OLX and Ukr.net occupy leading positions, while Silpo improving its privacy policy
Results of the “Personal Data Protection Index 2023” study
On July 26, NGO Internews-Ukraine presented an independent study of Ukraine's key private companies in telecommunications, internet, and online services — "Personal Data Protection Index 2023".
Lawyers and digital technology experts analyzed the privacy policies of 20 sites and 10 applications of technology companies that interact with customers in the digital space: Rozetka, OLX, Nova Poshta, Comfy, MAKEUP, Silpo, Bolt, Liki24, Uklon, Glovo, Epicenter, Bus for and others.
Read the full research
According to the criterion of personal data protection, OLX and UKR.NET sites showed the best results for the second time in a row, and Bolt, Liki24, and Uklon are the leaders among applications this year. Their privacy policies in the main comply with the provisions of Ukrainian legislation in the field of personal data protection and correlate with the EU General Data Protection Regulation. In 2023, progress with privacy policies was demonstrated primarily by Silpo, Rozetka, and Nova Poshta (compared to the results of the 2021 study). The sites of Citrus, MAKEUP, and Kasta.ua, and the applications of Epicenter and Busfor received lower scores - these companies should improve their privacy policies.
Ukrainian businesses are increasingly adapting their corporate policies to GDPR provisions. "During European integration, it is important that private companies not only comply with the legislation on personal data protection but are also ready to implement European standards. We see that this is happening gradually," one of the study's authors, Alina Pravdychenko, a lawyer in media law and personal data protection, said.
Apps generally performed better than company websites. 80% of applications (8 out of 10) received at least 50% of all possible points according to the criteria for personal data protection, while among sites just half of companies received at least 50% out of 100% possible points.
Companies were provided with recommendations for privacy policies:
- To adhere to the data minimization principle - collect only the necessary date of users for providing service.
- To prescribe which personal information is transferred to third parties in a more clear and comprehensive way.
- To simplify the privacy policy by making it easier and more accessible to the user - without red tape.
- To indicate the period during which the company will store user data.
- To clarify the security of data storage and the geographical location of servers (EU countries or Ukraine) for users.
"Even when the cities of Ukraine find themselves under constant shelling, national business has managed to continue providing services for its customers. And some companies are even able to improve their corporate policies and protect the digital rights of users," project expert and digital technology consultant, Vitaly Moroz, said.
Pavlo Belousov, an expert on digital security at NGO Internews-Ukraine, added: "The more that citizens are concerned about the protection of their data, the faster business will change for the better. Then every year we will record growth in the Personal Data Protection Index."
Study methodology
Experts studied the official websites of companies, analyzed users' online interactions with companies, and sent out individual requests.
Evaluation categories:
- compliance with the requirements of current legislation of Ukraine on personal data;
- compliance with European standards on personal data;
- technological aspects of the website in question;
- usability of the site and inclusiveness.
In each category, 3 to 6 questions were prepared, with answers that awarded from 0 to 1 point to companies.
Experts openly share the details of the evaluation and emphasize that the inclusion of private sector representatives in the list of companies studied is already recognition of their leadership on the market.
For additional information, please contact the project coordinator, Sofiia Lavreniuk, on slavreniuk@internews.ua.
This expert study was prepared by NGO Internews-Ukraine within the auspices of the Updating privacy in the digital sphere in Ukraine project, supported by the ABA ROLI Ukraine / Rule of Law Initiative. The material reflects the position of the authors and does not necessarily reflect the position of the ABA ROLI Ukraine / Rule of Law Initiative.