EU & KZ: General Data Protection Regulation Assessment, Part I

The issue of personal data security became of importance throughout the last decade while its topicality is raising daily. According to a recent research, 92% of people surveyed about their data security concerns report that privacy issue is important; meanwhile, confidence in due protection of personal data by companies is decreasing, dropping from 56% in 2019 to 31% in 2024 alone. The data indicates the growing concern on personal information safety in the online domain, and the issue is mainly addressed by creating a solid legally binding regulation and maintaining it on the level corresponding to rapid technological advancement. The article lays out a basis for a series of publications devoted to data protection laws in the European Union and Kazakhstan with a critical assessment of their similarities and differences. Also, the article describes the subject-matter and objectives of General Data Protection Regulation and Kazakhstan Law on Personal Data and its Protection; personal data as a notion under both acts; and territorial application of the legal instruments.

The Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 “on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)” is a comprehensive legal statute that establishes an extensive framework for interaction with personal data. The extensiveness lies in compilation of previously available protection tools in a single document, imposing severe punishment for violations which are to be discussed further as well as the imminence of vast financial and human resources involvement in due compliance. The structural approach with a strong basis for sanctions imposition was designed to ensure the effectiveness of data protection and to facilitate proper statute enforcement. The effects of GDPR are evident as relevant authorities in European countries revealed more than 200 violations and prescribed fines for more than EUR 459 million as of 2020. Even though the long-term impact of GDPR enactment is yet to be assessed, the sole point that remains unquestionable is that companies falling under GDPR regulation must change their attitude towards their customers’ data protection processes.

GDPR turned to be a flagship of personal data and privacy law refinement for many jurisdictions, being a model for changes introduced in existing statutes and the core of new relevant acts to be passed by legislators, and Kazakhstan has not been an exception here. Notwithstanding the enactment of the Law of Kazakhstan dated 21 May 2013 No. 94-V “On Personal Data and its Protection” (KZ DPL), the regulation largely conformed to the GDPR model by adopting the following major regulations:

1. introducing a supervisory authority and defining its competence scope (introduced in 2020 and 2023, currently Committee on Information Security by the Ministry of Digital Development; Innovation and Aerospace Industry of Kazakhstan) that replaced rather fragmented responsibility of the Kazakhstan Government put on various ministries depending on their competence;
2. categorising personal data into “publicly available” and “with limited access,” as well as identifying the requirements to access publicly available personal data (2020 and 2021);
3. introducing requirement to specify purposes of personal data processing when collecting data and requesting relevant consent from personal data subjects (2020);
4. introducing the right to access by a data subject (2020);
5. introducing the requirement for companies to designate a data protection officer (2020);
6. introducing the obligation to obtain preliminary consent from a data subject for personal data transfer (2021);
7. expanding the right to erasure for cases of non-obtainment of consent for data processing (2021); and
8. introducing the obligation to notify the authority in case of a personal data breach.

The said changes show a clear pattern of the KZ DPL development going towards unification of basic legal framework on personal data regulation with GDPR, at the same time maintaining local specifics and requirements. 

Objectives of the Acts and Notion of Privacy

The key objective of GDPR and KZ DLP as legal instruments is to protect the right of citizens to privacy. However, to fully grasp the objective, the knowledge of privacy as a legal concept is required. 

According to the Black’s Law Dictionary, privacy is “…[t]he right that determines the non-intervention of secret surveillance and the protection of an individual’s information. It is split into four categories: 

1. Physical: an imposition whereby another individual is restricted from experiencing an individual or a situation[;]
2. Decisional: the imposition of a restriction that is exclusive to an entity[;]
3. Informational: the prevention of searching for unknown information[;] and
4. Dispositional: the prevention of attempts made to get to know the state of mind of an individual.”

The key aspect from the personal data perspective is the informational dimension of privacy: obtaining personal information leads to infringement of one’s dignity and security.

