Commentary on Article 147. Violation of the Inviolability of Private Life and the Legislation of the Republic of Kazakhstan on Personal Data and Their Protection of the Criminal Code of the Republic of Kazakhstan

1. Failure to comply with measures for the protection of personal data by a person entrusted with the obligation to take such measures, if this act causes substantial harm to the rights and legitimate interests of individuals, —

shall be punishable by a fine in an amount of up to three thousand monthly calculation indices, or corrective labor in the same amount, or community service for a period of up to six hundred hours, or restriction of liberty for a period of up to two years, or imprisonment for the same period, with deprivation of the right to hold certain positions or engage in certain activities for a period of up to three years, or without such deprivation.

2. The unlawful collection, without the person's consent, of information concerning the private life of an individual that constitutes a personal or family secret, or causing substantial harm to the rights and legitimate interests of an individual as a result of the unlawful collection and (or) processing of other personal data, —

shall be punishable by a fine in an amount of up to five thousand monthly calculation indices, or corrective labor in the same amount, or community service for a period of up to eight hundred hours, or restriction of liberty for a period of up to three years, or imprisonment for the same period.

3. The acts provided for in Part Two of this Article, committed by a person through the use of their official position or special technical means intended for the covert acquisition of information, or through unlawful access to electronic information resources or an information system, or unlawful interception of information transmitted via telecommunications networks, or for the purpose of obtaining benefits and advantages for themselves or for other persons or organizations, —

shall be punishable by imprisonment for a period of up to five years, with deprivation of the right to hold certain positions or engage in certain activities for a period of two to five years, or without such deprivation.

4. Dissemination, without the person's consent, of information concerning the private life of an individual that constitutes a personal or family secret, or causing substantial harm to the rights and legitimate interests of an individual as a result of the unlawful collection and (or) processing of other personal data, —

shall be punishable by imprisonment for a period of up to five years.

5. Dissemination of the information specified in Part Four of this Article in a public speech, a publicly displayed work, in the mass media, or through the use of telecommunications networks, —

shall be punishable by imprisonment for a period of up to seven years.

The social danger of the crime is expressed in the violation of the constitutional right to the inviolability of private life, that is, the sphere of public relations that exists outside the scope of official and (or) public activities, as well as in the violation of legislation on personal data and their protection. Intrusion into a person's private life and the unlawful collection and processing of personal data may negatively affect the victim's performance of professional duties, business reputation, family life, etc.

The legislative basis for the protection of human rights to private life is the Universal Declaration of Human Rights of December 10, 1948, Article 3 of which states that everyone has the right to life, liberty and security of person.

The right to private life is enshrined in the International Covenant on Civil and Political Rights of December 16, 1966, Article 17 of which states: “No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.”

The right to private life is also enshrined in the PACE Declaration as the “right to conduct one's life as one sees fit, with the minimum possible interference by outsiders.”

In the Republic of Kazakhstan, the inviolability of private life is among the constitutional rights of individuals and citizens. Thus, Paragraph 1 of Article 18 of the Constitution of the Republic of Kazakhstan states that everyone has the right to the inviolability of private life, personal and family secrets, and the protection of their honor and dignity.

This right belongs to the category of natural human rights, belongs to everyone from birth regardless of whether they have citizenship, and allows information about one's personal and family life to be kept secret from other persons.

The object of the act under consideration is public relations ensuring the exercise of the right to the inviolability of private life.

The subject matter consists of information concerning the private life of an individual that constitutes their personal or family secret, as well as their personal data. For the qualification of a crime under this Article, it is important that the individual wished to keep such information confidential, regardless of its nature. This may include any information outside the sphere of public interest, for example, information about family relationships, relations with relatives, activities outside work, hobbies, friendships, various aspects of intimate life, health conditions, creative plans, and others. This also includes information relating to an identified or identifiable data subject, recorded on an electronic, paper and (or) other tangible medium (personal data).

The objective element is expressed in the failure to comply with measures for the protection of personal data by a person entrusted with the obligation to take such measures, provided that this act causes substantial harm to the rights and legitimate interests of individuals.

According to Subparagraph 2) of Article 1 of the Law of the Republic of Kazakhstan dated May 21, 2013, “On Personal Data and Their Protection,” personal data means information relating to an identified or identifiable data subject, recorded on an electronic, paper and (or) other tangible medium.

Personal data protection means a set of measures, including legal, organizational and technical measures, implemented for the purposes established by the Law “On Personal Data and Their Protection” (Subparagraph 11) of Article 1 of the said Law).

