Regulatory and Legal Framework for Personal Data Processing in Ukraine’s Public Electronic Registries

Abstract

The article examines the legal regulation of personal data processing in public electronic registers of Ukraine in the context of intensive digital transformation of public administration and the country’s European integration course. It is established that public electronic registers are among the largest personal data operators in the modern state, and their functioning gives rise to legal conflicts between the principles of openness of registry data and the requirements for the protection of the right to privacy. The article analyses the multi-level system of legal regulation in this sphere, encompassing constitutional guarantees, special legislation – in particular the Laws of Ukraine «On Personal Data Protection» and «On Public Electronic Registers» – sectoral normative acts and subordinate legislation.

The methodological framework of the study is based on general scientific and special legal methods, in particular the dialectical, formal-legal, systemic-structural, and comparative-legal methods, which were used to analyze the legal regulation of personal data protection in public electronic registers, identify legislative gaps, and formulate proposals for its improvement.

The key principles of personal data processing in registry systems are examined: lawfulness, functional sufficiency, purpose limitation, accuracy and data security. It is revealed that the practice of aggregating registry data through integrated electronic service portals significantly complicates compliance with the data minimisation principle and creates additional risks to the confidentiality of citizens’ personal information. The standards of the EU General Data Protection Regulation (GDPR) and the case law of the Court of Justice of the European Union are examined as key reference points for the harmonisation of national legislation.

The main gaps in the current legislation are identified: an excessively broad range of persons entitled to special access to registry data; the absence of a legislatively enshrined «privacy by default” principle; and the fragmented regulation of cross-border transfers of registry data. Proposals are formulated regarding the differentiation of legal access regimes for registry data, the codification of information legislation, and the strengthening of cybersecurity measures at the normative level.