Special Report
“Qazaqstan Shutdown 2022”
Privacy and Personal Data
Privacy and Personal Data
Article author
Ruslan Daiyrbekov
Eurasian Digital Foundation Public Foundation
Special Legal Aspects of Processing Personal Data of Citizens during the State of Emergency in Kazakhstan
With regard to the serious and immediate hazard to the safety of citizens and with the aim of ensuring social security, on January 5th, 2022, the President of the Republic of Kazakhstan issued respective Decrees on imposing the state of emergency until January 19th, 2022, in certain regions of the country.
After public disorder in Kazakhstan, 388 criminal proceedings have been initiated due to the facts of attacks on the buildings of governmental authorities and law enforcement agencies. This was announced on the 11th of January by the press relations office of the President of the Republic of Kazakhstan, Kassym-Jomart Tokayev. According to the statement of the press relations office, “The representative of the Ministry of Internal Affairs of the Republic reported to the President that appropriate operations were being currently taken on collecting and registering evidentiary records and restoring the event history”, the press relations office informed.
It is worth recalling that according to clause 1 of article 30-1 of the Law of the Republic of Kazakhstan “On Informatization”, it is presumed that the national video monitoring system is an information system consisting of a package of software products and hardware devices designed to collect, process, and store video materials to resolve matters of ensuring national security and public order.
As to clause 3 of article 30-1 of the Law of the Republic of Kazakhstan “On Informatization”, categories of objects, which must be connected to the national video monitoring system, include:
1. Video surveillance systems of the central and local governmental authorities;
2. Video surveillance systems of the facilities, considered to be vulnerable in terms of terroristic activities;
3. Video surveillance systems that relate to the public and road safety and security.
As stated in clauses 12 and 13 of the National Video Monitoring System Operating Rules adopted by Order No.69-KE of the Chairman of the National Security Committee of the Republic of Kazakhstan dated October 27, 2020, collection, processing, and storage of video materials in the national video monitoring system are conducted with the use of software and hardware packages and technological platforms of the data processing centers within video monitoring system. The period for keeping materials in the system equals 30 days, except for video materials on the events (incidents) that relate to implementing national security goals and ensuring public law and order, whose storage period shall not be less than 7 years.
As of now, personal biometrical data processing in Kazakhstan is regulated by the general provisions of the Law “On Personal Data and Their Protection”. In terms of the legal aspect of processing photo- and video materials, there is a standpoint that unless they are transferred to establish the identity of the person captured thereon, such materials should not be considered as personal biometrical data, because the operator does not use them for the purpose of personal identification. However, video images, employed by the authorities, which perform criminal intelligence activities, legal inquiry, or investigation under the framework of their operations, are deemed to be personal biometrical data as their processing is aimed at the identification of the specific natural person based on his/her physiological and biological features. It is noteworthy that the laws in Kazakhstan allow collecting and processing personal biometrical data, obtained from the materials of the national video monitoring system for the purposes of the investigation of cases associated with the public disorders of January 2022, without consent of the personal data owner, because such circumstances refer to the performance of the ‘activities of the law enforcement agencies and courts of enforcement proceedings’.
The use of biometrical technologies in the criminalistics and investigations conducted by law enforcement agencies is allowable in the democratic society, and yet the State should pay attention to the effects produced by the employment of such technologies on human rights so to protect persons identified by those systems against possible misapplications. The State must also guarantee that all such activities are taken in compliance with the commitments envisaged by the international law and fixed in the international and regional conventions on human rights.
It is worth mentioning that a state of emergency does not override the validity of the provisions of the Criminal Procedural Code of the Republic of Kazakhstan in terms of ensuring the right to privacy (including personal privacy and marital privacy). Clause 3 of article 16 of the Criminal Procedural Code of the Republic of Kazakhstan states that “No one has the right to collect, store, use, and disseminate information about the private life of a person without his (her) consent, except as required by law”. In addition, a state of emergency does not undo the norms of article 15 of the Law “On Law Enforcement Intelligence Operations” that prohibit “using illegal actions, which restrict rights, freedoms, and lawful interests of citizens” and “disclosing data, which relate to the right to privacy, including personal and marital privacy”.
That said, in a state of emergency, evidence fixation as well as identification of potential committers may be conducted only within the framework of a criminal process and only in relation to the persons involved therein. No information on the person’s private life may be pursued, except for the implementation of the criminal process objectives in line with the effective procedures set forth by the legislation that guarantee ensuring the right to privacy, personal secret, and correspondence privacy.
