A large-scale disruption in the operation of Yandex services and instances of personal data leaks involving Kazakh citizens have prompted a parliamentary inquiry to the Prosecutor General's Office and the Ministry of Artificial Intelligence and Digital Development. Members of the "Adilet" faction have questioned the legality of cross-border transfers of citizens' personal information and demanded strict control over its processing.

The corresponding inquiry was announced at a Kurultai session by MP Lyazzat Zhylkybayeva, addressing Prosecutor General Berik Asylov and Deputy Prime Minister – Minister of Artificial Intelligence and Digital Development Zhaslan Madiyev.

The trigger for the appeal was a technical malfunction in Yandex Go that affected taxi services, delivery, scooter rental, and other app functions.

According to the MP, the new Constitution for the first time enshrined at the legislative level the right of every person to the protection of personal and family privacy, as well as protection from unlawful collection and use of personal data. This guarantee, she emphasized, must be upheld in the daily work of all organizations that receive and process information about citizens.

– The ultimate goal of the changes initiated by the Head of State is the real protection of citizens' rights in everyday life. Therefore, constitutional guarantees must be fulfilled in the work of every organization, – Lyazzat Zhylkybayeva emphasized.

As the MP noted, the company explained the disruptions as a defect in foreign infrastructure. At the same time, she recalled, the Ministry of Artificial Intelligence and Digital Development reported that the servers storing personal data of Kazakh users are located in the country and are operating normally, although some components of the platform are located outside Kazakhstan.

– Every day, when a service that processes a citizen's phone number, address, travel route, and payment data stops due to a defect abroad, there must be a transparent determination of exactly which country and under what legal regime this data is being processed, – Lyazzat Zhylkybayeva posed the question.

However, the issue of protecting personal information, according to the MP, is not limited to the activities of international digital companies.

– Recently, in the Shieli district of the Kyzylorda region, seven educational organizations openly published the personal data of 529 employees on the public procurement portal. In Semey, along with employee data, the data of 344 minors was openly accessible. No hacking of the information system was even needed to obtain this data. It was openly published by the very organizations that were supposed to protect it, – Lyazzat Zhylkybayeva noted.

The authors of the parliamentary inquiry proposed a number of measures to strengthen personal data protection.

First and foremost, the MP considers it necessary to verify the legality of cross-border transfers of personal data.

Along with this, she proposes verifying the legality of personal data collection by social facilities and the companies servicing them.

Another measure concerns the enforcement of legislation requiring the use of masking methods for personal data that must not be published in publicly accessible sources. The corresponding requirements were introduced into legislation in June of this year.

In addition, Lyazzat Zhylkybayeva considers it necessary to improve the qualifications of specialists working with personal data and to develop a unified methodology for conducting inspections by local executive bodies.

The MP also proposes ensuring the effective operation of mechanisms for restoring the violated rights of citizens whose personal data was published unlawfully.

Meanwhile, in connection with the disruptions in Yandex Go, the Ministry of Artificial Intelligence and Digital Development previously explained why hosting personal data on Kazakh servers does not mean that the entire digital platform operates exclusively within the country.

The agency clarified that the servers storing personal data of Kazakh users are located in Kazakhstan and operate normally. However, not all of Yandex's service infrastructure is located within the country. Some of the technical systems necessary for the operation of taxi and delivery applications are located abroad. Therefore, problems with foreign servers can cause disruptions in app operations even if the servers with personal data in Kazakhstan are running without interruption.

The ministry explained that storing personal data in Kazakhstan and ensuring uninterrupted operation of applications are different tasks. Data may be stored on Kazakh servers, while the operation of certain service functions depends on technical infrastructure abroad.

Earlier, the head of Yandex Taxi in Kazakhstan, Ruslan Saitov, stated that the company uses local data centers and encryption to protect drivers' data. According to him, the company has not recorded any cases of information leaks.

Linara SAKTAGANOVA
Astana