Consent to personal data processing as a juridical fact in Ukrainian civil law: a comparative analysis of national legislation and the GDPR

Abstract

The article examines the civil-law nature of consent to personal data processing in the context of the digitalisation of private relations and the approximation of Ukrainian law to European data-protection standards. The analysis proceeds from the proposition that consent is not exhausted by its formal function as a legal basis for processing. It is also a legally relevant manifestation of private autonomy and informational self-determination. The purpose of the study is to determine the place of consent within the system of juridical facts in civil law and to clarify its relationship with a juridical act, a contract, personal non-property rights and the approach adopted by Regulation (EU) 2016/679. The methodology combines formal legal, systemic, comparative and functional methods. The article demonstrates that consent contains an expression of will but is not always directly aimed at creating, modifying or terminating civil rights and obligations in the traditional sense of a juridical act. Its principal function is to legitimise a specific processing operation or a set of operations for a defined purpose, while it may simultaneously influence contractual, protective and compensatory relations. It is proposed to classify consent as a special juridical fact sui generis with a personal non-property origin, informational content and potential law-of-obligations consequences. The requirements of freely given, specific, informed, unambiguous, separate and withdrawable consent are analysed. Consent incorporated into standard contractual terms cannot automatically be treated as freely given, especially where the processing is not objectively necessary for contract performance or where a substantial imbalance exists between the parties. Withdrawal is characterised as an independent juridical fact that terminates the relevant legal basis for future processing without retroactively invalidating previous lawful operations and without necessarily terminating the underlying contract. The civil-law consequences of defective consent are systematised: cessation of processing, erasure of data, prohibition on using the results of unlawful processing, compensation for pecuniary and non-pecuniary damage, and other remedies. The scientific novelty lies in a functional model of consent as a juridical fact distinct from a juridical act but capable of producing private-law consequences. The article proposes that Ukrainian legislation should expressly regulate the burden of proving consent, granularity, ease of withdrawal, the prohibition of conditioning a service on unnecessary processing, and the consequences of defective expressions of will. The findings may be applied by courts, controllers, digital-service developers and lawmakers. Further research should address contractual consequences of withdrawal, children’s consent, profiling and the controller’s civil liability.