The Law on Personal Data Protection in Belarus uses the factor of "Automated Means of Processing" to determine its scope of applicability. This factor extends the law's coverage to both automated and certain non-automated forms of data processing.

Text of Relevant Provision

Article 2(1) of the Law on Personal Data Protection states:

"1. This Law regulates relations related to the protection of personal data during processing carried out by:using automation tools;without the use of automation tools, if this provides search for personal data and (or) access to it according to certain criteria (file cabinets, lists, databases, journals, etc.)."

In the original language:

"1. Настоящий Закон регулирует отношения, связанные с защитой персональных данных при их обработке, осуществляемой:с использованием средств автоматизации;без использования средств автоматизации, если при этом обеспечиваются поиск персональных данных и (или) доступ к ним по определенным критериям (картотеки, списки, базы данных, журналы и другое)."

Analysis of Provisions

The law applies to two categories of personal data processing:

1. Processing "using automation tools" (с использованием средств автоматизации)
2. Processing "without the use of automation tools" (без использования средств автоматизации) under specific conditions

For non-automated processing, the law applies if it "provides search for personal data and (or) access to it according to certain criteria". This condition ensures that structured manual filing systems are also covered by the law.

The provision lists examples of such structured systems: "file cabinets, lists, databases, journals, etc." (картотеки, списки, базы данных, журналы и другое). This non-exhaustive list illustrates the types of non-automated processing that fall under the law's scope.

The inclusion of both automated and certain non-automated processing aligns with modern data protection principles, recognizing that personal data can be systematically processed and accessed in various forms, not just through digital means.

Implications

This broad scope of applicability has significant implications for businesses and organizations:

1. Digital systems: All computerized processing of personal data falls under the law's purview, regardless of the sophistication of the system.
2. Manual systems: Organizations must assess their non-digital data processing activities to determine if they constitute structured filing systems that allow for easy retrieval of personal data.
3. Mixed systems: Many organizations use both digital and paper-based systems, all of which may be covered by the law if they meet the criteria.
4. Small businesses: Even small businesses with basic digital tools or structured paper files for customer data are likely to fall under the law's scope.
5. Legacy systems: Older filing systems, if structured for easy data retrieval, are not exempt from the law's requirements.
6. Scope of compliance: Organizations need to ensure compliance across all forms of data processing, not just their digital operations.
7. Data mapping: Companies should conduct thorough data mapping exercises to identify all instances of personal data processing, including non-obvious cases like structured paper files.