Kazakhstan: New user
identification requirements
"further regulate
social relations"
11 January 2018
The President of Kazakhstan, Nursultan Nazarbayev, signed, on 28 December 2017, the Law of 28 December 2017 No. 128-VI on Amendments and Additions to Certain Legislative Acts of the Republic of Kazakhstan on Issues of Information and Communication ('the Law'), with most of the provisions entering into force on 9 January 2018. The Law imposes additional duties of website operators and telecommunications operators, including the obligation to collect and store users' data.
Marina Kahiani and Lola Abdukhalykova, Partner and Associate at GRATA International, told DataGuidance, "The Law is aimed at further regulating social relations in the sphere of mass media, informatisation and communications. Under the Law, which amends the Law of 24 November 2015 No. 418-V on Informatisation, owners of publicly available electronic informational resources (website operators) shall be required to identify website users who intend to publish information on an operator's website."
According to the Law, website operators will also be obliged to enter into a user agreement before allowing users to post comments or publish related information on their sites, and the information provided for the purposes of entering into the agreement will need to be retained for the duration of the agreement and for three months from its termination.
[O]ur interpretation suggests that the Law shall not apply to websites which, although publicly available from the territory of Kazakhstan, are established abroad
Kahiani and Abdukhalykova commented, "The Law applies to all types of companies [oering web services]. For website operators, the Law [applies to] legal relations in the territory of Kazakhstan; however, our interpretation suggests that the Law shall not apply to websites which, although publicly available from the territory of Kazakhstan, are established abroad. Please note, however, that there has been court practice where Kazakh state authorities blocked access from the territory of Kazakhstan to foreign websites that breached Kazakh law."
Moreover, the Law imposes specic transfer restrictions on website operators and telecommunications operators with regard to the user data that they collect, which adds to the requirement under the Law of 21 May 2013 No. 94-V on Personal Data Protection for data operators to maintain their personal information databases in Kazakhstan.
Kahiani and Abdukhalykova concluded, "The Law requires website operators and telecommunications operators to store information on their subscribers or users only in the territory of Kazakhstan. Additionally, a cross-border data transfer of such information is not permitted, except for the information that must be transferred during the course of providing roaming services. Moreover, the parallel storage of a database [both in Kazakhstan and abroad] will evidently also not be permitted."
Marina Kahiani | Partner | GRATA International
Lola Abdukhalykova | Associate | GRATA International
Kaveh Lahooti | Privacy Analyst | DataGuidance
