Law on Personal Data Protection Enters into Force in Belarus

The Law on Personal Data Protection was adopted on May 7, 2021 in Belarus, becoming the country’s first comprehensive legal act in the sphere of personal data protection. The law entered into force on November 15, 2021, six months after its adoption, in order to allow preparation time for entities processing personal data in Belarus.

Definitions

The law defines personal data as any information relating to an identified or identifiable individual. Definitions for “biometric”, “genetic”, and “special” personal data are also provided in the legislative text. Activities covered by the term “data processing” include data collection, systematization, storage, modification, use, depersonalization, blocking, distribution, provision or removal.

The law defines three key parties in personal data processing:

• Data subject – an individual whose personal data is being processed;
• Operator – a legal entity, state body, an organization or an individual, including individual entrepreneurs, who organizes and/or carries out personal data processing independently or together with other persons;
• Authorized person – a legal entity, state body, an organization, or an individual, including individual entrepreneurs, who processes personal data on behalf of the operator or in their interests, based on a contract with the operator.

Personal Data Processing

Personal data should be processed on the basis of the data subject’s consent, unless the law expressly permits the processing of data without permission, such as in cases of the delivery of justice or execution of court orders.

The consent is a free, unambiguous and informed expression of the data subject’s will, by which they authorize the processing of their personal data. The consent can be obtained in written form, via SMS, email, by putting a mark on an Internet resource and by any other means establishing that the subject’s consent was obtained.

The law also establishes that the processing of personal data should:

• Be commensurate with the stated purposes and ensure a fair balance between interests of all persons concerned;
• Be limited to achieving the specified, legitimate purposes (if necessary to change the initial purposes, the operator should obtain the subject’s consent for further processing of their personal data);
• Not be excessive – the content and scope of processed personal data must be consistent with the stated purposes of its processing, and the data should not be stored for longer than needed for the stated purposes;
• Be transparent – the data subject must be provided with all relevant information concerning the processing of their personal data.

Liability

Local administrative and criminal laws were also amended – administrative liability was introduced on March 1, 2021 and criminal liability on June 9, 2021, for the breach of personal data protection legislation, namely for:

• Unauthorized collection, processing, storage or provision of personal data;
• Violating data subject’s rights;
• Dissemination of personal data; and
• Failure to comply with measures ensuring personal data protection.

Data Protection Authority

On October 28, 2021, Presidential Decree No. 422 “On measures to improve the protection of personal data” was adopted, designating the National Center for Personal Data Protection as the specialized, authorized data protection authority.

Among other duties, the Center oversees the processing of personal data by operators and authorized persons, considers data subjects’ complaints and obliges the operators and authorized persons to change, block or delete invalid or illegally obtained personal data and eliminate other violations of the law.

The new law has introduced important changes regarding the relations between the entities involved in data processing – the operators and authorized persons will also have to review the already stored personal data, gain consent from new data subjects, and ensure proper protection of personal data.

Prepared by: Anastasia Khioni

For more information, please contact belarus@petosevic.com.

Sources: National Legal Internet Portal of the Republic of Belarus, Belarusian Telegraph Agency (BelTA) website