The Constitutional Court of the Republic of Belarus comprising the Presiding Officer – Chairman P.P. Miklashevich, Deputy Chairperson N.A. Karpovich, judges T.S. Boiko, T.V. Voronovich, S.Y. Danilyuk, L.G. Kozyreva, V.N. Ryabtsev, O.G. Sergeeva, A.G. Tikovenko, S.P. Chigrinov

 on the basis of Article 116.1 of the Constitution of the Republic of Belarus, Article 22.3.2 of the Code of the Republic of Belarus on Judicial System and Status of Judges, Article 98 and Article 101.1 of the Law of the Republic of Belarus “On the Constitutional Proceedings”

in the exercise of obligatory preliminary review considered the constitutionality of the Law of the Republic of Belarus “On Protection of Personal Data” in open court session.

Having heard the reporting judge S.Y. Danilyuk, having analysed the provisions of the Constitution of the Republic of Belarus (hereinafter – the Constitution), the Law of the Republic of Belarus “On Protection of Personal Data” and other legislative acts of the Republic of Belarus, the Constitutional Court of the Republic of Belarus found the following.

The Law of the Republic of Belarus “On Protection of Personal Data” (hereinafter – the Law) was adopted by the House of Representatives of the National Assembly of the Republic of Belarus on 2 April 2021, approved by the Council of the Republic of the National Assembly of the Republic of Belarus on 21 April 2021 and submitted to the President of the Republic of Belarus for signing.

The adoption of the Law is conditioned by the need to regulate public relations arising from the collection, processing, distribution, provision of personal data of individuals, as well as their protection.

1. The Constitutional Court, within its powers to exercise obligatory preliminary review of the constitutionality of laws, considers the present Law based on the following provisions of the Constitution:

the Republic of Belarus exercises supreme control and absolute authority over its whole territory and implements an independent domestic and foreign policy; the Republic of Belarus shall defend its independence and territorial integrity, its constitutional system, and safeguard lawfulness and law and order (Articles 1.2 and 1.3);

the individual, his rights, freedoms and guarantees to secure them are the supreme value and goal of the society and the State; safeguarding the rights and freedoms of citizens of the Republic of Belarus shall be the supreme goal of the State (Articles 2.1 and 21.1);

the State shall safeguard personal liberty, inviolability and dignity; everyone shall have the right to protection against unlawful interference with his private life, including encroachments on his honour and dignity (Articles 25.1 and 28);

the State shall guarantee the rights and freedoms of citizens of Belarus that are enshrined in the Constitution and laws, and specified by the State's international obligations (Article 21.3), including  the right to receive, store and disseminate complete, reliable and timely information on the activities of state bodies and public associations, on political, economic, cultural and international life, and on the state of the environment, and the obligation for State bodies, public associations and officials to provide citizens of the Republic of Belarus with an opportunity to familiarise themselves with materials that affect their rights and legitimate interests (Articles 34.1 and 34.2);

the State shall take all measures at its disposal to establish the domestic and international order necessary for the full exercise of the rights and freedoms of the citizens of the Republic of Belarus that are specified by the Constitution (Article 59.1).

Guided by Article 54.1 of the Law “On the Constitutional Proceedings” the Constitutional Court considers the constitutionality of the Law and determines whether the contents of its provisions, its form, delineation of competencies between state bodies and the procedure for its adoption are conforming to the Constitution, international legal instruments, ratified by the Republic of Belarus.

2. In the conditions of intensive development of information technologies, the issues of personal privacy, including personal data, have acquired special significance. In this regard, several documents have been adopted at the international and regional levels aimed at protecting personal information, the uncontrolled dissemination of which can cause significant harm to the constitutional rights and legitimate interests of individuals, property, public order and national security.

Thus, the UN General Assembly Resolution 73/179 “The right to privacy in the digital age” of 17 December 2018 calls upon all States to consider developing or maintaining and implementing adequate legislation, in consultation with all relevant stakeholders, including civil society, with effective sanctions and appropriate remedies, that protects individuals against violations and abuses of the right to privacy, namely through the unlawful and arbitrary collection, processing, retention or use of personal data by individuals, Governments, business enterprises and private organisations (para. 6, subpara. (f)).

The basic EU document on data protection – the General Data Protection Regulation of 27 April 2016 – provides for the possibility to restrict the scope of the rights provided for by the GDPR when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard national security, defence, public security, etc. (Article 23).

The issues of reliable protection of personal data are also given special attention in the Decision of the Supreme Eurasian Economic Council No. 12 “On the Main Guidelines on Implementing the Digital Agenda of the Eurasian Economic Union till 2025” of 11 October 2017.

According to the constitutional provisions stipulating that the Republic of Belarus shall recognise the supremacy of the generally recognised principles of international law and shall ensure the compliance of laws therewith (Article 8.1), the State shall guarantee the rights and freedoms of citizens of Belarus that are enshrined in the Constitution and laws, and specified by the State's international obligations (Article 21.3) and based on the analysis of the rules of the Law, the Constitutional Court notes that when improving the legal regulation of work with personal data, the legislator took into account the recommendations contained in international legal instruments, as well as positive foreign and domestic experience in this field.

