In order to ensure duly protection of rights and basic freedoms and, in particular personal privacy regardless of citizenship and place of living, in view of today’ automatic data processing, the European Council Member States adopted Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Strasbourg, 28 January 1981 with Additional Minutes to the Convention on Supervisory Bodies and Cross-Border Data Transmission, Strasbourg, 8 November 2001).
In order to ensure duly protection of rights and freedoms of an individual and citizen during acquisition and processing of personal data the Law on Personal Data and Protection was adopted in Kazakhstan on 21 May 2013, its provision are regulating relationship connected with acquisition, processing and protection of personal data.
The legally protected personal data shall mean data on certain individual who can be identified based on the personal data in soft or hard copies or any other tangible media. Personal data can be publicly available, i.e. a free access to them is subject to consent of a person; those, which do not fall under confidentiality requirement (biographical database, telephone and address directories, publicly available information resources); and data of restricted access under the laws.
Acquisition and processing of personal data are subject to consent of a person or his/her authorized representative, if none other is provided by laws. A person or his/her authorized representative gives (revokes) consent for acquisition and processing of personal data in written or electronic form, or by any other way subject to protective measures. A person may at any time to revoke its consent for acquisition and processing of personal data.
Provisions on acquisition, processing and protection of personal data of persons (physical persons) were included into sectorial legislation, inter alia, the Labour Code and other legal acts. Besides this, the Government approved Rules on determination of inventory of personal data by owner and/or operator, required and sufficient to perform its tasks.
Failure to comply with laws of the Republic of Kazakhstan on personal data and its protection creates administrative and criminal liability.