The FBRK editorial team has repeatedly reported on cases where participants in public procurement publish the personal data of Kazakh citizens in technical specifications when concluding contracts. After our official requests to the Ministry of Digitalisation, the department stated that they are considering the issue of removing citizens' personal data from the public procurement portal.
Not long ago, our editorial team wrote that while preparing materials on the costs of maintaining traffic light facilities in the cities of Kosshy and Shymkent, we discovered that when concluding public procurement contracts, the personal data of employees of the supplier company LLP "SMEU Astana" had been disclosed.
At the time, we suggested that the personal data was published without malicious intent, but rather by mistake and due to ignorance of the law.
The other day we received a letter from representatives of LLP "SMEU Astana" regarding the publication of our material. As the company reported, there was no mistake.
Representatives of "SMEU Astana" assure that the personal data of employees was part of the list of documents for the competitive bid, which is accessible only to the competition organiser, the customer, potential suppliers, and authorised state bodies.
The company stressed that "the information about the personal data of employees on the government procurement website is not publicly accessible". Thus, "SMEU Astana" concluded that the personal data of the employees was provided to us by someone from among their competitors, after which, in their opinion, we published material "aimed at spreading false information that discredits the honour, dignity and reputation of the company".
The FBRK editorial team, in turn, sent a response letter to the representatives of LLP "SMEU Astana", in which we explained exactly how we became aware of the disclosure of personal data, and sent links to the public procurement contracts, to whose technical specifications these documents are attached. For obvious reasons, we are not entitled to disclose the details of the contracts in the public domain.
Despite the information we provided, the representatives of LLP "SMEU Astana" remain convinced of the truth of their original version. The fact of the matter is that the company did not study the links we provided sufficiently carefully (or did not study them at all) and base their opinion on completely different contracts in which personal data is absent.
Confident in their correctness, the representatives of LLP "SMEU Astana" continue to express doubts about the correct work of our editorial team and insist on disclosing the name of the mythical "informant".
Regarding the publication of personal data, the FBRK editorial team previously sent an official request to the Ministry of Digitalisation (MCRIAP) asking whether the department intends to consider improving the public procurement portal or introducing any restrictions on the portal to maximise the security of the personal data of Kazakh citizens.
As reported by the MCRIAP, the Committee for Information Security proposed that the Ministry of Finance consider the issue of removing citizens' personal data from the government procurement portal. The Ministry of Digitalisation also noted that they are preparing a letter for the Ministry of Finance recommending the strengthening of control over the conduct of competitions on the public procurement portal.
However, both proposals imply "the publication of citizens' personal data without their consent" and are more focused on future security measures. But what about those who do not even suspect that their personal data has already been disclosed?
One can only hope that the departments will take into account the problem that has arisen against the backdrop of the disclosure of personal data by participants in public procurement, and not only consider the upcoming risks but also correct violations that have already occurred.