Measures for the protection of personal data are provided for in Articles 20–23 of the said Law. In particular, Article 22 of the Law establishes the obligations of the owner and (or) operator, as well as a third party, regarding the protection of personal data. Specifically, they are obliged to take the necessary measures to protect personal data, ensuring: 1) prevention of unauthorized access to personal data; 2) timely detection of instances of unauthorized access to personal data if such unauthorized access could not be prevented; 3) minimization of the adverse consequences of unauthorized access to personal data; 4) provision of access to the State Technical Service to informatization facilities that use, store, process and disseminate restricted-access personal data contained in electronic information resources, for the purpose of conducting an examination of the security of processes involving the storage, processing and dissemination of restricted-access personal data contained in electronic information resources, in accordance with the procedure determined by the authorized body.

The specific features of protecting electronic information resources containing personal data are established by the Law of the Republic of Kazakhstan dated November 24, 2015, “On Informatization.” Failure to comply with the measures for the protection of personal data provided for in the said Laws occurs in cases of violation of the rules governing the protection of personal data.

The obligations of the owner and (or) operator, as well as a third party, to protect personal data arise from the moment the personal data are collected and remain in force until the moment they are destroyed or depersonalized.

The procedure for the implementation of measures for the protection of personal data by the owner and (or) operator, as well as a third party, is determined by the Rules for the Implementation of Measures for the Protection of Personal Data by the Owner and (or) Operator, as well as a Third Party, approved by Resolution of the Government of the Republic of Kazakhstan dated September 3, 2013.

Liability under Part 1 of the commented Article is provided for inaction. In this regard, it is necessary to establish: 1) which measures for the protection of personal data were not complied with by the offender; 2) whether the person had the opportunity to take the measures for the protection of personal data prescribed by the legislation of the Republic of Kazakhstan. A mandatory condition for criminal liability under Part 1 of Article 147 of the Criminal Code is the infliction of substantial harm to the rights and legitimate interests of individuals. Harm to the rights and legitimate interests of individuals is recognized as substantial if the following consequences occur: violation of the constitutional rights and freedoms of individuals and citizens, the rights and legitimate interests of organizations, and the interests of society and the state protected by law; infliction of significant damage; the victim finding themselves in a difficult life situation; disruption of the normal operation of organizations or government bodies, etc.

Thus, the elements of the crime for which liability is provided under Part 1 of the commented Article belong to the category of material elements. The crime is considered completed from the moment substantial harm is caused to the rights and legitimate interests of individuals whose personal data were not protected as a result of failure to comply with the measures for their protection.

The subject of the crime is special. It is a person entrusted with the obligation to take measures for the protection of personal data. These include the owner and (or) operator, as well as a third party, who are obliged by legislative requirements to take measures for the protection of personal data. In accordance with Article 1 of the Law “On Personal Data and Their Protection,” the owner of a database containing personal data is a state body, an individual and (or) legal entity exercising, in accordance with the laws of the Republic of Kazakhstan, the right to own, use and dispose of a database containing personal data (Subparagraph 9)); the operator of a database containing personal data is a state body, an individual and (or) legal entity carrying out the collection, processing and protection of personal data (Subparagraph 10)); a third party is a person who is not a data subject, owner and (or) operator, but is connected with them (or it) by circumstances or legal relationships relating to the collection, processing and protection of personal data (Subparagraph 17)).

The objective element of the act under consideration, as provided for in Part 2, consists of: 1) the unlawful collection, without the person's consent, of information concerning the private life of an individual that constitutes their personal or family secret; 2) the unlawful collection and (or) processing of other personal data, resulting in substantial harm to the rights and legitimate interests of the individual.

Unlawful collection of information concerning private life should be understood as actions by a person who is not authorized to do so, aimed at collecting information constituting the personal or family secret of the victim. The individual to whom such information relates decides whether it constitutes a personal or family secret. A court may agree or disagree with that person's opinion. Information may be collected openly — the offender examines documents, letters and diaries in the victim's home or at the homes of their relatives and friends; or covertly — the offender examines official documents, disciplinary records, medical histories, etc.

Obtaining information about a citizen's private life is permitted in the course of criminal procedural and operational investigative activities.

