COVID-19 and Privacy in Kazakhstan: Legal aspects of citizens’ personal data processing during a state of emergency

Quarantine regime has been introduced in Almaty, Nur-Sultan and other cities by the Decree of the President of Kazakhstan “On the introduction of a state of emergency in the Republic of Kazakhstan” to combat against spread of coronavirus infection COVID-19.

Decree issued by the President of Kazakhstan “On the introduction of a state of emergency in the Republic of Kazakhstan”

According to the Decree of Acting the Chief State Sanitary Doctor of Almaty city dated March 18, 2020 No. 8 “On introduction of the quarantine regime in Almaty”, the Police Department is obligated to ensure, among other things, “control over citizens to ensure the home quarantine regime with no right to move outside, with location data tracking from citizens' mobile phones."

Decree of Acting the Chief State Sanitary Doctor of Almaty city dated March 18, 2020 No. 8 “On introduction of the quarantine regime in Almaty”

The Law of the Republic of Kazakhstan “On the state of emergency” allows certain restrictions on rights and freedoms of citizens, including the right to free movement and the right to privacy, however, these restrictions, according to Article 17 of this Law, must be implemented to the extent that are caused by circumstances, served as the basis for the imposition of a state of emergency and should not contradict international human rights treaties ratified by Kazakhstan.

As for the directive of “location data tracking from citizens' mobile phones,” obviously, it is an interference with the right to privacy by tracking the coordinates of mobile phone users with the assistance of telecommunication companies. This measure belongs to the data processing obtained from electronic communications, such as location data from mobile user devices. The legal basis for this limitation is an emergency situation with the spread of the virus.

Many governments are willing to use location data from citizens' smartphones to control the spread of coronavirus infection. According to The Washington Post, USA has been negotiating with Facebook, Google and other technology companies with the participation of health experts. Meanwhile, the public is curios: “Has this measure used in emergency situations, breaks limits of the restriction of human rights to privacy and confidentiality of personal data?”

As per The Washington Post

When processing data obtained using electronic communications, such as location data from smartphones in the European Union, ePrivacy Directive is used, which establishes the principle that mobile location data can only be used by an operator when they are made anonymous, or with the consent of the individuals.

According to the position of the European Data Protection Board, published on March 16, 2020, the current legislation of the European Union provides rules to apply to the processing of personal data in a context such as the one relating to COVID-19. Indeed, the GDPR provides for the legal grounds to enable the employers and the competent public health authorities to process personal data in the context of epidemics, without the need to obtain the consent of the data subject. This applies for instance when the processing of personal data is necessary for the employers for reasons of public interest in the area of public health or to protect vital interests (Art. 6 and 9 of the GDPR) or to comply with another legal obligation.

The position of the European Data Protection Board

Unfortunately, the Law of Kazakhstan “On personal data and their protection” limits the obligation to anonymize data only by collecting and processing personal data for statistical, sociological and scientific research. However, the lower house (Mazhilis) of Parliament of Kazakhstan is currently considering a so-called draft law on digital technologies, which, among other things, protecting rights of personal data subjects, involves the following addition to Article 17 of the Law "On Personal Data and its Protection":

Draft Law on Digital Technologies

“An essential condition for processing of personal data for implementation public functions is its depersonalization."

The draft law on digital technologies has already passed the first reading in the Mazhilis on March 18, 2020.

Analytics of anonymous data on the coordinates of smartphone owners might help to get a better idea of the spread of the virus. In this regard, these emergency measures for real-time monitoring of data from smartphones of those who are already infected or could become infected with coronavirus should be considered as justified, but with mandatory depersonalization of the collected and processed personal data of citizens.

Representing the state, prosecution authorities ensure supreme supervision over the accurate and uniform application of the Law of the Republic of Kazakhstan “On Personal Data and its Protection”. In addition, according to the Decree of the President of Kazakhstan “On the introduction of a state of emergency in the Republic of Kazakhstan”, the Prosecutor General of Kazakhstan should ensure rule of the law in the implementation of emergency measures and temporary restrictions.

Declarations of states of emergency, whether for health or security reasons, have clear guidance from international law, the UN experts said. “The use of emergency powers must be publicly declared and should be notified to the relevant treaty bodies when fundamental rights including movement, family life and assembly are being significantly limited.”

COVID-19: States should not abuse emergency measures to suppress human rights – UN experts

Some States and security institutions may find the use of emergency powers attractive because it offers shortcuts, the experts said. “To prevent such excessive powers to become hardwired into legal and political systems, restrictions should be narrowly tailored and should be the least intrusive means to protect public health.”