{"id":4820,"date":"2014-07-23T18:26:59","date_gmt":"2014-07-23T18:26:59","guid":{"rendered":"http:\/\/internetpolicy.kg\/2014\/07\/23\/%d0%b7%d0%b0%d0%ba%d0%bb%d1%8e%d1%87%d0%b5%d0%bd%d0%b8%d0%b5-%d0%ba-%d0%bf%d1%80%d0%be%d0%b5%d0%ba%d1%82%d1%83-%d0%b7%d0%b0%d0%ba%d0%be%d0%bd%d0%b0-%d0%ba%d1%8b%d1%80%d0%b3%d1%8b%d0%b7%d1%81%d0%ba\/"},"modified":"2019-04-13T17:51:03","modified_gmt":"2019-04-13T17:51:03","slug":"zakljuchenie-k-proektu-zakona-kyrgyzsk","status":"publish","type":"post","link":"https:\/\/internetpolicy.kg\/en\/2014\/07\/23\/zakljuchenie-k-proektu-zakona-kyrgyzsk\/","title":{"rendered":"Conclusion to the draft Law of the Kyrgyz Republic \u201cOn Biometric Registration of Citizens of the Kyrgyz Republic\u201d"},"content":{"rendered":"<p style=\"text-align: center;\"><span style=\"font-weight: 400;\">CONCLUSION<\/span><\/p>\n<p style=\"text-align: center;\"><span style=\"font-weight: 400;\">On the draft law of the Kyrgyz Republic<\/span><\/p>\n<p style=\"text-align: center;\"><b>On biometric registration of citizens of the Kyrgyz Republic<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Having reviewed the draft Law of the Kyrgyz Republic <\/span><i><span style=\"font-weight: 400;\">On Biometric Registration of Citizens of the Kyrgyz Republic<\/span><\/i><span style=\"font-weight: 400;\"> (hereinafter the draft law \/ draft law), the Public Foundation <\/span><i><span style=\"font-weight: 400;\">Civic Initiative Internet Policies<\/span><\/i><span style=\"font-weight: 400;\"> (hereinafter referred to as PF CIIP) notes that this draft law contains <\/span><b>legal shortcomings<\/b><span style=\"font-weight: 400;\"> that create the opportunity for ambiguous interpretation of some of the provisions contained in it, which in practice may lead to an arbitrary interpretation and inadequate application of this draft legislation and, as a result, to unreasonable restriction of the rights and freedoms of a person and citizen. The draft law does not comply with the Constitution of the Kyrgyz Republic, the Civil Code of the Kyrgyz Republic, the Law of the Kyrgyz Republic <\/span><i><span style=\"font-weight: 400;\">On Personal Information<\/span><\/i><span style=\"font-weight: 400;\"> dated April 14, 2008 N 58, international standards in the field of personal data protection.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">MAIN CONCLUSIONS:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">1) One of the main gaps and shortcomings of the draft law is the unjustified non-assignment of biometric data to personal information \/ personal data. Whereas, according to the legislation of the Kyrgyz Republic, <\/span><b>the biometric data of citizens is personal data<\/b><span style=\"font-weight: 400;\">. And, therefore, <\/span><b>they should be subject to all the guarantees and principles that are laid down in the Constitution and the legislation of the Kyrgyz Republic<\/b><span style=\"font-weight: 400;\"> on <\/span><b>privacy and the right to self-determination in relation to their personal data<\/b><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The basic principles that are enshrined in the Constitution, the Civil Code, the legislation of the Kyrgyz Republic in relation to personal data of citizens &#8211; the right of citizens to the integrity and protection of private (personal) life, personal data are confidential information, in relation to personal data, the principle of self-determination.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Thus, international standards in the field of personal data protection and the legislation of the Kyrgyz Republic unequivocally establish that only a personal data subject has the right to independently decide whether or not to provide his personal data to someone, he has the right to refuse to provide it without giving a reason, and has the right to demand blocking and destructing his personal data. <\/span><b>Thus, it is an inalienable right of the subject of personal data, guaranteed by the Constitution and not subject to any restrictions.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Taking into account the above provisions of the legislation of the Kyrgyz Republic, <\/span><b>no legislative act<\/b><b>2<\/b><b> can impose a duty on citizens to provide their personal data on a mandatory basis, no state body has the right to require mandatory submission of his\/her personal data.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">2) It is doubtful whether one of the tasks that the draft law is intended to solve is \u201creachable:<\/span><b>\u201c compiling an updated voter list<\/b><span style=\"font-weight: 400;\"> \u201d<\/span><span style=\"font-weight: 400;\">3<\/span><span style=\"font-weight: 400;\">. As mentioned above, <\/span><b>whether or not to submit personal data is the right of each subject<\/b><span style=\"font-weight: 400;\">. Consequently, any citizen who has a passive electoral right <\/span><b>has the right to refuse to submit his biometric personal data without giving reasons. This means that the task of forming a voter list based on citizens&#8217; biometric data may not be solved.