22 July 2020
.jpg)
This Alert summarizes the most significant amendments to digital technology regulations introduced by the Law «On introduction of amendments to certain legislative acts of the Republic of Kazakhstan on digital technology issues»1 (hereinafter – the "Amendments") entered into force on July 6, 2020.
The Law “On personal data and its protection”2 (hereinafter – the “PD Law”) has been changed as follows:
- The Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan has been designated as the authorized body with the Office for the Protection of Personal Data under the Committee on Information Security of the Ministry.
- The collection, processing of personal data can now be carried out by a third party. We note the need to obtain the prior consent of the subject or his legal representative.3 Along with this, third parties shall anonymize personal data obtained in the course of scientific, sociological, including marketing research.4
- It is worth mentioning that the processing of personal data is to be limited to the achievement of specific, predetermined and legitimate purposes. The law prohibits the processing of personal data incompatible with the purposes of collecting personal data.5
- The Amendments provide for the concept of “voluntary cyber insurance”, the types and procedure of which are determined by the agreement of the parties.6
- By analogy with the provisions of the GDPR adopted in the countries of the European Union, the Amendments introduced the concept of “a person responsible for organization of the processing of personal data”. Thus, besides the owner and / or operator of the PD, another person is appointed as a responsible for the compliance of the processing of PD with the legislation of the Republic of Kazakhstan. In particular, such person provides the opportunity to familiarize themselves with personal data related to the subject of the PD; in case the owner and (or) operator is a legal entity, it is entitled to appoint a person responsible for organization of the processing of personal data.7
- The competence of the authorized body was put in a separate article, thereby delimiting the competence of state bodies, the Government of the Republic of Kazakhstan and the authorized body.8
Moreover, the Amendments provide a requirement of confidentiality with respect to personal data that became known to the authorized body in the course of its activities.9
The law-maker introduced the following amendments to the Law “On Informatization”10:
-
The Amendments introduced the concepts of “blockchain”, “digital mining”, “digital token”, “digital asset”, etc. Blockchain is defined as an information and communication technology that ensures the constancy of information in a distributed data platform based on a chain of interconnected data blocks, given integrity confirmation algorithms and encryption tools.11
-
Blockchain is a way to store data. Transaction data is stored in blocks, which in their turn comprise a chain. The advantage of using this technology is that the risk of break into such a database is reduced, since each subsequent block in the chain enhances the verification of the previous one with a hash12 that links the blocks together and prevents any block from change or insertion between two existing blocks.
-
Digital mining – the process of performing computational operations using computer and energy capacities in accordance with the specified encryption and data processing algorithms, which ensures the integrity of data blocks in information objects via blockchain.13
-
The competence of the authorized body in the field of informatization, namely the Ministry of Information and Social Development of the Republic of Kazakhstan has been expanded. Now, the Ministry:
-
approves the rules for the collection, processing, storage, transfer of electronic information resources for the implementation of data analytics in order to fulfill the functions of state bodies in coordination with the authorized body in the field of personal data protection;
-
approves the rules for the formation, verification and use of electronic documents using the digital document service;
-
An authorized body, ensuring information security, namely the Committee on Information Security of the Ministry of Digital Development, Innovation and the Aerospace Industry of the Republic of Kazakhstan, determines the procedure for informing on activities for the implementation of digital mining, and the procedure for the issue
-
-
The competence of the authorized body in the electronic industry – the Department of Electronic Industry Development of the Ministry of Digital Development, Innovation and Aerospace Industry of the Republic of Kazakhstan was set forth in a separate article, thereby clearly delimiting the competence of the authorized bodies in the areas: electronic industry, ensuring information security and informatization.14
-
The Amendments establish the legal regime of digital assets, as well as their classification.15 Thus, a digital asset is the result of digital mining and does not serve as means of payment. The Amendments provide for the classification of digital assets as secured and unsecured. Secured digital assets include a digital token and other digital assets, which are a digital means of certifying property rights to goods and (or) services issued (provided) by a person who issued a secured digital asset. Unsecured digital assets include digital tokens received as a reward for participating in maintaining consensus on the blockchain.16
With regard to the formation and use of electronic information resources, the Amendments stipulate a provision in accordance with which third parties' access to electronic documents stored in the digital document service is carried out with the consent of the user in the manner determined by the authorized body. 17 The amendments also affected the Code “On Administrative Violations”18 (hereinafter referred to as the “Administrative Code”):
The Amendments provide for liability for improper implementation by a third party of the measures to protect information systems.19 This measure is necessary to prevent the illegal collection of personal data of citizens, as well as its use for previously undeclared purposes.
The Law “On the electronic document and electronic digital signature”20, has been amended as follows:
Due to difficulties in the technical implementation of the recognition of foreign registration certificates, the provision stipulating this issue was excluded.21 Thus, a foreign citizen or legal entity shall obtain registration certificates of the National Certification Authority of the Republic of Kazakhstan.
For further information, please contact:
Saniya Perzadayeva, Managing Partner, Unicase Law Firm
saniya.p@unicaselaw.com
1 The law of the Republic of Kazakhstan dated June 25, 2020 2 The law of the Republic of Kazakhstan dated May 21, 2013 3 Article 9 of the PD Law
4 para 1 Article 17 of the PD Law
5 paragraphs 4 and 5 of the Article 7 of the PD Law 6 Article 23-1 of the PD Law
7 Para 2 of the Article 24 of the PD Law
8 Article 27-1 of the PD Law
9 Para. 2 of the Article 27-1 of the PD Law
10 of the Republic of Kazakhstan dated November 24, 2015
11 Para.38-2 Article 1 of the law on Informatization
12 Hash – the conversion of an array of input data of arbitrary length into a (output) bit string of a specified length, performed by a certain algorithm 13 Para 55-3 of the Article 1 of the law on Informatization and circulation of secured digital assets. These amendments were introduced due to the introduction of new concepts into the Law.
14 Article 7-6 of the law on Informatization
15 Article 33-1 of the law on Informatization
16 Para 2 Article 33-1 of the law on Informatization
17 Article 35 of the law on Informatization
18 of the Republic of Kazakhstan dated July 5, 2014
19 Sub. para. 1 para. 1 of the Article 641 of the Administrative Code
20 The Law of the Republic of Kazakhstan dated January 7, 2003
21 Article 19 of the law on the electronic document and electronic digital signature