The list of lawful grounds for collecting and processing personal data without the data subject's consent is established by Article 9 of the Law “On Personal Data and Their Protection.” These include: 1) carrying out the activities of law enforcement agencies and courts, and enforcement proceedings; 2) carrying out state statistical activities; 3) the use of personal data by state bodies for statistical purposes, subject to their mandatory depersonalization; 4) implementation of international treaties ratified by the Republic of Kazakhstan; 5) protection of the constitutional rights and freedoms of individuals and citizens where it is impossible to obtain the consent of the data subject or their legal representative; 6) the exercise of the lawful professional activities of a journalist and (or) the activities of a mass media outlet, or scientific, literary or other creative activities, provided that the requirements of the legislation of the Republic of Kazakhstan concerning the protection of the rights and freedoms of individuals and citizens are observed; 7) publication of personal data in accordance with the laws of the Republic of Kazakhstan, including personal data of candidates for elected public positions; 8) failure by the data subject to perform their obligations to provide personal data in accordance with the laws of the Republic of Kazakhstan; 9) obtaining information by a state body that regulates, controls and supervises the financial market and financial organizations from individuals and legal entities in accordance with the legislation of the Republic of Kazakhstan; 10) other cases established by the laws of the Republic of Kazakhstan. Thus, the collection and processing of personal data without the data subject's consent, carried out in violation of the requirements established by personal data legislation and therefore unlawful, constitute the objective element of the crime provided for in Part 2 of the commented Article if such actions cause substantial harm to the rights and legitimate interests of the data subject.

In accordance with Article 1 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection,” the collection of personal data means actions aimed at obtaining personal data (Subparagraph 5)); the processing of personal data means actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalization, blocking and destruction of personal data (Subparagraph 12)).

Personal data includes information about an identified subject, recorded on an electronic, paper and (or) other tangible medium, which makes it possible to identify that subject.

Requirements for maintaining the confidentiality of personal data are established in Article 11 of the Law of the Republic of Kazakhstan dated May 21, 2013, “On Personal Data and Their Protection.”

According to this Law, owners and (or) operators, as well as third parties who obtain access to restricted-access personal data, ensure their confidentiality by complying with the requirement not to permit their dissemination without the consent of the data subject or their legal representative, or in the absence of another lawful ground. Persons who become aware of restricted-access personal data due to professional or official necessity, as well as through employment relationships, are obliged to ensure their confidentiality.

Depending on accessibility, personal data are divided into publicly accessible data and restricted-access data. Publicly accessible personal data means personal data to which access is unrestricted with the consent of the data subject or to which, in accordance with the legislation of the Republic of Kazakhstan, confidentiality requirements do not apply (biographical directories, telephone and address books, publicly accessible electronic information resources, mass media). Restricted-access personal data means personal data access to which is restricted by the legislation of the Republic of Kazakhstan.

According to Subparagraph 14) of Article 3 of the Criminal Code, substantial harm means the violation of the constitutional rights and freedoms of individuals and citizens, the rights and legitimate interests of organizations, and the interests of society and the state protected by law; the infliction of significant damage; the victim finding themselves in a difficult life situation; disruption of the normal operation of organizations or government bodies; and other consequences indicating the substantial nature of the harm caused.

Other consequences may include the loss of trust on the part of others, deterioration of relations within the family, with acquaintances and colleagues, the failure of a profitable transaction, damage to business reputation, etc. The harm caused may be both material and moral.

Where the objective element consists of the unlawful collection, without the person's consent, of information concerning the private life of an individual that constitutes their personal or family secret, the crime is considered completed from the moment the specified actions are carried out; that is, in this part, the crime has a formal structure.

In the case of unlawful collection and (or) processing of other personal data, the crime is considered completed from the moment the consequences occur. For these actions to be recognized as a criminally punishable act, it is necessary that they result in substantial harm to the rights and legitimate interests of citizens whose personal data have been unlawfully collected and (or) processed. Consequently, in terms of its structure, the crime in this case is material.

In Part 3 of Article 147 of the Criminal Code, the legislator provides for an aggravated form of the act under consideration — the unlawful collection, without the person's consent, of information concerning the private life of an individual that constitutes their personal or family secret, or causing substantial harm to the rights and legitimate interests of an individual as a result of the unlawful collection and (or) processing of other personal data, where such acts are committed by a person through the use of their official position or special technical means intended for the covert acquisition of information, or through unlawful access to electronic information resources or an information system, or unlawful interception of information transmitted via an information and communication network, or for the purpose of obtaining benefits and advantages for themselves or for other persons or organizations.

For the purposes of Article 147 of the Criminal Code, the use of one's official position should be understood as actions committed by a person within the scope of their official competence and within the framework of the rights and duties vested in them by virtue of the position they hold.