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Moreover, according to the Constitution of the Kyrgyz Republic, \u201cto elect and be elected\u201d is the <\/span><b>constitutional right of citizens <\/b><b>4<\/b><span style=\"font-weight: 400;\">, and <\/span><b>not an obligation<\/b><span style=\"font-weight: 400;\">; \u201cElections are free\u201d <\/span><span style=\"font-weight: 400;\">5<\/span><span style=\"font-weight: 400;\">. Hence it is not clear whether <\/span><b>citizens who have not submitted their biometric personal data will be admitted to the elections<\/b><span style=\"font-weight: 400;\">, and if not, on what grounds will this prohibition apply? And further, if to participate in the elections is the right of a citizen, on what basis to submit their biometric personal data for the formation of the list of voters referred by the bill to the duties.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">3) Practically in all countries of the world, the collection of biometric personal data of citizens is carried out with one purpose &#8211; for the introduction of a new generation of passports and exit \/ entry documents.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">It should be noted that in 2002, 118 countries of the world signed, under the auspices of the ICAO, the New Orleans Agreement \u201cDoc 9303. Machine Readable Travel Documents. Part 1 Machine Readable Passports. Volume 2. Specifications for electronic passports with biometric identification means\u201d, which <\/span><b>recognizes face biometrics as the basis for identification for the next generation of passports and entry visas.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">That is, biometric personal data can in essence be collected mainly for the purpose of creating foreign passports and entry visas with the obligatory confidentiality of such data and all legal requirements in the field of privacy.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Ukraine<\/span><span style=\"font-weight: 400;\">6<\/span><span style=\"font-weight: 400;\">, the Russian Federation<\/span><span style=\"font-weight: 400;\">7<\/span><span style=\"font-weight: 400;\">, Turkmenistan<\/span><span style=\"font-weight: 400;\">8<\/span><span style=\"font-weight: 400;\">, Moldova<\/span><span style=\"font-weight: 400;\">9<\/span><span style=\"font-weight: 400;\"> and other countries chose this path.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">This takes into account the phasing (gradual replacement of old passports with passports of a new generation) and voluntariness (self-determination of citizens in relation to their personal data).<\/span><\/p>\n<p><span style=\"font-weight: 400;\">4) The <\/span><b>\u201cBiometric Database of Citizens\u201d<\/b><span style=\"font-weight: 400;\"> united in one place, which \u201cis owned by the Government of the Kyrgyz Republic \u201d<\/span><span style=\"font-weight: 400;\">10<\/span><span style=\"font-weight: 400;\">, <\/span><b>in principle, cannot be created<\/b><span style=\"font-weight: 400;\">, because:<\/span><\/p>\n<p><b>&#8211; The formation of consolidated personal data files received by state authorities or local authorities from various state holders (owners) of personal data is not allowed<\/b><b>11<\/b><b>.<\/b><\/p>\n<p><b>&#8211; It is not allowed to combine arrays of personal data collected by holders (owners) for different purposes for automated information processing <\/b><b>12<\/b><b>.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">5) Before proceeding with the collection of biometric personal data of citizens, <\/span><b>the Government of the Kyrgyz Republic must implement the following measures provided for by the Law on Personal Data Protection:<\/b><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Create an authorized body within the meaning of the Law on Personal Data Protection, which will be entrusted with the functions of registering holders (owners) of an array of personal data, maintaining the Register of holders of an array of personal data; or impose such responsibilities on any government body;<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Conduct compulsory registration in the authorized state body:<\/span><\/li>\n<\/ul>\n<p><b>&#8211; arrays of personal data;<\/b><\/p>\n<p><b>&#8211; holders (owners) of these arrays;<\/b><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; <\/span><b>create a Register of holders of personal data<\/b><span style=\"font-weight: 400;\"> (fixing the information provided for by Article 30 of the Law on the Protection of Personal Data).<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Publish in the mass media the Register of personal data holders for general information.<\/span><\/li>\n<\/ul>\n<p><b>In more detail about all the legal shortcomings of the bill the analysis is given below.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">ANALYSIS OF BASIC PROVISIONS OF THE LAW:<\/span><\/p>\n<p>1)The law unreasonably does not include biometric data to personal information \/ personal data. The definition of \u201cpersonal data\u201d given in the draft law does not comply with the Law of the Kyrgyz Republic \u201cOn Personal Information\u201d (hereinafter &#8211; the Law on Personal Data).