Expected Amendments To The Legislation On Personal Data: Requirement For 'Localization Of Personal Data' In Kazakhstan

Active use of the Internet—in particular social networks—by users in Kazakhstan, where the information contains personal data (i.e. name, date of birth, residential address, place of work/study, personal photos, etc.); the growing number of cases of leaked personal data; concerns regarding "Internet surveillance" on the part of some states about nationals of other states – all these elements have set the scene for the initiation of a legislative requirement for "localization of personal data" in Kazakhstan.

Such measures have proved controversial when introduced in other countries. Although proponents of these rules say that they are necessary to protect against foreign threats to information security, critics describe them as leading to potential restrictions on freedom of information, loss of privacy and the facilitation of State surveillance and censorship.

It is planned to add to the RK Law dated 21 May 2013 No. 94-V "On Personal Data and Protection Thereof" (hereinafter referred to as "the Law") a rule obliging owners and/or operators to keep personal databases in the territory of Kazakhstan (proposed changes are underlined):

1 Article 12 of the Law: Accumulation and Storage of Personal Data 1. Accumulation of personal data shall be carried out by collecting personal data, necessary and sufficient to accomplish the tasks carried out by the owner and/ or operator, as well as by a third party.

  1. Storage of personal data shall be carried out by the owner and/ or operator, as well as by a third party in the database, which is kept in the territory of the Republic of Kazakhstan.

The period of storage of personal data shall be determined by the date of the achieving the objectives of the data collection and processing, unless otherwise provided by the legislation of the Republic of Kazakhstan".

To date, Kazakhstan operators and/or owners of the databases that contain personal data are typically registered abroad and, as a consequence, they maintain the databases outside the jurisdiction of the Republic of Kazakhstan (such operators and owners, for example, are Google, Microsoft, Facebook, Apple, VKontakte, etc.). In such cases, law enforcement agencies are deprived of direct access to the personal data of RK citizens. It is argued that this creates a threat to the informational security of the country. The aim of the planned changes is to prevent the moving and storage of personal data outside of the Republic of Kazakhstan.

The requirement...

To continue reading

Request your trial

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT