Legal basis for ensuring information security in a commercial organization
In the life of every commercial organization, there comes a period when it understands that among all the information stored in its information systems, there is one about which some degree of care should be shown. Most often this is due to the fact that the possession of some data gives an advantage over other market players (for example, the conditions of relations with regular customers, a plan for entering a new market or a plan to increase the extent of coverage of the existing market).
Very often, the management of the company attracts its technical specialists to implement any technical measures to control data transfer or monitor user actions, but at the same time it overlooks the legal side of the issue. Subsequently, this leads to the fact that in the event of a leak of information or a threat to a business, an organization simply cannot punish the guilty person or recover damages from it within the framework of civil law legislation.
This article is an attempt to analyze the existing legislation of Kazakhstan to build a scheme to ensure the legal security of information of market entities.
Kazakhstan is selected only because of my current geographic location. In general, Russian legislation is conceptually no different. If the community is interested in the topic, I will conduct such an analysis for Russian legislation.
Let's start with the Civil Code of the Republic of Kazakhstan (hereinafter - the Civil Code of the Republic of Kazakhstan).
')
GK RK declares that the state guarantees us, as entrepreneurs, the protection of our interests in the area of ​​restricting a company to access to some of its information, which is defined in the legal field as a “commercial secret”.
What is a “commercial secret”? This concept is disclosed in the Law of the Republic of Kazakhstan No. 124-III On Private Enterprise (hereinafter referred to as Law No. 124-III) and consists of the following. If our company has some information, the uncontrolled transmission of which contradicts our interests in the market (marketing, accounting information, information about information systems, allowing access to the above information, etc.), then the company can legally restrict the circle of persons having access to it.
Referring to Article 11 of Law No. 124-III. She tells us that:
Why do we pay so much attention to these articles? The answer lies in article 126 of the Civil Code of the Republic of Kazakhstan. This article gives us quite a lot of interesting information.
For a clearer understanding of this article, let's look at a few examples.
Entry conditions:
Case 1. The company has entered into non-disclosure agreements with employees. The employee disclosed information entrusted to him for the performance of his official duties.
Result : the company has the right to demand compensation by the employee for damage caused by this disclosure.
Case 2. The company has not entered into a non-disclosure agreement with employees. The employee disclosed information entrusted to him for the performance of his official duties.
Result : the company does not have the right to demand compensation from the employee for damage caused by this disclosure.
Case 3. The company has not entered into a non-disclosure agreement with employees. The manager stole the accountant’s documents and handed them over to third parties.
Result : the company has the right to demand compensation by the manager for the damage caused by this disclosure, since the manager has obtained access to the information by an illegal method.
The Labor Code of the Republic of Kazakhstan (hereinafter referred to as the Labor Code of the Republic of Kazakhstan) gives us, as an employer, the opportunity to apply a disciplinary action against an employee. Moreover, this opportunity exists:
Types of disciplinary action:
To implement the possibility of imposing a disciplinary punishment on an employee, the same input conditions as in the previous section must be met:
Regardless of whether the company is going to claim compensation for material damage and whether the company will impose a disciplinary action on the employee, the company has the right to file a lawsuit with a view to initiating a criminal case against the offender.
There is a very important point. The Criminal Code of the Republic of Kazakhstan (hereinafter referred to as the Criminal Code of the Republic of Kazakhstan) imposes punishment not only for the disclosure of commercial secrets, but also for the illegal collection of information constituting a commercial secret, for the purposes of disclosure or illegal use.
Very often, the management of the company attracts its technical specialists to implement any technical measures to control data transfer or monitor user actions, but at the same time it overlooks the legal side of the issue. Subsequently, this leads to the fact that in the event of a leak of information or a threat to a business, an organization simply cannot punish the guilty person or recover damages from it within the framework of civil law legislation.
This article is an attempt to analyze the existing legislation of Kazakhstan to build a scheme to ensure the legal security of information of market entities.
Kazakhstan is selected only because of my current geographic location. In general, Russian legislation is conceptually no different. If the community is interested in the topic, I will conduct such an analysis for Russian legislation.
Legal basis
Let's start with the Civil Code of the Republic of Kazakhstan (hereinafter - the Civil Code of the Republic of Kazakhstan).
')
GK RK declares that the state guarantees us, as entrepreneurs, the protection of our interests in the area of ​​restricting a company to access to some of its information, which is defined in the legal field as a “commercial secret”.
