention is paid to the case law of the Court of Justice of the European Union, which recognizes digital identifiers and user profiles automatically created based on their online actions as personal data. Judicial practice is an essential element in the evolution of the concept of personal data; in particular, through judicial precedents, the definition of personal data has acquired a dynamic content. Consequently, three key decisions of the Court of Justice of the European Union that significantly expanded the understanding of personal data are examined. The results of the study may be used for the further harmonization of Ukrainian legislation with European Union law and in scientific research in the field of personal data protection.