<\/p>\n<p><span style=\"font-weight: 400;\">Thus, according to Article 3 of the above Law, \u201cPersonal information (personal data) is recorded information on a material carrier about a specific person or which can be identified with a specific person, <\/span><b>allowing to identify this person directly or indirectly, by reference on one or more factors specific to its biological,<\/b><span style=\"font-weight: 400;\"> economic, cultural, civil or social <\/span><b>identity<\/b><span style=\"font-weight: 400;\">. Personal data includes <\/span><b>biographical and identification data<\/b><span style=\"font-weight: 400;\">, personal characteristics, information about marital status, financial status, health, etc. \u201d.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Thus, <\/span><b>according to the legislation of the Kyrgyz Republic, biometric data of citizens are personal data.<\/b><span style=\"font-weight: 400;\"> A similar approach (the assignment of biometric data to personal data) is used in international practice, the legislation of other states (including Russia, Kazakhstan, Lithuania, Ukraine, European states).<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Thus, in our opinion, in the definition of \u201cbiometric data\u201d it is necessary to indicate that \u201c<\/span><b>biometric data is personal data<\/b><span style=\"font-weight: 400;\"> (hereinafter referred to as the text)\u201d.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The <\/span><b>definition of personal data<\/b><span style=\"font-weight: 400;\"> given in the draft law must be either deleted or given <\/span><b>in accordance with the definition contained in the Law on Personal Data <\/b><span style=\"font-weight: 400;\">(in Article 3).<\/span><\/p>\n<p>2)It is doubtful whether the following provisions are included in the draft law:<\/p>\n<p><span style=\"font-weight: 400;\">&#8211; \u201cThe collection and use of biometric data of citizens of the Kyrgyz Republic is based <\/span><b>on the principles of mandatory biometric registration<\/b><span style=\"font-weight: 400;\">;\u201d <\/span><span style=\"font-weight: 400;\">13<\/span><span style=\"font-weight: 400;\">;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; \u201cIn addition to biometric data of citizens of the Kyrgyz Republic, \u00a0as well as personal data of a citizen of the Kyrgyz Republic <\/span><b>are also subject to compulsory collecting, storing and processing<\/b><span style=\"font-weight: 400;\">.\u201d <\/span><span style=\"font-weight: 400;\">14<\/span><span style=\"font-weight: 400;\">;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; \u201cThe Government of the Kyrgyz Republic <\/span><b>determines the list of personal data of citizens of the Kyrgyz Republic to be compiled on a mandatory basis<\/b><span style=\"font-weight: 400;\">.\u201d <\/span><span style=\"font-weight: 400;\">15<\/span><span style=\"font-weight: 400;\">;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">According to international standards in the field of personal data protection, personal data must be obtained and used in a conscientious and lawful manner, which implies, <\/span><b>above all, the consent of the subject, that is, the realization of the right to informational self-determination. Every person is guaranteed the right to self-determination in the use, transfer and disclosure of his personal data.<\/b><span style=\"font-weight: 400;\"> International generally accepted standards in the field of personal data protection require <\/span><b>the maximum human right to self-determination in relation to their personal data<\/b><span style=\"font-weight: 400;\">, which, at least, theoretically gives a person the ability to defend his rights to protect his data in any form of processing.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The need to protect personal data is based on one of the fundamental human rights &#8211; protection against interference with privacy. Article 12 of the Universal Declaration of Human Rights (adopted and proclaimed by General Assembly resolution 217 A (III) of December 10, 1948) states: \u201cNo one may be subjected to arbitrary interference with his personal and family life, arbitrary attacks on the integrity of his home, his secret correspondence or on his honor and reputation. Everyone has the right to the protection of the law against such interference or such attacks. \u201d<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The failure to guarantee the right to protection of personal data jeopardizes other related rights and freedoms, including freedom of expression, freedom of peaceful assembly, freedom of access to information, the principle of non-discrimination, and ultimately the stability of constitutional democratic principles. Therefore, in Article 17 of the International Covenant on Civil and Political Rights (ICCPR, New York, December 19, 1966) this formulation was expanded in terms of unlawful interventions and harassment and sounds like: \u201cNo one may be subjected to arbitrary interference with his personal and family life, arbitrary attacks on the integrity of his home, his secret correspondence or on his honor and reputation. Everyone has the right to the protection of the law against such interference or such attacks \u201d<\/span><\/p>\n<p><span style=\"font-weight: 400;\">According to the Constitution of the Kyrgyz Republic, \u201cThe Constitution has the highest legal force and direct effect in the Kyrgyz Republic. International treaties that have entered into force in accordance with the procedure established by law, to which the Kyrgyz Republic is a party, as well as <\/span><b>generally recognized