Abstract
The current level of development of the information community and the deep-rooted and recognized presence of digitalization in the labour sphere have significantly worsened employees' legal situation regarding personal data protection. The legislator does not always keep up with the changes in social and economic relations. The purpose of this study is to reveal defects and gaps in the current norms of labour law in our country with reference to the processing and protection of personal data, as well as to search for legal norms that can eliminate and cover them. The central idea is that the 2013 Law on Personal Data and Their Protection does not account for the specifics of employment relations, while the Labour Code of the Republic of Kazakhstan (LC RK) is confined to a single blanket provision. The scientific and practical relevance lies in the fact that the current LC RK, unlike its predecessor, contains no dedicated chapter on the employee's personal data. The methodology comprises general scientific methods together with the comparative legal method, the method of legal modelling, the systemic method and doctrinal analysis; the EU General Data Protection Regulation, Directive 95/46/EC, the ILO code of practice and foreign scholarship on algorithmic management served as benchmarks, alongside the current digital legislation of the Republic of Kazakhstan on personal data, cybersecurity and artificial intelligence. The main results are the substantiation of the need for a separate chapter in the LC RK and the drafting of articles establishing processing principles, employer obligations, the rights of employees and their representatives, the procedure for anonymisation and destruction of data, and the right of appeal. The study brings tested international standards to bear on Kazakhstan labour law at a moment when administrative sanctions in this field have been significantly raised. Its findings are directed at the legislature and at employers developing internal workplace policies.