Personal data cybersecurity: administrative and legal protection mechanisms

Abstract

This study aims to identify the main administrative and legal mechanisms for ensuring the cybersecurity of personal data as defined within various legal systems. The article notes that Ukraine’s legal system, like that of the EU, employs fairly similar administrative and legal mechanisms to ensure the cybersecurity of personal data. It has been established that Ukrainian legislation provides for the use of: 1) regulatory and legal measures to ensure the cybersecurity of personal data (establishing mandatory requirements for the protection of information by data controllers, data owners, and third parties upon whom corresponding obligations and responsibilities in this area are imposed); preventive measures to avert negative consequences arising from cyber threats, cyberattacks, or cyber incidents, including the establishment of response protocols for such threats and challenges; reactive measures (mitigating the negative consequences of such challenges and threats) and preventive measures related to the development and provision of recommendations to prevent cyber threats, cyberattacks, and cyber incidents that would have negative implications for the cybersecurity of information (including personal data). EU legislation establishes the following administrative and legal mechanisms for ensuring the cybersecurity of personal data, specifically: regulatory safeguards for the cybersecurity of personal data, which include provisions of EU laws and subordinate legislation aimed at maintaining the security of network and information systems, as well as protecting users and other individuals in the event of breaches of confidentiality and loss of personal data; the use of technologies to detect internal cyber threats; and the application of legal remedies, liability provisions, and fines for violations of legislation regarding the cybersecurity of personal data. At the same time, Ukrainian legislation, unlike European legislation, does not sufficiently define legal remedies, liability, and penalties for violations of laws regarding the cybersecurity of personal data, which points to further prospects for development and the exploration of ways to improve this area. It was concluded that it is important to establish regulations governing the right to cyber protection of personal data at both the EU and Ukrainian legislative levels. The need to implement this type of right has become urgent given the rapid growth of threats and challenges faced by individuals in cyberspace at the current stage of development of the digital intellectual environment. Keywords: cybersecurity, personal data, national cyber threat response system, cyberattacks and cyber incidents, national system for exchanging information on cyber threats, cyberattacks, and cyber incidents, EU, Ukraine, administrative and legal mechanisms for ensuring the cybersecurity of personal data.