The Law “On Personal Data Protection” is adopted

Law No. 99-Z dated 07.05.2021 “On Personal Data Protection” has been adopted in Belarus, which will significantly change the issues of personal data processing, enshrine new rights and obligations, mechanisms for protecting the rights of personal data subjects from 15.11.2021.

Here are the key changes.

What is personal data?

Personal data (hereinafter – “PD“) is any information related to an identified individual or an individual who can be identified (i.e. directly or indirectly determined, in particular, through a full name, date of birth, identification number or through one or more characteristics of his physical, psychological, mental, economic, cultural or social identity).

A separate group of PD includes:

• special PD – personal data related to race or nationality, political views, membership in trade unions, religious or other beliefs, health or sexual life, bringing to administrative or criminal responsibility, biometric and genetic PD;
• publicly available PD – personal data distributed by the PD subject himself or with his/her consent or distributed in accordance with the requirements of legislative acts.

FYI. Currently, the term “PD” means the main and additional PD of an individual. They are to be entered into the population register, as well as other data that allow identifying such a person.

What is PD processing?

PD processing is any action or set of actions performed with PD, including their collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision and deletion.

How are PD processed?

PD processing should be:

• committed on a legal basis;
• proportionate to the stated goals;
• carried out with the consent of the PD subject, if necessary;
• limited to achieving specific, pre-stated legitimate goals. PD processing that is not compatible with the originally stated goals is not allowed. If a change in the purpose of their processing is required, the operator must re-obtain the consent of the PD subject;
• transparent: the PD subject is provided with the relevant information regarding the processing of his/her PD.

How to get the PD subject’s consent and when there is no need in it?

The consent of the PD subject is a free, unambiguous, informed expression of his/her will, through which he/she authorizes the processing of his/her PD. It can be received in writing, in the form of an electronic document or in another electronic form (in some cases either in writing or in the form of an electronic document).

Before obtaining consent, the operator must:

• in writing or electronically provide the PD subject with information containing:
• name (full name (if available) and location (address of the place of residence/stay)) of the operator who receives the consent;
• goals of PD processing;
• the list of PD, subject to giving the consent;
• the period for which the consent is given;
• information about authorized persons if the PD processing is carried out by them;
• a list of actions with PD, to which consent is given, a general description of the methods of PD processing used by the operator;
• other information necessary to ensure PD processing transparency.
• explain in a simple and clear language to the PD subject his/her rights related to PD processing, mechanism of their implementation, as well as the consequences of giving consent/refusal to give such consent. This information must be provided by the operator in writing or electronically separately from other information provided by him.

In addition, the operator is obliged to:

• ensure PD protection;
• obtain the consent of the PD subject, if necessary;
• take measures to ensure the reliability of the PD processed by it, update them, if necessary;
• prove the fact of obtaining consent;
• be responsible to the PD subject for the actions of the authorized person who is responsible for their processing.

Consent is not required in the following cases:

• conducting individual (personalized) registration of information about insured persons for the purposes of state social insurance, as well as professional pension insurance;
• documenting employment relations, as well as in the process of employment of a PD subject in certain cases;
• for the purpose of assigning and paying pensions, allowances;
• for organizing and conducting of state statistical observations, preparation of official statistical information;
• upon PD receipt by the operator on the basis of an agreement concluded (to be concluded) with the PD subject, in order to perform the actions established by this agreement;
• PD processing, if they are specified in a document addressed to the operator and signed by the PD subject, in accordance with the content of such a document;
• in case the legislation directly provides for the PD processing without the PD subject’s consent, etc.

Moreover, since 01.03.2021, the responsibility for work with personal data has been strengthened, and therefore we recommend you to get acquainted with the key changes.

If you have any questions or would like our professional assistance on the issues connected with the legislation on personal data, experts of SCHNEIDER GROUP Minsk office will be glad to help you.