According to the international practice, no interference into private life is allowed, unless in line with the procedures that guarantee that all surveillance measures are compliant with the conditions established by law. In this regard, the Law of the Republic of Kazakhstan “On State of Emergency” allows restricting certain citizen rights and freedoms, including the right to privacy. However, these restrictions, as stipulated by clause 17 of the said Law, must be implemented to the extent necessitated by the circumstances that serve as the ground for imposing the state of emergency, and must not contradict international agreements in the field of human rights ratified by the Republic of Kazakhstan.
Laws of Kazakhstan in the sphere of criminal intelligence operations do not give a quite clear definition of permissible procedures and conditions of conducting surveillance activities – there are no guarantees that information collection is ceased immediately upon revealing objective data that traverse the supposition on someone’s criminal deeds. Struggle against crimes, for all its noble causes, must not lead to neglecting protection of human rights and freedoms. Any ongoing and proposed policies to combat crimes must make provisions for the assessment of their consequences to the sanctity of private life. It provides a possibility to consider and present information on how policies and technologies contribute to the mitigation of risks associated with the right to privacy. An internal legal framework on how law enforcement agencies store and use such data should be developed, providing that it should be predictable in terms of possible consequences and be subject to the thorough inspection of its compliance with public interests.
Any improper use of biometrical data can pose a threat to such rights. Misuse of such data can also cause serious risks in respect of the rights to appropriate legal process, including the right to presumption of innocence and other rights related to criminal trials (articles 9 and 14 of the ICCPR). Besides, mass-scale collection of such data with no adherence to the principles of necessity and proportionality may in itself constitute a violation of the right to privacy (article 2 (3) of the ICCPR).
Where there are lawful goals and adequate process-related guarantees, the State is allowed to perform quite intrusive tracking; however, the State still is obliged to prove that such interference is both necessary and proportionate to the specific risk. Mass-scale or so-called ‘blanket’ tracking programs, thuswise, may be considered ‘unmotivated’, even if they serve a legal purpose and have been adopted under the legal regime of publicly accessible personal data.
In the decisions handed down on the case of Klaas & others v Germany as of September 6, 1978, and of Schenk v Switzerland as of July 12, 1988, it was stated that when resolving the issue of the permissible interference into the private life, one must match up conflicting interests – the public interest in finding out the truth under the case and the personal interest in preserving confidentiality of private matters. Such standpoint has been confirmed by the recent decisions of the European Court of Human Rights: “Powers of secret surveillance of citizens are tolerable under the Convention only in so far as strictly necessary for safeguarding the democratic institutions”; “whatever system of surveillance is adopted, there must exist adequate and effective guarantees against abuse”.
Under international law, the right to privacy is not ultimate, but it is recognized that any interference into the implementation of this right must meet the principles of lawfulness, proportionality, and necessity. Besides, any interference allowed by the State must be conducted on legal grounds only, which must, in their turn, correspond to the ICCPR provisions, goals, and objectives, and be justified under specific circumstances. No such interference may discriminate on the ground of race, language, religion, ethnic or social origin, political and other opinion, and any other motives stipulated under international law (ICCPR, articles 2 (1) and 26). According to the UN Special Rapporteur on the Right to Privacy, several countries around the world have identified an overarching fundamental right to dignity and the free, unhindered development of one’s personality, and violation of the sanctity of private life may produce an adverse effect on that right. The preambles to the Universal Declaration of Human Rights and ICCPR establish that recognition of the inherent dignity and of the equal and inalienable rights of all members of the human family is the foundation of freedom, justice and peace in the world.
Without question, the above said ‘evidentiary records’ contain materials (video footage) collected with the use of the national video monitoring system.
The below section focuses on two major subjects: special legal aspects of personal data processing during the state of emergency in Kazakhstan and practice of inspecting phones, which citizens had to deal with.
● Upon the end of the state of emergency, all data related to the private life as well as to the personal honor and dignity, obtained as a result of criminal intelligence operations, must be deleted, unless they contain information on the commitment of actions prohibited by law, and it must be also ensured that such data will not be used for any other purposes, except for those compliant with the effective legislative provisions in the field of criminal intelligence operations.

● It is recommended to inspect the national video monitoring system for the presence of the adequate guarantees aimed at protecting the right to privacy and also to assess risks associated with data processing (in particular, by evaluating the impact on the data protection before any software products or hardware devices of the national video monitoring system, which conduct collection, processing, and storage of the video surveillance footage, are used).

● It is recommended to take additional measures to protect data pertaining to vulnerable groups.

● It is recommended to encourage inclusive approaches by engaging civil society organizations, national human rights advocacy institutions, and data protection bodies.