Disclosure of personal data to third parties and publication

In short

The Law uses two related concepts. Dissemination means transferring personal data or giving access to them to a specific person or group of persons (Art. 1(15)). Dissemination in public sources means giving access to an unlimited number of persons (Art. 1(3-2)). As a general rule, both require the data subject’s consent (Art. 7(6), Art. 15). Without consent, only in the cases of Article 9 and in special situations involving data that have already been published.

Disclosure to third parties

Consent. Transfer to third parties takes place subject to the data subject’s consent (Art. 7(6)). The consent itself must state whether the data may be transferred to third parties and disseminated in public sources (Art. 8(4)(4), (6)). Dissemination beyond the purposes stated at collection requires consent (Art. 15(2); Collection Rules, para 18). Even with consent, dissemination is allowed only if it does not affect the legitimate interests of others (Art. 15(1)).

Without consent. The Law lists such cases in Art. 9: law enforcement and courts, state statistics, ratified international treaties, journalistic and creative activity, publication required by law, certain functions of the financial regulator and tax authorities, and other cases expressly set by laws. There is no general ground such as “legitimate interest”.

Notifying the data subject. Where there is a condition to notify the data subject of a transfer to a third party, the owner or operator does so within ten working days (Art. 19(1)). Exceptions: functions of state bodies, the work of advocates, and statistical, sociological and scientific purposes (Art. 19(2)).

Confidentiality. Anyone who has access to restricted-access data may not disseminate them without consent or another legal ground (Art. 11). Technically, such data are transferred to others over secure channels and/or with encryption, and with consent (Protection Rules, para 15(8)). Transfers through integration of digital objects are also allowed (Art. 23(3)).

Dissemination in public sources

The rules here are more detailed (Art. 7(3)–(5); Collection Rules, paras 4-1–4-4):

• As a general rule, the data subject’s consent is required (para 3).
• If the data subject published the data themselves without giving consent to the operator, everyone who later collects or processes the data bears the burden of proving that this is lawful (para 3-1).
• If publication is required by law, no consent is needed, but data not subject to disclosure must be masked (para 4).
• Further use of data published on these grounds by third parties is allowed with a reference to the source (para 5).

There are also limits. Collecting and processing data to create or expand databases through “non-purposive extraction” from public sources is prohibited (Art. 7(11)). Data collected unlawfully are removed from public sources within one working day at the request of the data subject, a court or an authorised body (Art. 6).

Interpretation. The ban on “non-purposive extraction” looks like a response to mass collection of data from open sources (scraping). But the Law does not draw the line between “purposive” and “non-purposive” extraction. The general principle will probably have to serve as the guide: processing is limited to specific, predetermined and lawful purposes (Art. 7(8)).

No “processor” figure

Kazakhstan law knows the owner, the operator and the third party (Art. 1(9), (10), (17)), but does not single out someone who processes data on behalf of and in the interests of another. A contractor to whom a company passes data (an accounting firm, a cloud provider, a call centre) is formally also a recipient.

Interpretation. Since there is no separate processor regime, it is safer to treat a transfer to a contractor as a transfer to a third party: mention this possibility in the consent (Art. 8(4)(4)) and set out confidentiality and security obligations in the contract. The contractor is itself bound to protect the data — the Law expressly extends protection duties to third parties (Art. 22).

Comparison with the GDPR

Question	Kazakhstan	GDPR
Ground for disclosure	As a rule, consent (Art. 7(6), Art. 15)	Any ground under Art. 6, including legitimate interest
Processor acting on instructions	No separate figure	Processor; mandatory contract (Art. 28)
Publicly available data	Special rules: consent, burden of proof, source reference, ban on non-purposive extraction	Still personal data; an ordinary legal basis is needed
Notice of disclosure	Within 10 working days where such a condition exists (Art. 19)	Information about recipients at collection (Arts 13–14)

Open questions

Open question: is a transfer to a contractor a transfer to a third party? The Law does not distinguish a recipient acting in its own interests from a contractor processing data on instructions. No official regulator position has been found so far.

Open question: what is “non-purposive extraction”? It is unclear whether the ban covers open-data analytics, media monitoring or counterparty checks.

Open question: the “condition to notify”. Article 19 requires notification “where there is a condition to notify” but does not say where that condition must be set: in the consent, a contract or a law.

Still to research

• Regulator guidance on transfers to contractors and within corporate groups.
• The rules on the state and non-state access control services (Arts 8-1, 8-2).
• Court practice on dissemination of personal data in public sources.

All quotations of Kazakhstan legislation are unofficial translations from the Russian text published on Adilet.