principles and norms of international law are an integral part of the legal system of the Kyrgyz Republic. The norms of international human rights treaties have direct effect and priority over the norms of other international treaties<\/b><span style=\"font-weight: 400;\">. \u201d<\/span><span style=\"font-weight: 400;\">16<\/span><span style=\"font-weight: 400;\">. \u201cHuman rights and freedoms are inalienable and belong to everyone from birth. Human rights and freedoms are the highest value. They act directly, determine the meaning and content of the activities of the legislative, executive authorities and local governments. \u201d<\/span><span style=\"font-weight: 400;\">17<\/span><span style=\"font-weight: 400;\">. \u201cIn the Kyrgyz Republic, <\/span><b>no laws that repeal or diminish the rights and freedoms of a person and citizen should be enacted.\u201d<\/b><b> 18<\/b><b>. \u201cThe law cannot establish restrictions on rights and freedoms for other purposes and to a greater extent than is provided by the Constitution.\u201d <\/b><b>19<\/b><span style=\"font-weight: 400;\">. \u201cEveryone has the right to privacy &#8230;\u201d <\/span><span style=\"font-weight: 400;\">20.<\/span><span style=\"font-weight: 400;\"> \u201c<\/span><b>It is not allowed to collect, store, use and disseminate confidential information, information about the private life of a person without his consent,<\/b><span style=\"font-weight: 400;\"> except as required by law. Everyone is guaranteed protection, including judicial protection, from unlawful collection, storage, dissemination of confidential information and information about a person\u2019s private life, and also guarantees the right to compensation for material and moral damage caused by unlawful actions. \u201d<\/span><span style=\"font-weight: 400;\">21<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">According to the Personal Data Protection Act, \u201c<\/span><b>The personal data subject shall independently decide whether to provide anyone with any of his personal data<\/b><span style=\"font-weight: 400;\">, with the exception of cases provided for in Article 15 of this Law.\u201d <\/span><span style=\"font-weight: 400;\">22<\/span><span style=\"font-weight: 400;\">. \u201c<\/span><b>The subject of personal data in case of refusal to provide its data has the right not to indicate the reasons for its refusal<\/b><span style=\"font-weight: 400;\">.<\/span><span style=\"font-weight: 400;\">23<\/span><span style=\"font-weight: 400;\">\u201d.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Moreover, according to the Personal Data Protection Act, \u201cIn the event that the subject of personal data reveals their inaccuracy or disputes the lawfulness of actions in relation to his personal data, he <\/span><b>is entitled to require the holder (owner) to block this data<\/b><span style=\"font-weight: 400;\">.\u201d <\/span><span style=\"font-weight: 400;\">24<\/span><span style=\"font-weight: 400;\">. \u201cIf it is established that the collection of personal data is unlawful, <\/span><b>the holder (owner) is obliged to destroy the relevant data immediately<\/b><span style=\"font-weight: 400;\"> after such establishment and notify the subject of the personal data in writing.\u201d <\/span><span style=\"font-weight: 400;\">25<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Thus, international standards in the field of personal data protection and the legislation of the Kyrgyz Republic unequivocally establish that only a personal data subject has the right to independently decide whether or not to provide his personal data to someone, he has the right to refuse to provide it without giving a reason, and has the right to demand blocking and destruction of his personal data. Thus, it is an inalienable, guaranteed by the Constitution and is \u00a0not subject to any restrictions, the right of the subject of personal data.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Taking into account the above provisions of the legislation of the Kyrgyz Republic, no legislative act may impose a duty on citizens to provide their personal data on a mandatory basis, no state body has the right to require mandatory submission of its personal data. Therefore, the provisions established by Articles 4, 5 of the draft law (in terms of the mandatory biometric registration, mandatory delivery of personal data) are subject to exclusion from the draft law.<\/span><\/p>\n<p>3)The provisions of the draft law on the authorized body in the field of biometric registration are also inconsistent with the legislation of the Kyrgyz Republic in the field of personal data protection.<\/p>\n<p><span style=\"font-weight: 400;\">Thus, according to the draft law under consideration, \u201cThe authorized state body in the field of biometric registration is a state body authorized by the Government of the Kyrgyz Republic to perform<\/span><b> the functions of collecting, storing, using, processing, updating and protecting the base of biometric, personal and other data of citizens of the Kyrgyz Republic<\/b><span style=\"font-weight: 400;\">. \u201d<\/span><span style=\"font-weight: 400;\">26<\/span><span style=\"font-weight: 400;\">. And further: \u201cBiometric registration of citizens of the Kyrgyz Republic residing in the territory of the Kyrgyz Republic <\/span><b>is carried out by the authorized state body<\/b><span style=\"font-weight: 400;\"> in the manner determined by the Government of the Kyrgyz Republic\u201d <\/span><span style=\"font-weight: 400;\">27<\/span><span style=\"font-weight: 400;\">; <\/span><b>\u201cThe biometric data of citizens of the Kyrgyz Republic is transmitted in the established manner to data processing centers of the authorized state body\u201d <\/b><b>28<\/b><b>; \u201cThe holder of a biometric database of citizens of the Kyrgyz Republic is determined by the Government\u201d <\/b><b>29<\/b><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">These provisions of the draft law directly contradict the provisions of the Law on Protective Personal Data.