Ukraine the previous one, for further data processing, the data controller, except in cases specified by law, must obtain the consent of the data subject to process the data in accordance with the new purpose. As to the Special Risk Data, its processing is allowed only if unambiguous consent has been given by the data subject or based on exemptions envisaged by the PDP Law (e.g., for employment and healthcare purposes, protection of the vital interest of the data subject, law enforcement intelligence or counterintelligence activity, anti- terrorism). Under the general rule, the data controller must notify the Commissioner of processing Special Risk Data within 30 business days from the start of such processing. There is also an obligation to notify the Commissioner in cases of the alteration of Special Risk Data or termination of its processing. 3.2. Statutory exemptions The processing of personal data is allowed without adherence to the provisions of the PDP Law if such processing is made: (a) by a natural person purely for personal or household needs; (b) exclusively for journalistic and creative purposes, given a balance is ensured between the right to respect the private life and the right of freedom of expression. The PDP Law also does not cover relations on the receipt of archival information from repressive bodies. In specific cases, i.e., in cases provided by law to the extent required in a democratic society in
the interests of national security, economic welfare or protection of the rights and freedoms of data subjects or other persons, certain provisions of the PDP Law may be limited. 3.3. Territorial and extra-territorial application The PDP Law does not specify the territory of its application. However, according to the general principles of Ukrainian law and practice, it may be interpreted to apply to all personal data processed in the territory of Ukraine.
https://www.peterkapartner s.com/en/local/kyiv/
Made with FlippingBook - PDF hosting