THE INNOVATIONS OF BILL NO. 8153 AND THEIR IMPACT ON THE IT INDUSTRY

Abstract

To conduct a legal analysis of Draft Law of Ukraine No. 8153 “On the Protection of Personal Data” which has been adopted as a basis by the Verkhovna Rada of Ukraine and is currently being prepared for its second reading, to assess its compliance with European standards (GDPR).Content: This study focuses on the implementation of European standards (GDPR) into national law and the resulting conflicts. The article critically examines the problem of the outdated paradigm of the current 2010 Law and its failure to meet the challenges of the digital economy. The author provides a detailed analysis of the transformation of the conceptual framework (the introduction of the terms “joint controller,” “controller,” and “processor”), new institutions (DPO, Privacy by Design, and others), as well as mechanisms for cross-border data transfers, particularly to non-European jurisdictions that lack an adequate level of data protection. Particular attention is paid to the legal characterization of roles in IT outsourcing and the risks of joint and several liability through the lens of current CJEU case law. The article examines the experience of GDPR implementation in the European Union and the negative consequences for small and medium-sized businesses. Separately, the article analyzes the impact of establishing a new supervisory authority, as provided for in Draft Law of Ukraine No. 6177 “On the National Commission for the Protection of Personal Data and Access to Public Information,” and the transfer of powers from the Ombudsman to this body. The article analyzes the business risks that the implementation of Law of Ukraine No. 8153 “On the Protection of Personal Data” may pose for business entities in Ukraine, particularly regarding the establishment of technical capabilities for the protection of personal data, including designed privacy and privacy by default Results and Conclusions: The researcher concludes that a mechanical application of regulations without considering technological processes (CI/CD, data archiving) could lead to legal uncertainty and proposes specific amendments to the draft law.