Collection and processing in Belarus
The Data Protection Law contains a wide range of legal bases for processing personal data:
- data subject’s consent;
- if the processing is required for:
- administrative or criminal proceedings, operational-search activities;
- administration of justice and the enforcement of court orders and other enforcement documents;performing monitoring activities (supervision) in accordance with the legislation;
- implementation of legislation on national security, on combating corruption, on preventing money laundering, financing of terrorist activities and financing weapons of mass destruction proliferation;
- the implementation of legislation on elections and referendum;
- state social insurance purposes;
- formalising employment relationships, in the process of employment activities;
- notarial activities;
- Belarusian citizenship issues;
- assignment and payment of pensions, benefits;
- the organisation and carrying out of national statistical observations;
- scientific and other research purposes, on condition that the personal data are depersonalised;
- accounting, calculation, charging of fees for housing and utility services, other services, taxes;
- processing is based on a contract, that is concluded (being concluded) with the data subject, and for the purpose of performing actions stipulated by this contract;
- if personal data are specified in a document addressed to the operator and signed by the data subject;
- processing is essential for the performance of certain journalist’s activities;
- processing is required to protect the subject's life, health or other interests if obtaining of consent is not possible;
- if personal data were previously disseminated;
- in order to fulfil the duties / powers stipulated in legislation;
- in other cases expressly provided in legislation.
The Data Protection Law has different legal bases for processing of special personal data and for cross-border transfer of personal data to the territories of states that do not ensure proper protection of data subjects rights. For instance, the processing of special personal data based on a contractual basis is not permissible.
The consent of the data subject can be obtained in writing, in the form of an electronic document or in another electronic form (e.g. via tick-box at the website or SMS / email verification). The operator must provide proof, if it is requested, that it has collected proper consent for personal data processing.
Before obtaining consent, the operator must provide the data subject with the following information:
- name (full name) and location (address of residence) of the operator;
- purpose of personal data processing;
- list of personal data to be processed;
- consent validity term;
- information about the persons authorised by operator to process personal data (if those are engaged);
- what actions be done with personal data;
- a general description of the processing methods;
- other relevant information.
In addition, apart from other necessary information, the data subject must be informed of his/her rights, the mechanism for exercising them and the consequences of giving and withdrawing consent.
For the purposes of obtaining consent, where required for the purposes of processing , the operator may collect the surname, first name, middle name, date of birth, identification number (if not, the number of the ID document) of the data subject.
Collection and processing of personal data can only be performed after implementing certain legal, organisational and technical measures for personal data protection. The organisational measures may include establishing a special entrance regime to the premises used for collection and processing, designation of employees who can have an access to such premises and data, and differentiation of access levels to respective information. The technical measures may include using cryptography, technical means and other possible measures of control over information protection.
