Since December last year, the media and news channels have been full of reports about the ban on collecting copies of identity cards being introduced in Kazakhstan. The relevant ministry, announcing this news, notes that the corresponding amendments to the legislation on information security are, first of all, aimed at strengthening the protection of personal data, as well as removing unnecessary burden on business and reducing the cost of purchasing equipment necessary to create copies of documents, rental premises for their storage.At the same time, unfortunately, there are no comments from the authorized body on the essence of the introduced legislative norm and the mechanism for its implementation. However, the closer the date of entry into legal force of the amendments is February 11, 2024, the more questions lawyers and, of course, businesses have regarding the application of the introduced ban.
The literally new norm of the Law of the Republic of Kazakhstan No. 94-V dated May 21, 2013 “On personal data and their protection” (“Personal Data Law”) states the following: “The collection, processing of copies of identification documents on paper, for with the exception of cases of lack of integration with the objects of informatization of state bodies and (or) state legal entities, the impossibility of identifying the subject using technological means, as well as in other cases provided for by the laws of the Republic of Kazakhstan.Exceptional cases of collecting and processing copies of identification documents on paper, provided for in part one of this paragraph, do not apply to the use and presentation of identification documents generated through the digital document service.”
Already during the initial analysis of this norm in conjunction with the legislative regulation associated with it, a number of controversial issues arise or, so to speak, defective details of the mechanism for implementing the ban are discovered that can complicate its operation. Next, we will dwell on some of the most significant, in our opinion, aspects of this topic.
Types of identity documents
First of all, it should be noted that the analyzed ban on collecting copies concerns not only identity documents, as is translated in most publications, but we are talking about identity documents (hereinafter collectively - “documents”), and to them, according to paragraph 1 of the article 6 of the Law of the Republic of Kazakhstan No. 73-V dated January 29, 2013 “On Identity Documents” include:
1) passport of a citizen of the Republic of Kazakhstan;
2) identity card of a citizen of the Republic of Kazakhstan;
3) residence permit of a foreigner in the Republic of Kazakhstan;
4) certificate of a stateless person;
5) diplomatic passport of the Republic of Kazakhstan;
6) service passport of the Republic of Kazakhstan;
7) refugee certificate;
8) identity card of a seaman of the Republic of Kazakhstan;
9) foreign passport;
10) certificate of return;
11) birth certificate;
12) travel document.
In cases provided for by the Criminal Procedure Code of Kazakhstan, a driver's license, military ID and birth certificate may be recognized as documents. Accordingly, the above prohibition may apply to them too.
What exactly is prohibited
The collection and processing of “copies of identification documents on paper” are literally prohibited, while it is unclear what exactly the qualifying feature “paper” refers to. The following two interpretations of this wording are possible: (1) the collection and processing of paper copies of documents is prohibited, i.e. It is possible to collect and store electronic (scanned) copies of documents, or (2) the prohibition applies to any copies made from documents on paper, i.e. virtually all documents existing in material form, and not their electronic versions (in particular, in a digital document service).
There are no official explanations from the authorized body regarding the interpretation of the new norm in this part (as well as on other unclear issues) in public sources yet. However, from some speeches of representatives of the authorized body published in the media (for example, from the following: https://informburo.kz/novosti/zapret-na-sbor-kopii-udostovereniya-licnosti-kak-budut-nakazyvat-narusitelei) it follows that the legislator still had in mind a ban on any copies of documents in paper form.
According to subparagraphs 5 and 12 of Article 1 of the Law on Personal Data, the collection of personal data is actions aimed at obtaining personal data, while the processing of personal data refers to actions aimed at accumulation (i.e. entering into a database containing personal data). data), storage, modification, addition, use, distribution, depersonalization, blocking and destruction of personal data. Accordingly, the legislator actually prohibits any actions with copies of documents, including obtaining certain information from them.