3. The law systematically and comprehensively regulates public relations in the field of performing various actions with personal data (collection, use, distribution, deletion, etc.) and fixes such main terms as “personal data”, “publicly available personal data”, “special personal data”, “subject of personal data”, etc., as well as their definitions.

Article 1 of the Law provides that personal data is any information that relates to an identified or identifiable living individual (para. 9); publicly available personal data is personal data disseminated by the subject of personal data either with his consent or in accordance with the requirements of legislative acts (para. 7); special personal data is personal data concerning race or nationality, political views, membership in trade unions, religious or other beliefs, health or sex life, administrative or criminal prosecution, as well as biometric and genetic personal data (para. 12).

The incorporation of this terminology into the Law is due to the need to ensure the clarity and consistency of legal regulation, an unambiguous understanding of the rules of the Law and the exclusion of their various interpretations in law enforcement practice, which is consistent with the principle of legal certainty as an essential component of the constitutional principle of the rule of law established by Article 7.1 of the Constitution.

4. The law provides for the establishment of an authorised body for the protection of the rights of subjects of personal data (hereinafter – the authorised body) and determines its powers (Article 18 of the Law).

Thus, it is established that the authorised body exercises control over the processing of personal data by operators (authorised persons) in accordance with legislative acts; considers complaints of subjects of personal data concerning the processing of personal data; requires operators (authorised persons) to modify, block or delete inaccurate or unlawfully obtained personal data, to eliminate other violations of this Law; determines the list of foreign states ensuring an adequate level of protection of the rights of subjects of personal data on their territory; issues permits for a cross-border transfer of personal data, if an adequate level of protection of the rights of subjects of personal data is not ensured on the territory of a foreign state, etc.

According to Article 18.5 of the Law, the authorised body shall be determined by the President of the Republic of Belarus.

The Constitutional Court notes that the regulation of the activities of the authorised body by the Law is based on Article 7.2 of the Constitution, according to which the State and all the bodies and officials thereof shall operate within the confines of the Constitution and acts of legislation adopted in accordance therewith, is aimed at ensuring a more complete and effective fulfillment by the State of the constitutional obligation enshrined in Article 59.1 of the Constitution, is consistent with the constitutional provision stipulating that the President shall exercise other powers entrusted to him by the Constitution and laws (Article 84.30).

The establishment of the authorised body for the protection of the rights of subjects of personal data and monitoring compliance with the legislation on the protection of personal data meets the constitutional provisions stipulating that safeguarding the rights and freedoms of citizens of the Republic of Belarus shall be the supreme goal of the State (Article 21.1), and is also consistent with the requirements of the UN General Assembly Resolution 73/179 “The right to privacy in the digital age” of 17 December 2018 on the need for States to consider adopting and implementing data protection legislation, regulation and policies, including on digital communication data, that complies with their international human rights obligations, which could include the establishment of national independent authorities with powers and resources to monitor data privacy practices, investigate violations and abuses and receive communications from individuals and organisations, and to provide appropriate remedies (para. 6, subpara. (g)).

The same recommendation on the establishment of a national agency is contained in the Main Guidelines on Implementing the Digital Agenda of the Eurasian Economic Union till 2025, which emphasise the need for a more reliable institutional form of personal data protection, while maintaining a balance of protection in the context of their cross-border exchange (Chapter 2).

5. The Law lays down the requirements for the processing of personal data (Articles 4–9).

In accordance with Article 4.3 of the Law, the processing of personal data shall be carried out with the consent of the subject of personal data, with the exception of cases provided for by this Law and other legislative acts. Article 6 of the Law establishes cases when the consent of the subject of personal data to the processing of personal data is not required, with the exception of special personal data, the processing of which is established by Article 8 of this Law, Article 8.2 – cases when the consent of the subject of special personal data to their processing is not required. Thus, the Law includes provisions that restrict the rights and freedoms of individuals to a certain extent.

Several decisions of the Constitutional Court (No. D-1126/2018 of 8 June 2018, No. D-1162/2018 of 27 December 2018, No. D-1188/2019 of 10 July 2019, etc.) contain similar legal positions on the need for such legislative regulation and relevant law enforcement practice in the field of information relationship (including the procedure for identifying individuals), which would reliably ensure their rights and legitimate interests, the protection of personal data (including information constituting personal, family and other secrets protected by law), excluding actions with personal data that are not conditioned by the legally determined purposes of their collection, storage and use, the lawful performance of functions by bodies that are legally empowered to collect, store and use them.

