[ad_1]
Kazakhstan:
Amendments To Digital Technology Regulations
To print this article, all you need is to be registered or login on Mondaq.com.
This Alert summarizes the most significant amendments to digital
technology regulations introduced by the Law «On
introduction of amendments to certain legislative acts of the
Republic of Kazakhstan on digital technology
issues»1 (hereinafter – the
“Amendments”) entered into force on July 6, 2020.
The Law “On personal data and its
protection”2 (hereinafter – the “PD
Law“) has been changed as follows:
- The Ministry of Digital
Development, Innovation and Aerospace Industry of the Republic of
Kazakhstan has been designated as the authorized body with the
Office for the Protection of Personal Data under the Committee
on Information Security of the Ministry. - The collection, processing of
personal data can now be carried out by a third party. We note the
need to obtain the prior consent of the subject or his legal
representative.3 Along with this, third parties shall
anonymize personal data obtained in the course of scientific,
sociological, including marketing research.4 - It is worth mentioning that the
processing of personal data is to be limited to the achievement of
specific, predetermined and legitimate purposes. The law prohibits
the processing of personal data incompatible with the purposes of
collecting personal data.5 - The Amendments provide for the
concept of “voluntary cyber insurance“, the
types and procedure of which are determined by the agreement of the
parties.6 - By analogy with the provisions of the
GDPR adopted in the countries of the European Union, the Amendments
introduced the concept of “a person responsible for
organization of the processing of personal data“. Thus,
besides the owner and / or operator of the PD, another person is
appointed as a responsible for the compliance of the processing of
PD with the legislation of the Republic of Kazakhstan. In
particular, such person provides the opportunity to familiarize
themselves with personal data related to the subject of the PD; in
case the owner and (or) operator is a legal entity, it is entitled
to appoint a person responsible for organization of the processing
of personal data.7 - The competence of the authorized body
was put in a separate article, thereby delimiting the competence of
state bodies, the Government of the Republic of Kazakhstan and the
authorized body.8 Moreover, the Amendments provide a
requirement of confidentiality with respect to personal data that
became known to the authorized body in the course of its
activities.9
The law-maker introduced the following amendments to the
Law “On
Informatization”10:
- The Amendments introduced the
concepts of “blockchain“, “digital
mining“, “digital token“,
“digital asset“, etc. Blockchain is defined as
an information and communication technology that ensures the
constancy of information in a distributed data platform based on a
chain of interconnected data blocks, given integrity confirmation
algorithms and encryption tools.11 - Blockchain is a way to store
data. Transaction data is stored in blocks, which in their turn
comprise a chain. The advantage of using this technology is that
the risk of break into such a database is reduced, since each
subsequent block in the chain enhances the verification of the
previous one with a hash12 that links the blocks
together and prevents any block from change or insertion between
two existing blocks. - Digital mining – the process
of performing computational operations using computer and energy
capacities in accordance with the specified encryption and data
processing algorithms, which ensures the integrity of data blocks
in information objects via blockchain.13 - The competence of the authorized body
in the field of informatization, namely the Ministry of
Information and Social Development of the Republic of
Kazakhstan has been expanded. Now, the Ministry:
- approves the rules for the
collection, processing, storage, transfer of electronic information
resources for the implementation of data analytics in order to
fulfill the functions of state bodies in coordination with the
authorized body in the field of personal data protection; - approves the rules for the formation,
verification and use of electronic documents using the digital
document service;
- approves the rules for the
- An authorized body, ensuring
information security, namely the Committee on Information
Security of the Ministry of Digital Development, Innovation and the
Aerospace Industry of the Republic of Kazakhstan, determines
the procedure for informing on activities for the implementation of
digital mining, and the procedure for the issue and circulation of
secured digital assets. These amendments were introduced due to the
introduction of new concepts into the Law. - The competence of the authorized body
in the electronic industry – the Department of Electronic
Industry Development of the Ministry of Digital Development,
Innovation and Aerospace Industry of the Republic of
Kazakhstan was set forth in a separate article, thereby
clearly delimiting the competence of the authorized bodies in the
areas: electronic industry, ensuring information security and
informatization.14 - The Amendments establish the legal
regime of digital assets, as well as their
classification.15 Thus, a digital asset is the result of
digital mining and does not serve as means of payment. The
Amendments provide for the classification of digital assets as
secured and unsecured. Secured digital assets include a digital
token and other digital assets, which are a digital means of
certifying property rights to goods and (or) services issued
(provided) by a person who issued a secured digital asset.
Unsecured digital assets include digital tokens received as a
reward for participating in maintaining consensus on the
blockchain.16
With regard to the formation and use of electronic information
resources, the Amendments stipulate a provision in accordance with
which third parties’ access to electronic documents stored in
the digital document service is carried out with the consent of the
user in the manner determined by the authorized body.17
The amendments also affected the Code “On
Administrative Violations”18 (hereinafter
referred to as the “Administrative
Code“):
- The Amendments provide for liability
for improper implementation by a third party of the measures to
protect information systems.19 This measure is necessary
to prevent the illegal collection of personal data of citizens, as
well as its use for previously undeclared purposes.
The Law “On the electronic document and electronic
digital signature”20, has been amended as
follows:
- Due to difficulties in the technical
implementation of the recognition of foreign registration
certificates, the provision stipulating this issue was
excluded.21 Thus, a foreign citizen or legal entity
shall obtain registration certificates of the National
Certification Authority of the Republic of Kazakhstan.
Footnotes
1 The law of the Republic of Kazakhstan dated June
25, 2020
2 The law of the Republic of Kazakhstan dated May 21,
2013
3 Article 9 of the PD Law
4 para 1 Article 17 of the PD Law
5 paragraphs 4 and 5 of the Article 7 of the PD
Law
6 Article 23-1 of the PD Law
7 Para 2 of the Article 24 of the PD Law
8 Article 27-1 of the PD Law
9 Para. 2 of the Article 27-1 of the PD Law
10 of the Republic of Kazakhstan dated November 24,
2015
11 Para.38-2 Article 1 of the law on
Informatization
12 Hash – the conversion of an array of input data of
arbitrary length into a (output) bit string of a specified length,
performed by a certain algorithm
13 Para 55-3 of the Article 1 of the law on
Informatization
14 Article 7-6 of the law on Informatization
15 Article 33-1 of the law on Informatization
16 Para 2 Article 33-1 of the law on
Informatization
17 Article 35 of the law on Informatization
18 of the Republic of Kazakhstan dated July 5,
2014
19 Sub. para. 1 para. 1 of the Article 641 of the
Administrative Code
20 The Law of the Republic of Kazakhstan dated January 7,
2003
21 Article 19 of the law on the electronic document and
electronic digital signature
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
POPULAR ARTICLES ON: Technology from Kazakhstan
[ad_2]
Source link