GOVERNMENT OF THE KYRGYZ REPUBLIC
RESOLUTION
Dated November 21, 2017 No. 759
On approval of the Procedure for obtaining the consent of the subject of personal data to the collection and processing of his personal data, the procedure and form for notifying subjects of personal data about the transfer of their personal data to a third party
In accordance with Articles 9 and 24 of the Law of the Kyrgyz Republic "On Personal Information", Articles 10 and 17 of the constitutional Law of the Kyrgyz Republic "On the Government of the Kyrgyz Republic", the Government of the Kyrgyz Republic
DECIDES:
1. Approve the Procedure for obtaining the consent of the subject of personal data to the collection and processing of his personal data, the procedure and form for notifying subjects of personal data about the transfer of their personal data to a third party in accordance with the application.
2. State executive bodies, state bodies that are not part of the executive power system (by agreement), legal entities (by agreement) that are holders (owners) of personal data arrays, take the necessary measures to ensure the implementation of this resolution.
3. This resolution comes into force from the date of its official publication.
The Prime Minister S. Isakov
Annex
ORDER
obtaining the consent of the subject of personal data to the collection and processing of his personal data, the procedure and form for notifying the subjects of personal data about the transfer of their personal data to a third party
1. General Provisions
1. This Procedure establishes the form and procedure for obtaining the consent of the subject of personal data, including in the form of an electronic document, for the collection and processing of his personal data in accordance with the Law of the Kyrgyz Republic "On Personal Data", as well as the mandatory procedures for notifying the subject of personal data about the fact transfer of his personal data to a third party.
2. This Procedure is subject to application by holders (owners) of personal data arrays that collect, store, process, use, transfer personal data, including cross-border transfer of personal data.
3. The concepts used in this Procedure are applied in the meanings defined in the laws of the Kyrgyz Republic "On Personal Data", "On Electronic Signature", "On Electronic Management".
2. The procedure for obtaining the consent of the subject of personal data, including in the form of an electronic document, for the collection and processing of his/her personal data, including the purposes of providing state and (or) municipal services.
4. In order to obtain the consent of the subject, on the official websites of the performers of state or municipal services and (or) holders (owners) of personal data, forms (forms on paper or in the form of an electronic document) of the consent of the subject to the processing of his personal data, including the necessary to receive services provided by this body/holder of the array of personal data.
5. The holder (owner) of the array of personal data must familiarize the subject of personal data before providing them with their personal data, with the list of data collected, the basis and purposes for their collection and use, with the possible transfer of personal data to a third party, and also inform about other possible use of personal data.
6. The subject of personal data independently decides on providing of his/her personal data to anyone and consents to their collection and processing freely, consciously and in a form that allows confirming the fact of his receipt, except as provided for in Article 15 of the Law of the Kyrgyz Republic "On Personal Data ".
The subject of personal data provides personal data personally or through an authorized representative.
7. The consent of the subject of personal data must be expressed in writing on paper or in the form of an electronic document signed in accordance with the legislation of the Kyrgyz Republic on electronic signature.
8. The consent of the subject of personal data, including in the form of an electronic document, to the collection and processing of his personal data, including the purposes of providing state and municipal services (hereinafter - the consent of the subject), must contain:
- last name, first name, middle name, address of the place of the subject of personal data, data of the document proving his identity;
- last name, first name, middle name, address of the place of residence of the authorized person (representative) of the subject of personal data, details of the document proving his identity, details of a notarized power of attorney or other document confirming the authority of this authorized person (representative) (upon obtaining consent from trustee (representative) of the subject of personal data);
- the name or last name, first name, middle name and address of the holder (owner) of the personal data array or the processor receiving the consent of the personal data subject;
- an indication of the basis and purpose of the collection, use, processing of personal data;
- a list of personal data for the processing of which the consent of the subject of personal data is given;
- name or last name, first name, middle name and address of the processor (if any);
- a list of actions with personal data, for which consent is given, including the possibility of transferring personal data to a third party, other possible use of personal data, a general description of the personal data processing methods used by the holder (owner) of the personal data array;
- the period during which the consent of the subject of personal data is valid, unless otherwise established by the Law of the Kyrgyz Republic "On Personal Data".
9. The consent of the subject of personal data in order to receive state and municipal services is provided in a standard form in accordance with the appendix to this Procedure.