Assessing the nature and limits of the restrictions of the rights and freedoms of an individual provided for by the Law, the Constitutional Court notes that, taking into account Articles 23.1, 28 and 34.3 of the Constitution, establishing the legal grounds for interference in the private life of individuals, the considered legal restrictions, on the condition of protection of personal data from illegal access by other persons, appear to be permissible and proportionate to constitutionally significant goals, since they are based on the need to achieve an optimal and fair balance between public and private interests, including between the objectively determined requirement for an accurate identification of users and the exercise of a constitutional guarantee to protect their personal life from unlawful infringements.

6. Chapter 3 of the Law (Articles 10–17) enshrines the rights of the subject of personal data, that is, an individual in respect of whom the processing of personal data is carried out, and the obligations of the operator, that is, a state body, a legal entity of the Republic of Belarus, another organisation, an individual, including an individual entrepreneur, independently or jointly with other specified persons organising and (or) carrying out the processing of personal data.

Thus, according to the Law, the subject of personal data has the right: to revoke his consent at any time without giving reasons (Article 10.1); to receive information regarding the processing of his personal data (Article 11.1); to require the operator to modify his personal data if the personal data is incomplete, outdated or inaccurate (Article 11.4); to receive information from the operator about the provision of his personal data to third parties once per calendar year free of charge, unless otherwise provided by this Law and other legislative acts (Article 12.1); to require the operator to stop the processing of his personal data free of charge, including their deletion, in the absence of grounds for the processing of personal data provided for by this Law and other legislative acts (Article 13.1).

Article 16 of the Law establishes the corresponding obligations of the operator: to ensure the protection of personal data in the course of their processing; to modify personal data that are incomplete, outdated or inaccurate, unless a different procedure for making changes to personal data is established by legislative acts or if the purposes of processing personal data do not imply subsequent changes in such data; to stop processing personal data, as well as to carry out their deletion or blocking (to ensure the termination of the processing of personal data, as well as their deletion or blocking by an authorised person) in the absence of grounds for processing personal data provided for by this Law and other legislative acts, etc.

According to the Constitutional Court, the establishment of the rights of subjects of personal data and the corresponding obligations of operators by the Law is aimed at providing additional guarantees against arbitrary and uncontrolled processing, including collection, storage, use, distribution and provision, of personal data of individuals, as well as achieving a constitutional balance between public and private interests.

Moreover, the Law guarantees the right to appeal against actions (inaction) and decisions of the operator related to the processing of personal data. Thus, according to Article 15 of the Law, the subject of personal data has the right to appeal against the actions (inaction) and decisions of the operator that violate his rights when processing personal data, to the authorised body according to the procedure established by the legislation on applications from individuals and legal entities; the decision made by the authorised body may be appealed against by the subject of personal data in court according to the procedure established by law.

The Constitutional Court considers that the procedure for appealing against actions (inaction) and decisions of the operator in the field of personal data processing, determined by the Law, complies with Article 40.1 of the Constitution, providing that everyone shall have the right to address personal or collective appeals to state bodies, and with Article 60.1 of the Constitution, stipulating that everyone shall be guaranteed protection of his rights and freedoms by a competent, independent and impartial court within the time limits specified by law.

Such legal regulation establishes the necessary conditions for the timely and effective restoration of violated rights, which also meets the provision of the Constitution providing that the State shall take all measures at its disposal to establish the domestic and international order necessary for the full exercise of the rights and freedoms of the citizens of the Republic of Belarus that are specified by the Constitution (Article 59.1).

Based on the analysis of the rules of the Law, the Constitutional Court considers that the Law establishes a systemic and comprehensive regulation of the most important social relations arising from the processing of personal data of individuals, it is aimed at protecting the constitutional human rights and freedoms, including the right to protection from unlawful interference in one’s personal life, by preventing the misuse of personal data, at strengthening the information security of the State, as well as creating the necessary conditions for effective international cooperation in the field of ensuring the right to inviolability of personal life, which is consistent with the provisions of the Constitution

The law was adopted by the House of Representatives of the National Assembly of the Republic of Belarus and approved by the Council of the Republic of the National Assembly of the Republic of Belarus within the powers in accordance with Articles 97.1.2 and 98.1.1 of the Constitution.

In view of the foregoing the Constitutional Court concludes that the Law is in conformity with the Constitution as regards the contents of its rules, the form of the act and the procedure of its adoption.

Guided by Articles 116.1 and 116.7 of the Constitution of the Republic of Belarus, Article 24.2 of the Code of the Republic of Belarus on Judicial System and Status of Judges, Articles 103–105 of the Law of the Republic of Belarus “On the Constitutional Proceedings” the Constitutional Court of the Republic of Belarus

RULED:

1. To recognise the Law of the Republic of Belarus “On Protection of Personal Data” to be conforming to the Constitution of the Republic of Belarus.
2. The present Decision shall come into force from the date of adoption.
3. To publish the present Decision in accordance with legislative acts.

Presiding Officer –

Petr Miklashevich,

Chairman

Constitutional Court

Republic of Belarus