If an official, using their official authority, influences another person for the purpose of inducing that person to unlawfully collect, without the person's consent, information concerning the private life of an individual that constitutes their personal or family secret, or to cause substantial harm to the rights and legitimate interests of an individual as a result of the unlawful collection and (or) processing of other personal data, as well as to fail to comply with measures for the protection of personal data by a person entrusted with the obligation to take such measures, where this act causes substantial harm to the rights and legitimate interests of individuals, the actions of such official should be qualified as incitement to commit these acts (Part 4 of Article 28 of the Criminal Code, Part 1 or 2 of Article 147 of the Criminal Code).

It should be noted that the special-subject characteristic is not mandatory for the elements of the crime provided for in Part 3 of Article 147 of the Criminal Code. For example, the unlawful collection, without the person's consent, of information concerning the private life of an individual that constitutes their personal or family secret through unlawful access to electronic information resources or an information system, or through unlawful interception of information transmitted via a telecommunications network, may be carried out by a person who does not possess the characteristics of a special subject.

Special technical means intended for the covert acquisition of information are understood to mean devices and other equipment that record, capture and decipher information. The use of special technical means intended for the covert acquisition of information increases the possibility of obtaining more complete information and, consequently, increases the degree of public danger of the act.

According to Subparagraph 4) of Article 1 of the Law of the Republic of Kazakhstan dated September 15, 1994, “On Operational Investigative Activities,” special technical means are devices, equipment, instruments and apparatus having special functions, software and design features for obtaining and documenting information during operational investigative measures and covert investigative actions.

According to Article 1 of the Law of the Republic of Kazakhstan dated November 24, 2015, “On Informatization,” electronic information resources are information in electronic-digital form contained on an electronic medium and in informatization facilities (Subparagraph 57)); an information system is an organizationally ordered set of information and communication technologies, service personnel and technical documentation that implements certain technological operations through information interaction and is intended to solve specific functional tasks (Subparagraph 12)).

According to Subparagraph 55) of Article 2 of the Law of the Republic of Kazakhstan dated July 5, 2004, “On Communications,” a telecommunications network is a set of telecommunications facilities and communication lines ensuring the transmission of telecommunications messages, consisting of switching equipment (stations, substations, concentrators, linear cable structures (subscriber and connecting lines and channels), transmission systems and subscriber devices).

Unlawful access to electronic information resources or an information system should be understood as access to them in violation of the established rules developed by the owner of the information system or information resource.

According to Paragraph 4 of Article 35 of the Law “On Informatization,” access to electronic information resources is carried out by sending a request to the owner or holder of the information system in one of the following ways: 1) by transmitting a request using email or in the form of an electronic document certified by an electronic digital signature; 2) by the user's direct access to publicly accessible electronic information resources and information systems.

The use of information and communication networks should be understood as the use of a set of technical and hardware-software means ensuring interaction between information systems or between their components, as well as the transmission of information resources.

Unlawful interception of information transmitted via an information and communication network should be understood as the unlawful acquisition of information from information networks or their components, or from information resources forming part of an information and communication network. The method of interception is irrelevant for the purposes of qualification.

Benefits and advantages should be understood as benefits of a property-related or non-property-related nature. For example, a person possessing information about another person's private life transfers or disseminates it for a certain fee or out of some other personal interest. For more details on the concept of obtaining benefits and advantages for oneself or for other persons or organizations, see the commentary to Article 361 of the Criminal Code.

The elements of the crime for which liability is provided under Part 3 of the commented Article belong to the category of formal elements. The crime should be considered completed from the moment the offender unlawfully collects, without the person's consent, information concerning the private life of an individual that constitutes their personal or family secret, using the methods specified in Part 3 of Article 147 of the Criminal Code.

Part 4 provides for liability for the dissemination, without the person's consent, of information concerning the private life of an individual that constitutes their personal or family secret, or for causing substantial harm to the rights and legitimate interests of an individual as a result of the unlawful collection and (or) processing of other personal data.

According to Subparagraph 15) of Article 1 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection,” the dissemination of personal data means actions resulting in the transfer of personal data, including through mass media, or the provision of access to personal data by any other means.

For the concept of substantial harm to the rights and legitimate interests of an individual as a result of the unlawful collection and (or) processing of other personal data, see the commentary to Subparagraph 14) of Article 3 of the Criminal Code.

