Astana, 10 November. The Ministry of Artificial Intelligence and Digital Development will inspect five Yandex companies registered in Kazakhstan by the end of November to check how they protect personal data and whether they store it in the country, Minister Zhaslan Madiyev said in his reply to a deputy's inquiry.
The inspections are unscheduled. They will cover Yandex Kazakhstan LLP, Yandex Bastau LLP, Yandex. Taxi Corp LLP, Yandex. Food Kazakhstan LLP and Yandex LLP. Madiyev, who is Deputy Prime Minister and Minister of Artificial Intelligence and Digital Development, writes that the ministry will examine compliance with personal data protection law thoroughly and comprehensively, including the localisation of data storage and organisational and technical protection measures. The inspections will assess whether the requirements are met. If violations are found, the companies will be given recommendations on remedying them and the question of administrative liability for those responsible will be considered. The minister promises to present the results to the media. The reply was published on 10 November.
The inquiry followed a mass outage of Yandex services that also affected Kazakhstan in October. Kurultai deputy Lyazzat Zhylkybayeva wrote on 14 October to Prosecutor General Berik Asylov and to Madiyev. According to her, the service processes phone numbers, addresses, travel routes and payment data of citizens every day, so a stoppage caused by a fault abroad requires a transparent answer on which country, and under what legal regime, processes this data. Deputies of the Adilet faction asked for a check on whether Kazakhstanis' data was transferred abroad and whether that was lawful, Informburo reported. The same inquiry concerned cases in which organisations themselves put personal data into open access. According to the deputies, seven educational organisations in the Shieli district of the Kyzylorda region posted details of 529 employees on the public procurement portal, and in Semey the data of employees and 344 minors turned out to be open.
The outage began on 11 October: the Yandex Go press service said that services were working with interruptions, and the company explained this by damage to data centres. According to the deputies' account, the ministry then replied that the servers with Kazakhstani users' data are in the country, but some components work outside it. The outage also affected the market: on 13 October the Agency for Protection and Development of Competition (AZRK) sent a warning to the inDrive service, where taxi prices had risen almost threefold.
Apart from the deadline "by the end of November", the reply does not give the start dates of the inspections, the list of documents requested or the format for publishing the results.
What it means: The deputy's question of which country processes the data, and under what law, has turned into concrete inspections of five legal entities, with a separate check of where the data is stored. The outcome depends on the answer to that question: if the components through which Kazakhstanis' data passes work abroad, the inspectors will have to assess whether that complies with the law.
Who benefits: By the logic of the reply, users whose data will be checked stand to gain. The five companies are at risk: if violations are found, they will receive recommendations on remedying them, and those responsible may be held administratively liable. The ministry promises a public report, which means it has committed itself to showing a result.
Background: Data storage localisation means keeping databases with citizens' personal data on servers inside the country. Yandex is a Russian technology group; in Kazakhstan it runs taxi, food delivery and other services.
We have also reported on how Yandex denied reports about insuring its data centres.