The right’s international recognition stems from the Universal Declaration of Human Rights (UDHR; soft law and customary law) and the International Covenant on Civil and Political Rights (ICCPR, ratified by Kazakhstan by the law No. 91 enactment on 28 November 2005 and ratified by all EU states as well). It is worth noting that personal data collection was not initially the primary concern of the documents as personally identifiable information had not been gathered electronically on a large-scale basis pertinent to technological development at the time of the UDHR and ICCPR texts adoption. In accordance with the General Comment No. 16, “[T]he gathering and holding of personal information on computers, databanks, and other devices, whether by public authorities or private individuals or bodies, must be regulated by law. Effective measures have to be taken by States [parties to the Covenant] to ensure that information concerning a person's private life does not reach the hands of persons who are not authorized by law to receive, process and use it, and is never used for purposes incompatible with the Covenant”. The protection of the right in this case is established by creation of the legal framework for personal data to remain confidential and duly protected while not curtail personal data free movement. That is, the regulations do not prohibit or restrict personal data circulation but provide a set of rules under which such data can be legally obtained, processed, transferred, or used otherwise. Now, as the general understanding of the legal instruments purpose is defined, the material scope, specifically the general data as such, is to be expounded. 

Scope of Material Application

According to the GDPR Article 4 (1), personal data is “…any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.”

In turn, the KZ DPL Article 1.2 states that personal data is information relating to a specific subject of personal data or determined on its basis, recorded on electronic, paper and (or) other tangible media.

Both acts provide a broad definition of personal data without providing an exhaustive list, which allows to assume that GDPR and KZ DPL are forward-looking regulations aiming at comprising new types of personal data yet to be defined, discovered, or invented. This was the case with, for instance, personal email, internet protocol addresses, cookies, and other data types.

Examples of common personal data are name, phone number, home or employment address, passport or identification card data, geolocation, and other data.

Additionally, the case-law of the EU states that 

1. personal data relates to an “identifiable person” also if features alphanumeric code and an identification database is applied to re-identify a person based on the data received from a third party and on information in possession by the receiving person; and
2. personal data should also be considered as a combination of pieces of information that allow to identify a person. For example, if dynamic IP address or any other depersonalised data can be combined with any additional information that allows to identify an individual, such combined information piece is considered personal data.

Hence, it should be considered that depersonalised or pseudonymised data transmitted to a third party retains such status only if that third party does not have any additional information to re-identify that person based on the data combination.

Kazakhstan court practice also supports broad interpretation of personal data by relating apartment numbers, last and first names of apartment owners, personal account numbers, amounts of debt, images of individuals, and voting to personal data. However, the legal practice in relation to IP address, cookies, and other digital data is not yet solidly formed. However, it is assumed that even though the relevant practice is not yet developed, it is likely to follow the approach taken by the EU.

Another point that catches the eye is that the application of statutes does not encompass processing of personal data for activities that are intensely personal or related to household matters. Therefore, if one receives certain personal data from one’s family member or a friend and uses it for non-commercial or professional purposes, one will not fall under the restrictive regulations until the data processing purposes change. For example, if one receives personal data from an individual communication channel and uses it for personal purposes, one should not be found in violation of the data protection laws. If the same person, however, uses the received personal information to make a public post or to send a marketing email, prior consent of the data subject shall be obtained. 

Exterritorial application

GDPR spreads its application for processors that operate both within the EU member states’ territories and outside thereof, provided they process personal data in the territory of the EU for either offering of goods or services or monitoring ones’ behaviour. The approach is not only reinforced by the EU case-law but also by the court practice and interpretation in common law states. The exterritorial application leads global internet trading platforms towards deciding on compliance with the GDPR in its entirety or in part. This approach, on the one hand, creates a solid ground for the protection of personal data within the EU from a theoretical perspective while posing a practical risk of avoiding the regulation as such by circumventing the EU market itself or of having to allocate significant resources on research into GDPR applicability and compliance with its provisions, on the other.

As for Kazakhstan, the effect of regulatory legal acts extends for locals and legal entities, as well as foreigners and stateless persons, legal entities of foreign states, their branches and representative offices located in the territory, except for cases provided for by legislative acts and international treaties ratified by Kazakhstan. Since KZ DPL does not directly establish exterritorial application, and the legal scholars and practitioners lean towards application specifically within Kazakhstan, it may be concluded that currently KZ DPL does not have exterritorial effect.

Even though the application practice is not well established yet, it should be considered that Kazakhstan may follow the development paths of its neighbouring countries, which establish exterritorial application without directly mentioning such in the local legislation provisions. 

…on to the Part II