Kazakhstan is continuously working to strengthen the protection of personal data. Now the Rules on the collection and processing of personal data (the “Rules”) have been adopted on the basis of the previously adopted special law on personal data.
The Rules regulate two new important issues:
- Another effective measure for personal data protection is established: an individual’s ability to appeal to the Ministry of Digital Development, Innovation and Aerospace Industry in order to check specific subjects’ compliance with the requirements for the collection and processing of personal data. The Ministry examines the appeal within 30 calendar days from the date of its receipt. This mechanism will allow citizens to protect their rights without going to court. In addition, the ability to initiate verifications will help uncover serious violations and achieve greater compliance with the law.
- The procedure for personal data protection in the texts of court acts is regulated. Now access to personal data of participants in court proceedings may be limited when publishing the texts of court acts on the Supreme Court website.
The texts of court acts may contain quite sensitive personal data, for instance surnames, names and patronymic names, date and place of birth, place of residence, phone numbers, passport or other identifying documents, data on property, etc. The publication of court acts in open sources containing personal data has raised many questions for a long time.
Now anyone who collects, uses or distributes court acts is obliged to exclude (depersonalize) personal data from such court acts. Thus, for example, reprinting of court acts in any publication requires personal data excluding or depersonalizing. Moreover, according to the Rules, participants in court proceedings or court chairpersons may limit the general access to personal data contained in court acts and court records of open proceeding. It is assumed that the above innovations will increase the level of personal data confidentiality in Kazakhstan.
The basic requirements for the collecting and processing of personal data do not change – as before, an individual’s consent is required for the collection and processing; and personal data must be stored in Kazakhstan.
The Rules became effective on November 8, 2020. The Rules can be found at the following link. If you have any questions about this Alert, please contact us.
- Owners, operators of databases containing personal data and third parties. ↩