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Thus, \u201c<\/span><b>Holder of the personal data array &#8211; state authorities, local governments and legal entities<\/b><span style=\"font-weight: 400;\"> entrusted with the authority to define goals, categories of personal data and control the collection, storage, processing and use of personal data in accordance with this Law.\u201d<\/span><span style=\"font-weight: 400;\"> 30<\/span><span style=\"font-weight: 400;\">. \u201cState authorities, local governments that work with personal data arrays in accordance with this Law and other regulatory legal acts of the Kyrgyz Republic have the right to act as holders (owners) of personal data\u201d <\/span><span style=\"font-weight: 400;\">31<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">That is, the holders of personal data arrays can be the relevant <\/span><b>state authorities, local self-government bodies and even legal entities<\/b><span style=\"font-weight: 400;\"> at whose disposal may be personal data of citizens and who <\/span><b>process personal data<\/b><span style=\"font-weight: 400;\"> &#8211; \u201cany operation or set of operations performed regardless of the ways the holder (owner) personal data or on his instructions, with or without automatic means, for the purpose of collecting, recording, storing, updating, grouping, blocking, erasing and destroying personal data. \u201d<\/span><span style=\"font-weight: 400;\">32<\/span><span style=\"font-weight: 400;\">.\u201c State authorities and local governments in their activities can use personal data held by other holders (holders) of personal data \u201d<\/span><span style=\"font-weight: 400;\">33<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">At the same time, it is <\/span><b>the responsibility of the Government<\/b><span style=\"font-weight: 400;\"> of the Kyrgyz Republic <\/span><span style=\"font-weight: 400;\">34<\/span><span style=\"font-weight: 400;\"> to determine <\/span><b>the authorized state body<\/b><span style=\"font-weight: 400;\"> \u2014 the state body entrusted with <\/span><b>the functions of registering holders of an array of personal data, maintaining the Register of holders<\/b><span style=\"font-weight: 400;\"> of an array of personal data and other tasks stipulated by this Law, <\/span><span style=\"font-weight: 400;\">35<\/span><span style=\"font-weight: 400;\">, as well as maintaining and the registration of arrays of personal data and their holders (owners) &#8220;<\/span><span style=\"font-weight: 400;\">36<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Thus, the authorized body must perform the functions of registering holders (holders) of an array of personal data, maintaining the register of holders, and the definition of an \u201cauthorized body\u201d contained in the draft law contradicts the specified requirements.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Moreover, according to the Law on the protection of personal data and international standards in this area, one body cannot perform the functions of \u201ccollecting, storing, using, processing, updating and protecting the base of biometric, personal and other citizens&#8217; data\u201d (all these actions in the Law on the protection of personal data combined into one definition &#8211; \u201cpersonal data processing\u201d), biometric data cannot be transferred to one body, as the \u201ccitizen&#8217;s biometric data base\u201d itself cannot be created in principle because:<\/span><\/p>\n<p><b>&#8211; The formation of consolidated personal data files received by state authorities or local authorities from various state holders (owners) of personal data is not allowed <\/b><b>37<\/b><b>.<\/b><\/p>\n<p><b>&#8211; It is not allowed to combine arrays of personal data collected by holders (owners) for different purposes, for automated processing of information <\/b><b>38<\/b><b>.<\/b><\/p>\n<p>4)Contrary to the Constitution, legislation in the field of personal data protection is the provision of the draft law, established in paragraph 1 of Art. 6: &#8220;The database of biometric data of citizens of the Kyrgyz Republic belongs to the Government of the Kyrgyz Republic.&#8221;.<\/p>\n<p><span style=\"font-weight: 400;\">According to the Constitution of the Kyrgyz Republic, \u201cThe state, its bodies, local self-government bodies and their officials <\/span><b>cannot go beyond the scope of the powers defined by this Constitution and the laws<\/b><span style=\"font-weight: 400;\">.