Personal Data Protection

"The one, who owns the information, owns the world". Sir Winston Churchill

We live in the world of high technologies, where information is available for everyone. Nowadays, well-developed technologies afford people to have an access for any type of data. In the Information Age personal data became a crucial topic in the area of the Human Rights protection. Personal data laws are developed in order to protect civil rights and freedoms of people, to secure the privacy of individuals' lives.

In Kazakhstan personal data protection law was introduced in 2013, and lately the State introduced some amendments to the Law of the Republic of Kazakhstan On Personal Data Protection dated 21 May 2013 No.94-V (hereinafter the "Personal data law"), which raised discussion within population and legal community.

In order to understand the issue regarding introduced amendments which led to the discussion, we need to understand the core of personal data protection law. According to the legislation1, personal data shall be defined as data related to a specific individual or an individual who may be identified on the basis thereof and which are recorded on electronic, paper and/or other objects. While personal data protection is the package of measures, including legal, organisational and technical. These measures are performed in order to protect an individual's rights and freedoms in connection with the collection and processing of its personal data2.

Below are given some of the major regulatory legal acts which form a base for regulation of personal data protection:

Constitution of the Republic of Kazakhstan; Labour Code of the Republic of Kazakhstan dated 23 November 2015 No.414-V; Code on Administrative Offences of Republic of Kazakhstan dated 30 January 2001 No.155-II (hereinafter the "Administrative Code"); Civil Code of the Republic of Kazakhstan dated 27 December 1994 (General Part); Criminal Code of Republic of Kazakhstan 16 July 1997 No.167-I (hereinafter the "Criminal Code"); Law on Personal data protection of the Republic of Kazakhstan dated 21 May 2013 No.94-V; Law on Informatisation of the Republic of Kazakhstan dated 24 November 2015 No.418-V (hereinafter the "Informatisation law"); Law on Banks and banking activity of the Republic of Kazakhstan dated 31 August 1995 No.2444; Rules on protection of personal data by the owner and (or) operator, and third parties dated 3 September 2013 No.909; and List of individuals' personal data which are included into state data resource 26 February 2016 No.117. Let us start with the...