10. The holder (owner) of the array of personal data is obliged, during the entire period of processing (and storage) of personal data, to store information that allows providing evidence of the consent of the subject of personal data to provide his personal data and to carry out procedures related to the processing of his personal data, in particular:
- in case of information interaction through the exchange of electronic documents signed with an electronic signature in accordance with the legislation of the Kyrgyz Republic - an electronic document signed with an electronic signature of the subject of personal data or his/her authorized representative and containing the consent of the subject of personal data provided for by this Procedure in the form of an electronic document for processing his/her personal data;
- in case of information interaction in electronic format by gaining access to the information system of the holder (owner) of the array of personal data using the login and password of the subject of personal data or his/her authorized representative - information about the fact of access to the information system using this login and password, protocol of actions of the subject of personal data or his/her authorized representative in the information system using this login and password;
- when carrying out procedures related to the processing of personal data of the subject without the use of electronic documents or information systems - a paper document certified by the handwritten signature of the person providing personal data (the subject of personal data or his authorized representative), unambiguously confirming the fact that the subject gave personal given consent to the processing of his personal data.
3. The procedure and form of notification of personal data subjects about the fact of transfer of their personal data to a third party
11. The transfer of personal data from one holder (owner) to another is allowed if the holder (owner) to whom these personal data are transferred has legal basis for working with personal data provided for in Article 5 of the Law of the Kyrgyz Republic "On Personal Information", at the time of such transfer.
12. The holder (owner) of the array of personal data is obliged, within a week from the date of transfer of personal data, to inform the subject of personal data about the transfer of his personal data to a third party, with the exception of cases provided for in subparagraphs a) and b) of paragraph 2 of part 1 of Article 15 of the Law of the Kyrgyz Republic "On information of a personal nature". In this case, the form of notification can be a message by phone, SMS, letter, e-mail message in agreement with the subject of personal data and at the discretion of the holder (owner) of the array of personal data.
13. The holder (owner) of the array of personal data upon receipt of personal data must request from the subject of personal data his contact information (address of the place of residence (place of stay), telephone number, e-mail address), using which the subject in a form convenient for him can be notified of the transfer of his/her personal data to a third party.
In the absence of contact information of the subject of personal data, the holder (owner) of the personal data array must take actions to inform the subject of personal data about the transfer of his/her personal data to a third party by requesting the missing contact information from public authorities or local governments, or by obtaining it from publicly available sources of personal data.
In all cases of obtaining contact information about the subject of personal data not from the personal data subject himself, the holder (owner) of the personal data array must make sure that:
- the received contact information unequivocally refers to this personal data subject (for example, the subject was identified using the state information systems of the Kyrgyz Republic or the holder (possessor) of the personal data array previously contacted the subject of personal data in order to verify his identity);
- the collection of additional contact information about the subject of personal data in order to inform him/her does not conflict with the purposes of processing personal data for which the formation of an array of personal data took place;
- the holder (owner) of the array of personal data, from whom the contact details of the subject of personal data are requested for the purpose of sending a notification, the consent of the subject of personal data (in cases established by the Law of the Kyrgyz Republic "On Personal Data") has been obtained to transfer his personal data to a third party.
14. The holder (owner) of the array of personal data chooses the form of notification in agreement with the subject of personal data, based on the method of communication with the subject (by phone, SMS, letter, e-mail message). At the same time, the holder (owner) of the array of personal data must store evidence of informing the subject of personal data about the transfer of his/her personal data to a third party (copies of letters, telephone messages, messages) and provide them to the subject of personal data or an authorized state body at their request in accordance with the Law of the Kyrgyz Republic "On Personal Data".
15. In order to inform the subject of personal data about the circumstances of the transfer of his/her personal data to a third party, the content of the notification includes the following information:
- name or last name, first name, middle name and address of the holder (owner) of the personal data array or his/her representative;
- the basis for the transfer of personal data;
- the composition of the transferred personal data;
- the purpose of processing personal data and a general description of the methods of processing;
- source of obtaining personal data.
16. If the holder (owner) of the array of personal data, on the basis of the data he/she has, cannot notify the subject of personal data about the transfer of his/her personal data, he/she is obliged to inform the authorized state body for personal data about this, providing data that allows identifying the subject of personal data in if he/she applies to the authorized state body for personal data, as well as information about the attempts made by the holder (owner) of the array of personal data to inform such a subject of personal data about the transfer of his/her personal data.