\u201d <\/span><span style=\"font-weight: 400;\">39<\/span><span style=\"font-weight: 400;\">. That is, the principle \u201ceverything is forbidden that is not directly allowed by the laws of the Kyrgyz Republic\u201d applies to state authorities. The powers of the Government are established by Art. 88 of the Constitution and the Constitutional Law \u201cOn the Government of the Kyrgyz Republic\u201d. In these regulatory legal acts, the Government does not have the authority to be the owner of a \u201cbiometric database of citizens of the Kyrgyz Republic\u201d (<\/span><b>as well as it is illegal to create the biometric database itself<\/b><span style=\"font-weight: 400;\">)<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Based on the above, <\/span><b>the provisions of art. 3 (definition of the authorized body), p.2 Art. 5, paragraph 4 of Art. 5, paragraph 1 of Art. 6, paragraph 2 of Art. 6 must be excluded.<\/b><\/p>\n<p>5)In our opinion, the collection and use of biometric data of citizens of the Kyrgyz Republic cannot be carried out on the principles of \u201c<b>openness<\/b> (ensuring citizens&#8217; confidence in the use of state of biometric data); &#8220;, as established by Article 4 of the draft law.<\/p>\n<p><span style=\"font-weight: 400;\">Since \u201c<\/span><b>Personal data<\/b><span style=\"font-weight: 400;\"> held by the holder (owner) is classified as <\/span><b>confidential information<\/b><span style=\"font-weight: 400;\">, except as specified by this Law.\u201d 40; \u201cEveryone is guaranteed protection, including judicial protection, from unlawful collection, storage, and <\/span><b>distribution of confidential information and information about the private life of a person\u201d<\/b><b> 41<\/b><b>.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Thus, instead of the principle of &#8220;openness&#8221;, the law should be based on the principles of legality, confidentiality and security of personal data of citizens, including biometric.<\/span><\/p>\n<p>6)Contradicts the Law on the protection of personal data and international standards in the field of privacy of the provisions of paragraph 5 of Art. 6 of the draft law: \u201cThe provision of information, information from the biometric database of citizens of the Kyrgyz Republic is carried out in cases stipulated by laws and other regulatory legal acts of the Kyrgyz Republic, international treaties and agreements to which the Kyrgyz Republic is a party, in the interests of the national security of the Kyrgyz Republic, protection of rights human or by consent of the subject of biometric data. &#8220;.<\/p>\n<p><span style=\"font-weight: 400;\">Thus, according to the Law on Personal Data Protection, <\/span><b>the Holder (owner) of an array of personal data is entitled to transfer this data to another holder (holder) without the consent of the subject of personal data in the following cases:<\/b><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; urgently necessary to protect the interests of the subject of personal data;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; at the request of state authorities, local authorities, if the requested list of personal data corresponds to the powers of the requesting authority;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; based on legislation of the Kyrgyz Republic.<\/span><span style=\"font-weight: 400;\">42<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In any case, the holder (owner) of the personal data array <\/span><b>is obliged to inform the subject of personal data about the transfer of his personal data to a third party in any form in a week time.<\/b><b>43<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Under the \u201ctransfer of personal data\u201d, in accordance with the Law on the Protection of Personal Data, is meant \u201cthe provision by the holder (owner) of personal data to third parties in accordance with this Law and international agreements.\u201d <\/span><span style=\"font-weight: 400;\">44<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Issues of cross-border transfer of personal data (holders under the jurisdiction of other states) are regulated by Art. 25 of the Law on Personal Data Protection. According to the Law, \u201cThe transfer of personal data to countries that do not provide an adequate level of protection of the rights and freedoms of the subjects of personal data may take place under the condition:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; <\/span><b>the consent of the subject of personal data on this transfer;<\/b><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; if the transfer is necessary to protect the vital interests of the subject of personal data;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8211; if personal data are contained in a publicly accessible array of personal data. &#8220;<\/span><span style=\"font-weight: 400;\">45<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Under <\/span><b>the consent of the subject of personal data<\/b><span style=\"font-weight: 400;\">, the Law means \u201cexpressed in any form <\/span><b>free, specific, unconditional and conscious will of the person<\/b><span style=\"font-weight: 400;\">, in accordance with which the subject announces his consent to the implementation of procedures related to the processing of his personal data\u201d <\/span><span style=\"font-weight: 400;\">46<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p>7)For the above reasons, it contradicts the requirements of the Law on Personal Data Protection of the provisions of art. 8 of the draft law: <b>The use of biometric data of citizens of the Kyrgyz Republic can be carried out without the consent of the subject<\/b> of biometric data only<b> in the case of the administration of justice and the execution of a judicial act, as well as in cases stipulated by the legislation of the Kyrgyz Republic on national security, countering terrorism and corruption, operational search activities other cases determined by the legislation of the Kyrgyz Republic.