Applicability of Data Protection Law in Belarus: Filing System Criterion

The Filing System Criterion is utilized in Belarus to determine the applicability of its data protection law to the processing of personal data, whether by automated means or manually, if the manual processing allows for the search and access of data according to specific criteria.

Text of Relevant Provisions

PDP Law Art.2(1):

"This Law regulates relations related to the protection of personal data during processing carried out by: using automation tools; without the use of automation tools, if this provides search for personal data and (or) access to it according to certain criteria (file cabinets, lists, databases, journals, etc.)."

Original (Russian):

"Настоящий Закон регулирует отношения, связанные с защитой персональных данных при их обработке, осуществляемой: с использованием средств автоматизации; без использования средств автоматизации, если при этом обеспечиваются поиск персональных данных и (или) доступ к ним по определенным критериям (картотеки, списки, базы данных, журналы и другое)."

Analysis of Provisions

The Filing System Criterion is clearly articulated in Article 2(1) of the Belarusian Law on Personal Data Protection, which specifies the conditions under which the law applies to personal data processing.

1. Automated and Non-Automated Processing:
   • The provision states that the law applies to personal data processing "using automation tools" and extends to processing "without the use of automation tools, if this provides search for personal data and (or) access to it according to certain criteria."
2. Criteria for Manual Processing:
   • Manual processing is included if it allows for the search and access of personal data based on specific criteria, such as "file cabinets, lists, databases, journals, etc." This ensures that structured manual records, which can be systematically accessed, are subject to the same regulatory scrutiny as automated data.
3. Scope Extension:
   • The inclusion of manual processing under this criterion ensures comprehensive data protection coverage. This is critical for scenarios where personal data is maintained in organized non-digital formats, making it accessible and retrievable through structured methods.

Implications

For Business

• Manual Data Processing: Businesses must understand that their obligations under the Belarusian data protection law extend to manual records. If personal data is organized systematically in physical formats like file cabinets or lists, these fall under the regulatory framework.
• Compliance Measures: Organizations should implement appropriate data protection measures for both digital and manual records. This includes ensuring secure storage, access controls, and protocols for the rectification or deletion of personal data in physical formats.
• Records Management: Companies should establish clear policies for the management of all personal data, whether digital or manual. Proper handling and organization of personal data in any format are essential for compliance with the law.

The Filing System Criterion in Belarusian law mandates that personal data, regardless of being processed manually or automatically, must be adequately protected, ensuring comprehensive data protection across different processing methods.