This document is being drafted since 2017, and this fact proves its importance for setting the grounds for cybersecurity in Belarus. Today protection of personal data is a tendency of the development of legislation in Europe (we are sure, you have heard about the GDPR and appropriate amendments to the legislation of the EU member states), and Belarus makes its attempt to regulate processing of personal data. In case this law is adopted, it will affect all of us: individuals, private companies and state bodies. However, this law will not apply to the relationships related to personal, family, home and similar use of personal data for non-commercial purposes.
The draft law shall be adopted in the second reading, then approved by the Council of the Republic and signed by the President. Therefore, now we are assessing the possible future impact of the new law.
Which data are we talking about?
The law will apply to the individuals (i. e., to each of us) in connection with our professional or commercial activities. If the data or their combination allow to identify specifically you (for example, first and last name, fingerprints, image, DNA code), then such data are considered personal. The operator which processes them applying automation tools or without applying such tools (but having the possibility to search among them - for example, lists and databases) must ensure compliance with the requirements of the law.
What should the companies pay attention to? Now, being an operator, you need to check all processes with personal data, ensure the protection of personal data of your employees, contractors which have the status of individual entrepreneur, consumers and other individuals whose data are processed by your company.
“I just called to…” receive your consent for processing of your data!
The key aspect for processing of the personal data is the consent of an individual. The list of cases when processing may be carried out without such a consent is also included into the draft law. For example, collection, processing, dissemination and provision of personal data for court procedures, state statistical observations, registration of the inheritance rights, payment of pensions, academic research purposes with compulsory anonymization of the data, for professional activity of journalists aimed at protecting the public interest are allowed without consent. It is interesting that for processing of personal data of dead people their consent is also needed: it should be given either by themselves during their life, or by their heirs or close relatives.
What should the companies pay attention to? Your company will need to receive the consent of individuals to process their data (however, it should be noted that this requirement has been in force before). The good news is that you can process the personal data of individuals with whom you have a contract concluded without their additional consent (that applies to your employees and contractors which have the status of individual entrepreneur, as well as to consumers, if you are a retailer or service provider). The consent is not necessary for processing of anonymized data.
Consent from the first click
The draft law provides that consent should be the “freely given, concrete and informed expression of the data subject’s will”. In simple words, you voluntarily give a consent for usage of the specific list of your personal data for specific purposes, and you are informed about all companies which you provide your data with, and the purposes of the procession of your data by these companies.
What should the companies pay attention to? You can choose a form of consent – either written or electronic, even by entering the code after receiving an SMS or email message, by putting a tick or any other mark on the web-site site. The main thing you need to remember is that you shall have the possibility to prove having obtained such consent from an individual, if required.
End of “endless” data collection
Personal data should be collected for specific purposes. All operations with the data should be conducted in accordance with these purposes. The amount of data collected should not exceed the goals set.
What should the companies pay attention to? You should not collect all the data “for potential future analysis or use”. Determine which personal data you really need for your activity now and notify the data subjects of the goals of processing of these data. Make sure that the data subjects understand them and agree. If these purposes change, you should obtain the consent of the data subject again.
Can I hire a processor?
Yes, it is possible, including processors in other countries, but the operator needs to obtain the consent of the data subject for the transfer data to the third-party processors (do not take it personally, it is so just because the data subject is a manager of their own data). The good news is that consent is not necessary in case of data transfer, including cross-border transfer, if such transfer is required for execution of the contract concluded with the data subject (for example, if such person orders goods from an online store). Data processing carried out by a third-party processor shall be carried out on the basis of a contract, and this processor should take all necessary data protection measures.
What should the companies pay attention to? You are responsible for the actions of all your processors before the data subject. Choose the processors carefully. And remember that the consent of the data subject for work with the data should be obtained by the company which needs these data (i.e., the operator, not the processor).
Medical and research organizations. As well as photo- and video-filming services
The draft law considers biometric and genetic data as special personal data. They include fingerprints, characteristics of the person’s face and image, information about a person’s physiology and health. Therefore, if you are a medical company or a professional photographer, the new rules will affect you.
What should the companies pay attention to? The list of cases when you can process such data is strictly limited. Moreover, even additional requirements may be introduced. For example, medical companies may collect such data for providing medical care services (1) by a medical person (doctor, pharmacist, and etc.) (2) who is obliged to take measures for personal data protection (3) and whom the medical secrecy requirements apply to (4 ). If you are a photographer, do not forget to receive the consent for the photo-shoot.
You have the right!
Finally, this moment has come, when the basic rights of the data subjects are reflected in the legislation. Individuals may obtain information about their rights related to processing of their personal data, give and withdraw their consent, familiarize themselves with their personal data being processed, demand termination of collection and processing. And it is not the full list. The procedure for submitting applications to the operator and the requirements to these applications are also set by the draft law. This application may be made either in oral, or in written form, as well as in the form of an electronic document signed by the electronic digital signature (if we interpret it strictly, that means that the application cannot be submitted to the operator by e-mail).
What should the companies pay attention to? Now you have the duty to explain these rights to the data subjects and ensure their realization.
What should I do, if data are leaked?
The provision which prohibits the operators from hiding the leakage of personal data appeared in the draft law. It also serves to protection of the interests of the data subjects.
What should the companies pay attention to? It is necessary to notify the authorized body (which will be determined after the law is adopted) immediately, but not later than 3 days after the company has become aware of these violations.
Will it be controlled?
The draft law provides that the President will determine the authorized body for the protection of the rights of personal data subjects. This body will monitor work with personal data, deal with complaints and interpret legislation, determine the list of states which ensure an adequate level of protection of the personal data subjects’ rights and issue permits for cross-border data transfer to countries which do not ensure such level of protection. Moreover, the supervision will be carried out by the Prosecutor General and the other prosecutors. So please take it all seriously.
What should the companies pay attention to?It will be required to provide the authorized body with the information confirming legality of your actions as an operator. The procedure for submitting of this information has not been determined yet.
Protect them, if you can
The draft law sets the requirements to data protection measures. It also establishes mandatory measures to be followed by the operator, which include the creation of the division or appointment of the person responsible for data protection, publication of the company’s policy on data processing, informing employees, setting the procedure of access to the personal data, implementation of the technical and cryptographic data protection. Moreover, in case the violations are discovered, the personal data subjects are entitled to compensation (even for moral harm).
What should the companies pay attention to? There is a lot of work ahead, but you will be given one year to prepare and ensure compliance.