<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Such unjustifiably broad language that does not comply with the legislation in the field of personal data protection makes it possible to fully exempt from the guarantees provided for by the Constitution of the Kyrgyz Republic and the Personal Data Protection Law and cannot be considered acceptable.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">According to the Personal Data Protection Act, \u201c<\/span><b>Before providing personal data, an entity must be familiar <\/b><span style=\"font-weight: 400;\">with the holder (owner) of the personal data set with the list of collected data, the grounds and purpose of their collection and use, <\/span><b>with the possible transfer of personal data to a third party, and informed otherwise possible use of personal data<\/b><span style=\"font-weight: 400;\">. \u201d<\/span><span style=\"font-weight: 400;\">47<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Article 15 of the Law on the Protection of Personal Data establishes <\/span><b>only <\/b><span style=\"font-weight: 400;\">restrictions on the subject\u2019s<\/span><b> rights to provide and receive personal data<\/b><span style=\"font-weight: 400;\">, which include:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">1. the right to provide personal data to the holders (owners) of personal data arrays by the subject &#8211; for subjects of personal data that are authorized for state secrets, in accordance with the Law of the Kyrgyz Republic \u201cOn Protection of State Secrets of the Kyrgyz Republic\u201d;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">2. the rights of the subject to access his personal data, make changes to his personal data, block his personal data:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">a) for personal data obtained as a result operational search activities, except in cases where this activity is conducted in violation of the legislation of the Kyrgyz Republic;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">b) for the personal data of the subjects detained on suspicion of committing a crime or who are charged in a criminal case, or to whom a preventive measure is applied before being charged to the authorities conducting the specified actions.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">At the same time, \u201cRestriction of the subject\u2019s access rights to his personal data, not provided for in part 1 of this article, is not allowed.\u201d 48.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The above list (second paragraph of Article 8 of the draft law) <\/span><b>should be brought into line with the Law on the Protection of Personal Data<\/b><span style=\"font-weight: 400;\"> (Article 24, 25 of the Law), on the assumption that all state bodies, local authorities, legal entities that are holders of personal biometric data should consider the requirements of the Law on Personal Data from the point of view of ensuring the rights and freedoms of citizens, enshrined in the Constitution of the Kyrgyz Republic.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Otherwise, the authorities will create a comfortable mode in which they will not actually be repaired by any significant obstacles to the collection, processing and use of personal data of citizens<\/span><\/p>\n<p>8)Also, the provisions of paragraph 7 of Art. 6 of the draft law: \u201cControl and supervision over the fulfillment of the requirements established by the Government of the Kyrgyz Republic is carried out by the authorized state body in the field of national security, by the prosecution authorities within the limits of authority.\u201d<\/p>\n<p><span style=\"font-weight: 400;\">According to the Law on the Protection of Personal Data, \u201c<\/span><b>Control over the use of personal data <\/b><span style=\"font-weight: 400;\">obtained by state authorities, local state administrations and local authorities from other state holders (owners) of personal data is exercised by higher authorities, law enforcement agencies, and the Ombudsman (Akyikatchy) of the Kyrgyz Republic Republic in accordance with this Law. &#8220;<\/span><span style=\"font-weight: 400;\">49<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Thus, paragraph 7 of Art. 6 of the bill must be aligned with the provisions of Art. 22 of the Law on the protection of personal data.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Notes:<\/span><\/p>\n<ol>\n<li><span style=\"font-weight: 400;\"> Law of the Kyrgyz Republic \u201cOn Personal Information\u201d dated April 14, 2008 N 58<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Clause 3 Art. 20 of the Constitution of the Kyrgyz Republic: The law may not establish restrictions on rights and freedoms for other purposes and to a greater extent than is provided for by the Constitution.