Personal data processing in state information systems: administrative, legal, and technological regulation

The administrative and legal regulation of personal data processing in state information systems (SIS) is
becoming increasingly important because of the development of e-government and digital identification
systems. The aim of the study is to establish how legal instruments ensure lawful, transparent, and secure
data processing. The methodology includes comparative legal analysis, documentary review, and case
studies, with a focus on jurisdictions with developed e-government.
Significant discrepancies between norms and practice were identified, especially in the areas of
accountability, data minimization, and cross-border exchange. In Germany, the BundID system provides
legal certainty thanks to clear obligations enshrined in federal law. Legal transformation is ongoing in
Ukraine (the Diia platform). Most systems lack effective oversight and are not adapted to technological
changes. The user access to the X-Road-based platform complies with Articles 5 and 6 of the General Data
Protection Regulation (GDPR) regarding the lawfulness of processing and identification. The Delphi
procedure revealed only 12% agreement on the criteria of minimization and user autonomy.
It is necessary to update the legal framework, implement risk-based control, unify standards with
international norms. Research into automated tools and adaptive management models using artificial
intelligence (AI) and biometrics is promising.