DOING BUSINESS IN KAZAKHSTANDownload PDF
aequitas@aequitas.kz+7 (727) 3 968 968

Labor & Employment

Yu. Chumachenko, A. Chumachenko PROHIBITION ON COLLECTION OF COPIES OF IDENTIFICATION DOCUMENTS: WHAT IS WRONG//Zakon.kz – 05.02.2024

  Since last December, mass media and news channels have been striking the eye with the messages about a prohibition on collection of copies of identification documents to be introduced in Kazakhstan. When announcing this news, the ministry in charge mentioned that relevant amendments to legislation on information security are primarily intended to strengthen personal data protection and remove excessive burden from business, as well as to reduce costs associated with the acquisition of equipment required to make copies of documents and lease of the premises to store them. Unfortunately, so far, there are no comments of the authorized agency on the nature of the introduced legislative rule and its implementation mechanism. However, the closer the date of putting the amendments into legal force (11 February 2024), the more questions lawyers and, of course, business have regarding application of the introduced prohibition.

  The new rule of the Kazakhstan Law No. 94-V "On Personal Data and Protection Thereof" dated 21 May 2013 ("Personal Data Law") literally states as follows "It shall be prohibited to collect, process copies of identification documents on paper, except for the cases of absence of integration with computer systems of governmental agencies and/or state legal entities, impossibility to identify a subject using technological facilities, and in other instances stipulated by the laws of the Republic of Kazakhstan. The exceptional cases of collection, processing of copies of identification documents on paper stipulated by the first part of this paragraph shall not cover the use and provision of identification documents formed by way of digital documents service".

  Even the initial analysis of this rule together with related statutory regulation gives rise to a number of disputable issues or, in some way or other, discovers defective details of the prohibition implementation mechanism, which may hinder its operation. Below we will consider the aspects of this topic, which we deem most important for business.

Types of Identification Documents

  First of all, it is worth mentioning that the analyzed prohibition to collect copies relates not only to identity cards as this is conveyed in most publications, but the case is about the identification documents (collectively, the "Documents"), which include, according to Article 6.1 of the Kazakhstan Law No. 73-V "On Identification Documents" dated 29 January 2013, as follows:

  1. passport of a citizen of the Republic of Kazakhstan;
  2. identity card of a citizen of the Republic of Kazakhstan;
  3. permit for the foreigner's residence in the Republic of Kazakhstan;
  4. certificate of a stateless person;
  5. diplomatic passport of the Republic of Kazakhstan;
  6. service passport of the Republic of Kazakhstan;
  7. certificate of a refugee;
  8. seafarer identity card of the Republic of Kazakhstan;
  9. foreign travel passport;
  10. certificate of return;
  11. birth certificate; and
  12. travel document.

  In cases stipulated by the Kazakhstan Criminal Procedure Code, a driver's license, military ID and birth record may be recognized as Documents. Accordingly, the above prohibition may cover them as well.

What is Prohibited?

  It is literally prohibited to collect and process "copies of identification documents on paper", and the reference to the qualification feature "paper" is unclear. This wording may be interpreted in two ways: (1) it is prohibited to collect and process hardcopy Documents (paper files), i.e. it is allowed to collect and store electronic (scan) copies of Documents; or (2) prohibition relates to any copies of Documents on paper, i.e. in fact all Documents existing in tangible form, but not their electronic versions (specifically, in the digital documents service).

  So far, there are no official clarifications of the authorized agency regarding interpretation of this aspect of the new rule (same as with respect to other unclear issues) in public sources. Nevertheless, it follows from certain statements of the representatives of the authorized agency published in mass media (e.g. https://informburo.kz/novosti/zapret-na-sbor-kopii-udostovereniya-licnosti-kak-budut-nakazyvat-narusitelei) that the law-maker meant a prohibition on any copies of hardcopy Documents.

  According to Articles 1.5 and 1.12 of the Personal Data Law, collection of personal data is the actions aimed at obtainment of personal data, whereas processing of personal data means the actions aimed at accumulation (i.e. introduction into a base containing personal data), storage, change, amendment, use, dissemination, anonymization, blocking, and destruction of personal data. Accordingly, the law-maker actually prohibits any actions with the copies of Documents, including to get certain information from them.