<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 2 of the Law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Subparagraph 2 paragraph 1 of the hundred. 52 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 4 of Art. 2 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> The Law of Ukraine \u201cOn the United Kingdom&#8217;s State Demographic Registry and Documentation, just to give Ukraine the hubris of the nation, to dedicate itself to the special status\u201d (with special laws, introduced by the Laws of Ukraine on the 5th uniformed 5610 -f un-56. VII, vid 17, heather 2013, rock N 568-VII, vid 13 grass 2014, rock n 1262-VII<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> FL from 21.12. 2009 No. 337-\u0424\u0417 \u201cOn Amendments to the Federal Law\u201c On the Procedure for Exiting the Russian Federation and Entering the Russian Federation \u201d<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> http:\/\/www.migration.gov.tm\/ru\/news\/76<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> http:\/\/www.allmoldova.com\/moldova-news\/1249054402.html<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1 of Art. 6 of the Law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 2 of Art. 22 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 6 of Art. 4 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Article 4 of the draft law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Article 5 of the draft law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Article 5 of the draft law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 6 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1 of Art. 16 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1st. 20 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 3 of Art. 20 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1 of Art. 29 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 3, 4 tbsp. 29 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1 of Art. 9 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 4 of Art. 9 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 12 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 3 of Art. 19 of the Personal Data Protection Act<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 3 of the Law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 2 of Art. 5 of the Law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 4 of Art. 5 of the Law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 2 of Art. of the Law<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 3 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1 of Art. 16 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 3 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1 of Art. 22 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 29 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 3 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 29 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 2 of Art. 22 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 6 of Art. 4 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 3 of Art. 5 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1 of Art. 6 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 4 of Art. 29 of the Constitution of the Kyrgyz Republic<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 1 of Art. 24 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 2 of Art. 24 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 3 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 3 of Art. 25 Law on the protection of personal data<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Art. 3 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> Clause 3 Art. 9 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 2 of Art. 15 of the Law on Personal Data Protection<\/span><\/li>\n<li><span style=\"font-weight: 400;\"> P. 2 of Art. 22 of the Law on Personal Data Protection Act<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CONCLUSION On the draft law of the Kyrgyz Republic On biometric registration of citizens of the Kyrgyz Republic Having reviewed the draft Law of the Kyrgyz Republic On Biometric Registration of Citizens of the Kyrgyz Republic (hereinafter the draft law \/ draft law), the Public Foundation Civic Initiative Internet Policies (hereinafter referred to as PF [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":4817,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[44],"tags":[],"class_list":["post-4820","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analytics-en"],"_links":{"self":[{"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/posts\/4820"}],"collection":[{"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/comments?post=4820"}],"version-history":[{"count":5,"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/posts\/4820\/revisions"}],"predecessor-version":[{"id":5642,"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/posts\/4820\/revisions\/5642"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/media\/4817"}],"wp:attachment":[{"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/media?parent=4820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/categories?post=4820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/internetpolicy.kg\/en\/wp-json\/wp\/v2\/tags?post=4820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}