Article 10 of the Civil Code of the Republic of Kazakhstan. Protection of the rights of entrepreneurs and consumers
...
5. Commercial (business) secrets are protected by law. The procedure for determining information constituting a trade secret, means of its protection, as well as a list of information that should not be part of a trade secret, are established by law.
...
5. Commercial (business) secrets are protected by law. The procedure for determining information constituting a trade secret, means of its protection, as well as a list of information that should not be part of a trade secret, are established by law.
...
What is a “commercial secret”? This concept is disclosed in the Law of the Republic of Kazakhstan No. 124-III On Private Enterprise (hereinafter referred to as Law No. 124-III) and consists of the following. If our company has some information, the uncontrolled transmission of which contradicts our interests in the market (marketing, accounting information, information about information systems, allowing access to the above information, etc.), then the company can legally restrict the circle of persons having access to it.
Article 1 of Law No. 124-III. Basic concepts and definitions used in this Law
...
A trade secret is information determined and protected by a business entity, legally free access to which a limited circle of persons has, disclosure, receipt, the use of which may damage its interests.
...
A trade secret is information determined and protected by a business entity, legally free access to which a limited circle of persons has, disclosure, receipt, the use of which may damage its interests.
...
Referring to Article 11 of Law No. 124-III. She tells us that:
- the company itself has the right to determine the distribution of what information it wants to limit (there is a small list of things to which it cannot restrict access);
- the company itself determines the circle of persons to whom information relating to the company's trade secret will be available, and must itself ensure its protection;
- to secure its position, a company may require a non-disclosure subscription from employees;
- the company has the right to limit the access of inspecting organizations to information classified as a commercial secret, and to expect from them the non-disclosure of commercial secrets, access to which they obtained during the verification process;
- information constituting a commercial secret of a company may be disclosed only with the consent of the company (except for cases of disclosure by court order, etc.)
Article 11 of Law No. 124-III. Protection of information on the subject of private entrepreneurship
1. Protection of a trade secret is to prohibit the unlawful receipt, dissemination or use of information constituting a trade secret.
2. A private enterprise shall determine the circle of persons having the right of free access to information constituting a commercial secret, and shall take measures to protect its confidentiality.
3. The procedure for classifying information as access categories, conditions for storing and using information constituting a commercial secret are determined by the subject of private entrepreneurship.
4. Persons who illegally obtained, disclosed or used information constituting a commercial secret are obliged to compensate for the damage caused in accordance with the civil legislation of the Republic of Kazakhstan.
5. A private enterprise or a person authorized by it has the right to demand from its employees a non-disclosure subscription of information constituting a commercial secret, and persons who carry out its verification warn about responsibility in accordance with the laws of the Republic of Kazakhstan.
6. The list of information subject to mandatory publication or mandatory notification to shareholders, members of a business partnership or other specified circle of persons is established by the constituent documents of the private entrepreneurship entity in accordance with the laws of the Republic of Kazakhstan.
7. The subject of private entrepreneurship has the right not to provide public authorities and officials in the performance of registration, control functions and in the performance of other actions access to information constituting a commercial secret, other than that necessary for the implementation of their functions.
8. Deleted
9. Law enforcement agencies have the right to request and receive the necessary information, including commercial secrets, both from the subject of private entrepreneurship and from state authorities possessing this information, on the basis of the sanction of the prosecutor, the decision of the investigating authorities to initiate criminal proceedings or court
10. Information constituting a commercial and other secret protected by law cannot be disclosed without the consent of the subject of private entrepreneurship, with the exception of information on which there is a court decision that has entered into legal force.
11. Generalized information that does not disclose information constituting commercial and other secrets of private entrepreneurship protected by law is publicly available.
12. To publicly available information of the subject of private entrepreneurship include:
1) the last name, first name and patronymic (if any) or the name of the individual entrepreneur;
2) the name and date of registration of the legal entity;
3) identification number;
4) legal address (location);
5) type of activity;
6) surname, name, patronymic (if available) of the manager.
2. A private enterprise shall determine the circle of persons having the right of free access to information constituting a commercial secret, and shall take measures to protect its confidentiality.
3. The procedure for classifying information as access categories, conditions for storing and using information constituting a commercial secret are determined by the subject of private entrepreneurship.
4. Persons who illegally obtained, disclosed or used information constituting a commercial secret are obliged to compensate for the damage caused in accordance with the civil legislation of the Republic of Kazakhstan.
