The Ukrainian data protection authority, the State Service of Ukraine on Personal Data Protection (The Service), has issued a letter (No.10/203-13) to clarify the permitted circumstances for transfers of data outside of Ukraine.
Ukraine is not a member of the EU and therefore has not implemented the EU Data Protection Directive 95/46/EC, including provisions governing cross-border transfers. However, the Law of Ukraine "On Personal Data Protection" (No.2297-VI, dated 1 June 2010) (the "OPDP Law"), is similar to the EU Directive. The Service's letter seeks to clarify that under the OPDP Law, transfers of personal data outside the Ukraine are permitted, provided the transfer and storage of any personal data is only to countries which provide an adequate level of personal data protection. The Service confirms that the following countries are deemed to provide adequate protection:
- The European Economic Area member states
- States party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data
- States on the list adopted by a resolution of the Council of Ministers of Ukraine (publication of the list is pending)
Any transfers that fail to fall within these circumstances will require the signing of an Agreement on Personal Data Transfer in accordance with a template provided by the American Chamber of Commerce in Ukraine.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.