IMPLEMENTATION OF GDPR STANDARDS INTO THE CIVIL LEGISLATION OF UKRAINE

Abstract

The article develops a private-law model for implementing the standards of the General Data Protection Regulation into Ukrainian legislation. The central problem is not the complete absence of national rules concerning information about an individual, but the fragmented relationship of those rules with the doctrines of personal non-property rights, transactions, obligations and civil remedies. The purpose of the study is to identify the criteria according to which individual GDPR standards should be incorporated into the Civil Code of Ukraine, specified in special legislation, or remain outside civillaw codification. The research employs formal legal, systemic, comparative and functional methods and analyses the case law of the Constitutional Court of Ukraine, the Grand Chamber of the Supreme Court, the Court of Justice of the European Union and the European Court of Human Rights. It is argued that the relevant criterion is not the formal location of a provision in the GDPR but its legal function in defining a subjective right, the limits of private autonomy, a private duty or a remedy restoring an infringed legal position. The article therefore distinguishes between fundamental privatelaw guarantees suitable for inclusion in the Civil Code, detailed regulatory rules that should remain in personal data protection legislation, and institutional or administrative enforcement mechanisms that do not belong to civil-law codification. The right to personal data protection should be constructed as a personal non-property right with an open but legally determinable set of entitlements. Consent is characterised as a unilateral legally relevant declaration of will whose validity neither removes the controller’s duties nor turns personal data into property. A two-level model is proposed: the Civil Code should determine the individual’s private-law status, limits of contractual autonomy and civil remedies, while special legislation should regulate procedures, organisational duties, supervision and sanctions.