5. A private enterprise or a person authorized by it has the right to demand from its employees a non-disclosure subscription of information constituting a commercial secret, and persons who carry out its verification warn about responsibility in accordance with the laws of the Republic of Kazakhstan.
6. The list of information subject to mandatory publication or mandatory notification to shareholders, members of a business partnership or other specified circle of persons is established by the constituent documents of the private entrepreneurship entity in accordance with the laws of the Republic of Kazakhstan.
7. The subject of private entrepreneurship has the right not to provide public authorities and officials in the performance of registration, control functions and in the performance of other actions access to information constituting a commercial secret, other than that necessary for the implementation of their functions.
8. Deleted
9. Law enforcement agencies have the right to request and receive the necessary information, including commercial secrets, both from the subject of private entrepreneurship and from state authorities possessing this information, on the basis of the sanction of the prosecutor, the decision of the investigating authorities to initiate criminal proceedings or court
10. Information constituting a commercial and other secret protected by law cannot be disclosed without the consent of the subject of private entrepreneurship, with the exception of information on which there is a court decision that has entered into legal force.
11. Generalized information that does not disclose information constituting commercial and other secrets of private entrepreneurship protected by law is publicly available.
12. To publicly available information of the subject of private entrepreneurship include:
1) the last name, first name and patronymic (if any) or the name of the individual entrepreneur;
2) the name and date of registration of the legal entity;
3) identification number;
4) legal address (location);
5) type of activity;
6) surname, name, patronymic (if available) of the manager.
Damages
Why do we pay so much attention to these articles? The answer lies in article 126 of the Civil Code of the Republic of Kazakhstan. This article gives us quite a lot of interesting information.
- In order to be able to receive state support in terms of compensation for damages from disclosure , three conditions must be met simultaneously:
- the information must have real or potential commercial value due to the unknown to third parties;
- access to this information should be limited ;
- The company must take steps to protect this information from disclosure.
- The company may claim damages in the following cases:
- information obtained by a third party through illegal methods ;
- the employee disclosed the information, although the employment contract provided for a non-disclosure agreement ;
- the counterparty disclosed the information, although the civil contract provided for a non-disclosure agreement .
Article 126 of the Civil Code of the Republic of Kazakhstan. Official and commercial secret
- Civil law protects information constituting official or commercial secrets, in the case when the information has real or potential commercial value due to its unknown to third parties, there is no free access to it legally and the information owner takes measures to protect its confidentiality.
- Persons who illegally obtained such information, as well as employees contrary to the employment contract or counterparties contrary to the civil law contract, who divulged official or commercial secrets, are obliged to compensate for the damage caused.
For a clearer understanding of this article, let's look at a few examples.
Entry conditions:
- The company has determined what information has commercial value for it and has documented the list in any document with which it acquaints all the workers with the painting.
- The company has established means of differentiating access to information (passwords, attendances) that do not allow the manager to access the accountant’s information, and the accountant’s access to the manager’s information.
Case 1. The company has entered into non-disclosure agreements with employees. The employee disclosed information entrusted to him for the performance of his official duties.
Result : the company has the right to demand compensation by the employee for damage caused by this disclosure.
Case 2. The company has not entered into a non-disclosure agreement with employees. The employee disclosed information entrusted to him for the performance of his official duties.
Result : the company does not have the right to demand compensation from the employee for damage caused by this disclosure.
Case 3. The company has not entered into a non-disclosure agreement with employees. The manager stole the accountant’s documents and handed them over to third parties.
Result : the company has the right to demand compensation by the manager for the damage caused by this disclosure, since the manager has obtained access to the information by an illegal method.
Disciplinary action
The Labor Code of the Republic of Kazakhstan (hereinafter referred to as the Labor Code of the Republic of Kazakhstan) gives us, as an employer, the opportunity to apply a disciplinary action against an employee. Moreover, this opportunity exists:
- whether or not the company entered into a nondisclosure agreement with the employee;
- regardless of whether the company will claim damages by the employee or not.
Types of disciplinary action:
- comment;
- rebuke;
- severe reprimand;
- termination of employment contract.
Article 22 of the LC RK. Basic rights and obligations of an employee
1. The employee must:
...
6) not to disclose information constituting state secrets, official, commercial or other secret protected by law, which became known to him in connection with the performance of his job duties;
...