17. The authorized state body for personal data, having received, in accordance with Article 19 of the Law of the Kyrgyz Republic "On Personal Data", the statement of the subject of personal data about the unlawful transfer of personal data, immediately checks the availability in its information systems of information about the attempts made by the holder (owner) of the array personal data inform this subject of personal data and in case of detection of the specified information informs the subject of personal data (with the contact information of the holder of the array of personal data) and the holder of the array of personal data (with contact information about the subject of personal data).
18. In order to inform the subject of personal data about the transfer of his/her personal data to a third party, the authorized state body for personal data organizes voluntary registration of the subject of personal data and stores contact information provided by the subject of personal data. In case of receipt from the holder (owner) of the array of personal data notification of the impossibility to inform the subject of personal data about the transfer of his/her personal data and identification of the subject of personal data among those registered by the authorized state body for personal data, the authorized state body for personal data informs the subject of personal data about the transfer his/her personal data using the contact information provided by the subject of personal data during registration.
Annex
STANDARD FORM
Consent of the subject of personal data to the collection and processing of his/her personal data
Locality, Data
I am
_________________________________________________________________________________________
(last, first, middle names)
residing at: _____________________________________________________________________
_________________________________________________________________________________________
Identity document: ___________________________ series ___________ № ___________
(type of document)
issued _____________________________________________________________________________________
(date of issue) (issued by)
(for authorized persons)
acting on behalf ______________________________________________________________________
(last, first, middle names)
residing at:____________________________________________________________________
Identity document: ___________________________ series ___________ № ___________
(type of document)
issued____________________________________________________________________________________
(date of issue) (issued by)
based on_______________________________________________________________________________
(power of attorney, law, other legal act)
freely, consciously, voluntarily giving consent ________________________________________________ .
(name, address of the owner or holder of the information system, full name of the processor of personal data)
for processing (any operation or set of operations performed, regardless of the methods, by the holder (owner) of personal data or on his/her behalf, by automatic means or without them, for the purpose of collecting, recording, storing, updating, grouping, blocking, erasing and destroying personal data) and also to:
for the transfer of personal data (provision by the holder (owner) of personal data to third parties in accordance with the Law of the Kyrgyz Republic "On Personal Information" and international treaties
cross-border transfer of personal data (transfer by the holder (owner) of personal data to holders under the jurisdiction of other states)
the following personal data:
1. _____________________________________________________________________________________
2. _____________________________________________________________________________________
3. _____________________________________________________________________________________
4. _____________________________________________________________________________________
5. _____________________________________________________________________________________
6. _____________________________________________________________________________________
7. _____________________________________________________________________________________
8. _____________________________________________________________________________________
(indicate the required list of data, for example: last name, first name and middle name (former last, first, middle names, date, place and reason for the change (in case of change); date and place of birth; information about citizenship (including previous citizenship, other citizenships); information about education (name and year of graduation from the educational organization, name and details of the document on education, qualification, field of study or specialty according to the document on education);
information about the presence of a scientific degree; ownership informationforeign languages, level of proficiency; sports title, sports category; address of the place of residence (place of stay); contact phone number or information about other methods of communication; type, series, number of the identity document, name of the authority that issued it, date of issue; taxpayer identification number; number of insurance certificate of compulsory pension insurance; details of the compulsory medical insurance policy; attitude to military duty, information on military registration (for citizens in the reserve and persons subject to conscription for military service); marital status, family composition; information about labor activity (including military service, part-time work, entrepreneurial activity, etc.); state awards, other awards and distinctions (who was awarded and when); information about the presence or absence of a criminal record; information on income, expenses, property and liabilities of a property nature; personal photo)
I provide the above personal data for processing in order to provide me with a state (municipal) service
__________________________________________________________ (indicate the name of the service)
I am aware that:
1) consent to the processing of personal data is valid from the date of signing this consent for the entire period of providing me with a state (municipal) service and storing data about the service provided in accordance with the legislation of the Kyrgyz Republic;
2) consent to the processing of personal data may be withdrawn on the basis of a written application in any form;
3) in case of withdrawal of consent to the processing of personal data, the processing of my personal data in whole or in part may be continued in accordance with Articles 5 and 15 of the Law of the Kyrgyz Republic "On Personal Information".
Start date of personal data processing: _____________________________________________
(day month Year)
"___" __________________ 20__.
______________________________________________ ________________________________________
Signature Full name