As for the exceptions to the ban in question established by the new norm, the ban does not apply, i.e. collection and processing of copies of documents is allowed:
1) in the absence of integration with informatization objects of state bodies and (or) state legal entities;
It is unclear what kind of integration is meant.
Perhaps this implies integration by operators (owners) of databases containing personal data and third parties of their own informatization objects with the state service for controlling access to personal data, which, according to paragraph 1 of Article 8-1 of the Law on Personal Data, is ensured in the case of interaction with informatization objects state bodies and state legal entities containing personal data, and in other cases is carried out on a voluntary basis.
Thus, if a person does not have the opportunity (due to the fact that the information objects he uses are not associated with the specified state service (not integrated into it)) to obtain relevant personal data (information from a document) from state information objects, he has the right to collect and process copies documents. The question arises whether the fact that a person has not taken measures to implement integration when he is obliged to ensure it can be considered as a lack of integration.
2) if it is impossible to identify the subject of personal data using technological means (there are no explanations (additional provisions) in this part either in the Law on Personal Data or in the Law of the Republic of Kazakhstan No. 44-VIII of December 11, 2023, amending the legislation about informatization, no, so it is unclear to whom and in what specific case this exception will apply);
3) in other cases provided for by the legislation of Kazakhstan.
Other cases include the collection and processing of copies of documents of non-residents by the Law of the Republic of Kazakhstan No. 44-VIII dated December 11, 2023. At the same time, according to the amendments introduced by this law to the Labor Code of the Republic of Kazakhstan No. 414-V dated November 23, 2015, it is allowed to collect and process copies of documents only of labor migrants, and not of non-residents in general. Accordingly, a conflict arises between the provisions of the code and the Personal Data Law.
The legislator establishes that the above exceptions do not apply to the use and presentation of documents generated in the digital document service (“Service”). The service is an element of the e-government portal of Kazakhstan, through which the owner can both view his digital (electronic) documents and send (for example, via WhatsApp) an electronic copy of the document to the appropriate person or provide him with access to the document on the portal. In the latter case, the recipient must have the portal's mobile application installed.
According to subparagraph 55-2 of Article 1 of the Law of the Republic of Kazakhstan No. 418-V dated November 24, 2015 “On Informatization”, documents in the Service used and presented to government bodies, individuals and legal entities are equivalent to documents on paper. On this basis, we can conclude that when receiving a document from the owner through the Service (as a result of forwarding or gaining access to it), it is not allowed to save a copy of the document at home, or use it or present it (apparently, this means distributing it) to anyone -or.
The effect of the ban in time
According to paragraph 5 of Article 77 of the Constitution of the Republic of Kazakhstan dated August 30, 1995, laws establishing or increasing liability, imposing new responsibilities on citizens or worsening their situation do not have retroactive effect. Therefore, the new provision of the Personal Data Law should not apply to those copies of documents that were received by the relevant persons before February 11, 2024 (the commitment of the authorized body to this approach is confirmed by its comments in the above-mentioned media publication).
However, it is unclear how the authorized body (another interested party) will in practice determine which copies of documents were received and when. Most likely, the date of receipt of a copy of the document will be determined by the date of receipt from the relevant subject of personal data of consent to their collection and processing.
***
It is obvious that changes to the Law on Personal Data formulated unclearly and ambiguously by the legislator may lead in practice to non-fulfillment or improper implementation of the prohibition in question by persons participating in the relevant legal relations. Therefore, we expect that the authorized body will soon publish comprehensive clarifications on all controversial issues. We also consider it advisable to stimulate the authorized body to do this by submitting official requests by companies and other persons actively collecting and processing documents as part of their core business.In the meantime, there are no such clarifications and law enforcement practice has not been formed, from February 11, 2024, the most “safe” (minimizing the risk of violation of the law and the occurrence of adverse consequences) approach to the collection and processing of copies of documents, we see the cessation of such actions, at least in relation to documents of Kazakh citizens .