  As regards the exceptions from the prohibition at hand established by the new rule, the prohibition does not cover, i.e. it is allowed to collect and process Documents:

  1. in case of absence of integration with the computer systems of the governmental agencies and/or state legal entities; It is unclear what integration is meant. Perhaps, this implies integration between operators (owners) of the bases containing personal data and third parties of their own computer systems with the state service allowing to exercise control over access to personal data, which, according to Article 8-1.1 of the Personal Data Law, is ensured in case of interaction with the computer systems of governmental agencies and state legal entities containing personal data, and which is implemented on a voluntary basis in other cases. Thus, if a person is not able (due to the fact that the used computer systems are not connected to the state service (not integrated into such service)) to obtain relevant personal data (information from a document) from the state computer systems, such person may collect and process copies of Documents. This gives rise to the issue of whether the fact that a person failed to take measures to ensure integration (in a situation where it had to ensure such integration) may be considered as the absence of integration.

  2. if it is impossible to identify a personal data subject using technological facilities (there are no relevant clarifications (additional provisions) in the Personal Data Law or the Kazakhstan Law No. 44-VIII dated 11 December 2023 introducing amendments into the informatization legislation; therefore, it is unclear whom such exception will apply to and in which specific cases);

  3. in other cases stipulated by the Kazakhstan legislation.

  According to the Kazakhstan Law No. 44-VIII dated 11 December 2023, other cases are collection and processing of copies of Documents of non-residents. According to the amendments introduced by this law into the Kazakhstan Labor Code No. 414-V dated 23 November 2015, it is allowed to collect and process copies of Documents of the labor migrants only, but not of non-residents in general. Accordingly, this gives rise to a conflict between provisions of the code and the Personal Data Law.

  The law-maker states that the above exceptions do not apply to the use and provision of Documents formed by the digital documents service ("Service"). The Service is an element of the portal of the Kazakhstan electronic Government, by which an owner may both review his/her digital (electronic) documents and forward (e.g. via WhatsApp) an electronic copy of a document to a relevant person or provide such person with access to a document on the portal. In the latter case, the recipient must install a mobile application of the portal. According to Article 1.55–2 of the Kazakhstan Law No. 418-V "On Informatization" dated 24 November 2015, documents in the

  Service used and submitted to governmental agencies, individuals and legal entities, are equal to the hardcopy documents. Based on this ground, it is possible to draw a conclusion that, in case of receiving a Document from an owner through the Service (as a result of forwarding or gaining access thereto), it is not allowed to retain any copies of the Document, use such copies or provide (apparently, this means to disseminate) to anyone.

Retroactive Effect

  According to Article 77.5 of the Kazakhstan Constitution dated 30 August 1995, laws establishing or strengthening liability, imposing new obligations on citizens, or worsening their condition have no retroactive effect. Therefore, the new rule of the Personal Data Law must not apply to the copies of Documents, which had been received by relevant persons before 11 February 2024 (authorized agency's agreement with this approach is confirmed by its comments in the above publication in mass media). However, it is unclear how the authorized agency (any other party concerned) will, in practice, determine which copies of Documents were obtained and when. Most likely, the date of receiving a copy of a Document will be determined by the date of receiving consent to collection and processing of personal data from a personal data subject.

  Obviously, the amendments to the Personal Data Law set out by the law-maker in an unclear and ambiguous manner may entail, in practice, a failure to comply or improper compliance with the prohibition in question by the persons participating in relevant legal relations. Therefore, we expect that the authorized agency will soon publish exhaustive clarifications on all disputable issues. We also deem it reasonable to give a boost to the authorized agency by filing official inquiries by the companies and other persons actively collecting and processing Documents as part of their primary activities. Since there are no such clarifications or law-application practice, we believe that, starting 11 February 2024, the "safest" (minimizing the risk of violating legislation and origination of unfavorable consequences) approach to collection and processing of copies of Documents is to stop such actions at least with respect to the Documents of the Kazakhstan citizens.