Amendments To Digital Technology Regulations – Technology


Private Equity Investment In Health Care Technology (Video) - Food, Drugs, Healthcare, Life Sciences


Kazakhstan:

Amendments To Digital Technology Regulations


To print this article, all you need is to be registered or login on Mondaq.com.

This Alert summarizes the most significant amendments to digital
technology regulations introduced by the Law «On
introduction of amendments to certain legislative acts of the
Republic of Kazakhstan on digital technology
issues»
1 (hereinafter – the
“Amendments”) entered into force on July 6, 2020.

The Law “On personal data and its
protection”
2 (hereinafter – the “PD
Law
“) has been changed as follows:

  • The Ministry of Digital
    Development, Innovation and Aerospace Industry of the Republic of
    Kazakhstan
    has been designated as the authorized body with the
    Office for the Protection of Personal Data under the Committee
    on Information Security
    of the Ministry.

  • The collection, processing of
    personal data can now be carried out by a third party. We note the
    need to obtain the prior consent of the subject or his legal
    representative.3 Along with this, third parties shall
    anonymize personal data obtained in the course of scientific,
    sociological, including marketing research.4

  • It is worth mentioning that the
    processing of personal data is to be limited to the achievement of
    specific, predetermined and legitimate purposes. The law prohibits
    the processing of personal data incompatible with the purposes of
    collecting personal data.5

  • The Amendments provide for the
    concept of “voluntary cyber insurance“, the
    types and procedure of which are determined by the agreement of the
    parties.6

  • By analogy with the provisions of the
    GDPR adopted in the countries of the European Union, the Amendments
    introduced the concept of “a person responsible for
    organization of the processing of personal data
    “. Thus,
    besides the owner and / or operator of the PD, another person is
    appointed as a responsible for the compliance of the processing of
    PD with the legislation of the Republic of Kazakhstan. In
    particular, such person provides the opportunity to familiarize
    themselves with personal data related to the subject of the PD; in
    case the owner and (or) operator is a legal entity, it is entitled
    to appoint a person responsible for organization of the processing
    of personal data.7

  • The competence of the authorized body
    was put in a separate article, thereby delimiting the competence of
    state bodies, the Government of the Republic of Kazakhstan and the
    authorized body.8 Moreover, the Amendments provide a
    requirement of confidentiality with respect to personal data that
    became known to the authorized body in the course of its
    activities.9

The law-maker introduced the following amendments to the
Law “On
Informatization”
10:

  • The Amendments introduced the
    concepts of “blockchain“, “digital
    mining
    “, “digital token“,
    digital asset“, etc. Blockchain is defined as
    an information and communication technology that ensures the
    constancy of information in a distributed data platform based on a
    chain of interconnected data blocks, given integrity confirmation
    algorithms and encryption tools.11

  • Blockchain is a way to store
    data. Transaction data is stored in blocks, which in their turn
    comprise a chain. The advantage of using this technology is that
    the risk of break into such a database is reduced, since each
    subsequent block in the chain enhances the verification of the
    previous one with a hash12 that links the blocks
    together and prevents any block from change or insertion between
    two existing blocks.

  • Digital mining – the process
    of performing computational operations using computer and energy
    capacities in accordance with the specified encryption and data
    processing algorithms, which ensures the integrity of data blocks
    in information objects via blockchain.13

  • The competence of the authorized body
    in the field of informatization, namely the Ministry of
    Information and Social Development of the Republic of
    Kazakhstan
    has been expanded. Now, the Ministry:

    • approves the rules for the
      collection, processing, storage, transfer of electronic information
      resources for the implementation of data analytics in order to
      fulfill the functions of state bodies in coordination with the
      authorized body in the field of personal data protection;

    • approves the rules for the formation,
      verification and use of electronic documents using the digital
      document service;


  • An authorized body, ensuring
    information security, namely the Committee on Information
    Security of the Ministry of Digital Development, Innovation and the
    Aerospace Industry of the Republic of Kazakhstan
    , determines
    the procedure for informing on activities for the implementation of
    digital mining, and the procedure for the issue and circulation of
    secured digital assets. These amendments were introduced due to the
    introduction of new concepts into the Law.

  • The competence of the authorized body
    in the electronic industry – the Department of Electronic
    Industry Development of the Ministry of Digital Development,
    Innovation and Aerospace Industry of the Republic of
    Kazakhstan
    was set forth in a separate article, thereby
    clearly delimiting the competence of the authorized bodies in the
    areas: electronic industry, ensuring information security and
    informatization.14

  • The Amendments establish the legal
    regime of digital assets, as well as their
    classification.15 Thus, a digital asset is the result of
    digital mining and does not serve as means of payment. The
    Amendments provide for the classification of digital assets as
    secured and unsecured. Secured digital assets include a digital
    token and other digital assets, which are a digital means of
    certifying property rights to goods and (or) services issued
    (provided) by a person who issued a secured digital asset.
    Unsecured digital assets include digital tokens received as a
    reward for participating in maintaining consensus on the
    blockchain.16

With regard to the formation and use of electronic information
resources, the Amendments stipulate a provision in accordance with
which third parties’ access to electronic documents stored in
the digital document service is carried out with the consent of the
user in the manner determined by the authorized body.17
The amendments also affected the Code “On
Administrative Violations”
18 (hereinafter
referred to as the “Administrative
Code
“):

  • The Amendments provide for liability
    for improper implementation by a third party of the measures to
    protect information systems.19 This measure is necessary
    to prevent the illegal collection of personal data of citizens, as
    well as its use for previously undeclared purposes.

The Law “On the electronic document and electronic
digital signature”
20, has been amended as
follows:

  • Due to difficulties in the technical
    implementation of the recognition of foreign registration
    certificates, the provision stipulating this issue was
    excluded.21 Thus, a foreign citizen or legal entity
    shall obtain registration certificates of the National
    Certification Authority of the Republic of Kazakhstan.

Footnotes

 1 The law of the Republic of Kazakhstan dated June
25, 2020

2 The law of the Republic of Kazakhstan dated May 21,
2013

3 Article 9 of the PD Law

4 para 1 Article 17 of the PD Law

5 paragraphs 4 and 5 of the Article 7 of the PD
Law

6 Article 23-1 of the PD Law

7 Para 2 of the Article 24 of the PD Law

8 Article 27-1 of the PD Law

9 Para. 2 of the Article 27-1 of the PD Law

10 of the Republic of Kazakhstan dated November 24,
2015

11 Para.38-2 Article 1 of the law on
Informatization

12 Hash – the conversion of an array of input data of
arbitrary length into a (output) bit string of a specified length,
performed by a certain algorithm

13 Para 55-3 of the Article 1 of the law on
Informatization

14 Article 7-6 of the law on Informatization

15 Article 33-1 of the law on Informatization

16 Para 2 Article 33-1 of the law on
Informatization

17 Article 35 of the law on Informatization

18 of the Republic of Kazakhstan dated July 5,
2014

19 Sub. para. 1 para. 1 of the Article 641 of the
Administrative Code

20 The Law of the Republic of Kazakhstan dated January 7,
2003

21 Article 19 of the law on the electronic document and
electronic digital signature

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.

POPULAR ARTICLES ON: Technology from Kazakhstan

Cybersecurity Comparative Guide

Haas Avocats

Cybersecurity Comparative Guide for the jurisdiction of France, check out our comparative guides section to compare across multiple countries

To The Point: Technology & Digitalisation

Schoenherr Attorneys at Law

Welcome to the June edition of Schoenherr’s to the point: technology & digitalisation newsletter! We are excited to present a selection of legal developments in the area of…


Source link