...
6) not to disclose information constituting state secrets, official, commercial or other secret protected by law, which became known to him in connection with the performance of his job duties;
...
Article 54 of the LC RK. Grounds for termination of employment contract at the initiative of the employer
1. An employment contract with an employee at the initiative of the employer may be terminated in the following cases:
...
12) disclosure by the employee of information constituting state secrets and other secrets protected by law, which became known to him in connection with the performance of his job duties;
...
...
12) disclosure by the employee of information constituting state secrets and other secrets protected by law, which became known to him in connection with the performance of his job duties;
...
Article 72 of the LC RK. Disciplinary action
1. For a disciplinary offense committed by an employee, an employer shall have the right to apply the following types of disciplinary action:
1) remark;
2) reprimand;
3) severe reprimand;
4) termination of the employment contract at the initiative of the employer in the cases established by this Code.
...
1) remark;
2) reprimand;
3) severe reprimand;
4) termination of the employment contract at the initiative of the employer in the cases established by this Code.
...
To implement the possibility of imposing a disciplinary punishment on an employee, the same input conditions as in the previous section must be met:
- The company has determined what information has commercial value for the company and has documented the list in any document with which it acquaints all the workers with the signature.
- The company has established means of differentiating access to information (passwords, attendances) that do not allow the manager to access the accountant’s information, and the accountant’s access to the manager’s information.
Criminal prosecution
Regardless of whether the company is going to claim compensation for material damage and whether the company will impose a disciplinary action on the employee, the company has the right to file a lawsuit with a view to initiating a criminal case against the offender.
There is a very important point. The Criminal Code of the Republic of Kazakhstan (hereinafter referred to as the Criminal Code of the Republic of Kazakhstan) imposes punishment not only for the disclosure of commercial secrets, but also for the illegal collection of information constituting a commercial secret, for the purposes of disclosure or illegal use.
Article 200 of the Criminal Code of the Republic of Kazakhstan. Illegal receipt and disclosure of information constituting commercial or banking secrets
1. The collection of information constituting commercial or banking secrets, by stealing documents, bribing or threats against persons who possess commercial or banking secrecy, or their relatives, interception in communications, illegal entry into a computer system or network, the use of special technical means, as well as in any other illegal way in order to disclose or illegal use of this information - is punishable by a fine of one hundred to two hundred monthly calculated indicators, or correctional work for up to two years, or restriction of liberty for up to one year, or imprisonment for the same period.
2. Illegal disclosure or use of information constituting commercial or banking secrets, without the consent of their owner by a person to whom they were entrusted in the service or work, committed out of mercenary or other personal interest and causing major damage, is punished with a fine of two hundred to five hundred monthly calculation indicators either by correctional labor for a period of one to two years, or by restriction of liberty for a term of up to three years or imprisonment for the same period with a fine of up to one hundred monthly estimated performance or without it.
2. Illegal disclosure or use of information constituting commercial or banking secrets, without the consent of their owner by a person to whom they were entrusted in the service or work, committed out of mercenary or other personal interest and causing major damage, is punished with a fine of two hundred to five hundred monthly calculation indicators either by correctional labor for a period of one to two years, or by restriction of liberty for a term of up to three years or imprisonment for the same period with a fine of up to one hundred monthly estimated performance or without it.
Summary
- The legislation gives the company the right to set a privacy mode for certain types of data. For this you need:
- determine the list of data that is a commercial secret;
- determine to whom and in what cases provide access to any information that is a commercial secret;
- familiarize employees with these documents against signature;
- restrict free access to this information.
- In the event of the employee disclosing a trade secret, the company has the right to impose a disciplinary action on him, up to the termination of the employment contract:
- subject to the necessary conditions of paragraph 1;
- even if the company has not entered into non-disclosure agreements.
- In case of disclosure by a worker or counterparty of a commercial secret, the company is entitled to claim compensation for the damage caused, subject to compliance with all the conditions of clause 1 (including a non-disclosure agreement).
- In the event that the disclosure of a trade secret by an employee resulted in major damage, the company has the right to file a lawsuit to open a criminal case.
- In the event that a trade secret has been stolen by third parties by hacking or interception, the company has the right to:
- file a lawsuit to institute criminal proceedings;
- to demand compensation for the damage, subject to the necessary conditions of paragraph 1.
Source: https://habr.com/ru/post/202614/
All Articles