According to Article 1 of the Law of the Republic of Kazakhstan “On Personal Data and Their Protection,” the processing of personal data means actions aimed at the accumulation, storage, modification, supplementation, use, dissemination, depersonalization, blocking and destruction of personal data (Subparagraph 12)); accumulation of personal data means actions involving the systematization of personal data by entering them into a database containing personal data (Subparagraph 4)); destruction of personal data means actions as a result of which it becomes impossible to restore the personal data (Subparagraph 6)); use of personal data means actions involving personal data aimed at implementing the activities of the owner, operator and third party (Subparagraph 13)); storage of personal data means actions aimed at ensuring the integrity, confidentiality and availability of personal data (Subparagraph 14)); depersonalization of personal data means actions as a result of which it becomes impossible to determine the attribution of personal data to a data subject (Subparagraph 7)).

The elements of the crime for which liability is provided under Part 4 of the commented Article belong to the category of formal elements.

Dissemination of information concerning the private life of an individual that constitutes their personal or family secret should be understood as the act of communicating such information to at least one person without the victim's consent, regardless of the method used (orally, in writing, by telephone or through other communication channels). The information may have been collected by any means: during conversations with neighbors, acquaintances or work colleagues; as a result of visual observation; by examining documents, etc.

Part 5 provides for liability for the dissemination of information concerning a person's private life in a public speech, a publicly displayed work, or in the mass media, or through the use of telecommunications networks, which poses a greater degree of public danger than merely collecting such information or disseminating it to one or several persons.

A public speech is a speech delivered before a specific audience in the form of a lecture or conversation.

A publicly displayed work is understood to mean the presentation of an audio or video recording. Posting information on the Internet is considered a public display of a work if any person has access to such information.

The concept of mass media is defined in Article 1 of the Law of the Republic of Kazakhstan dated July 23, 1999, “On Mass Media.” A mass medium is a periodical printed publication, television or radio channel, film documentation, audiovisual recording, or another form of periodic or continuous public dissemination of mass information, including Internet resources (Subparagraph 4)); a periodical printed publication is a newspaper, magazine, almanac, bulletin or supplements thereto, having a permanent title and current issue and published at least once every three months (Subparagraph 11)).

The elements of the crime for which liability is provided under Part 5 of the commented Article belong to the category of formal elements.

The increased public danger of such actions is due to the fact that unwanted personal information becomes known to a wide circle of outsiders, which may cause more substantial harm to the rights and freedoms of the victim.

The subjective element is characterized exclusively by direct intent. The offender realizes the socially dangerous nature of their actions, foresees the possibility or inevitability of the consequences specified in the law and desires their occurrence. The motive for the criminal offense is generally mercenary, but does not affect the legal qualification.

The subject of the crime under Parts 2, 3, 4 and 5 is a sane natural person who has attained the age of sixteen.

In certain cases, the disclosure of information about private life under the Criminal Code simultaneously constitutes the elements of another crime: disclosure of the secret of adoption (Article 138 of the Criminal Code), disclosure of information about security measures applied in respect of an official holding a responsible public position (Article 382 of the Criminal Code). In such cases, the act is qualified cumulatively with the commented Article. Conversely, the unlawful disclosure of a personal or family secret by a person who is legally obliged to disclose it (for example, during questioning as a witness) does not constitute an unlawful act.

If the unlawful collection of information concerning private life is accompanied by unlawful entry into a dwelling against the will of the person residing therein, the act should be qualified cumulatively with Article 149 of the Criminal Code.

The act provided for in Part 1 of Article 147 of the Criminal Code belongs to the category of minor offenses.

The acts provided for in Parts 2, 3 and 4 of Article 147 of the Criminal Code belong to the category of medium-gravity crimes.

The act provided for in Part 5 of Article 147 of the Criminal Code belongs to the category of serious crimes.

Commentary of 2021 to the Criminal Code of the Republic of Kazakhstan by Isidor Shamilovich Borchashvili, Honored Figure of Kazakhstan, Doctor of Law, Professor, Academician of the National Academy of Natural Sciences of Kazakhstan, Member of the Scientific Advisory Councils under the Constitutional Council of the Republic of Kazakhstan and the Supreme Court of the Republic of Kazakhstan, Member of the Working Group on Reform of the Law Enforcement System under the Security Council of the Republic of Kazakhstan, Honored Employee of the Ministry of Internal Affairs of the Republic of Kazakhstan.

Constitution Law Code Regulatory Decree Order Decision Resolution Lawyer Almaty Lawyer Legal services Legal Consultation Civil Criminal Administrative cases disputes Defense Arbitration Legal Company of Kazakhstan Law Office Court Cases Declaration Decree Order Resolution Decision Report Conclusion Application Conclusion Convention Contract Memorandum Methodology Norms Note Rules Program Charter Charter Article Commentary Resolution Regulation Protocol Draft Program Rules Messages