On July 2, 2019, the Republic of Uzbekistan adopted the Law on Personal Data No.547 (The Law), which provides for several legal obligations for individuals whose activities involve personal data – that is actually all legal entities.
Personal data is…?
Personal data is any information related to a specific person or that makes to his/her identification possible and that is recorded on electronic, paper and/or other material object.
Furthermore, stricter requirements apply to biometric or genetic data, as well as to special personal data (i.e. data on racial or social origin, political, religious or ideological beliefs, membership in political parties and trade unions, concerning physical or mental health and privacy, criminal record).
Field of application
The Law clearly defines the scope of its action and covers relations arising from the processing and protection of personal data, regardless of the processing tools used, including information technology.
At the same time, this Law does not apply to relations arising from:
- processing of personal data for personal, household purposes and not related to his professional or commercial activities;
- using archival documents containing personal data;
- processing of personal data that classified as information constituting state secrets;
- processing of personal data obtained in the course of operational-search, intelligence and counterintelligence activities, the fight against crime, the protection of law and order, as well as in the framework of combating the legalization of proceeds from criminal activity.
Data Protection Authority
The State Personalization Center under the Cabinet of Ministers of the Republic of Uzbekistan is appointed as the authorized state body in the field of personal data and has the following powers:
- issues a certificate of registration of the personal data base in the State Register of personal data bases;
- exercises state control over the compliance with the requirements of data protection laws;
- makes compulsory instructions for eliminating violations of data protection laws;
- determines the required level of personal data security;
- analyzes the volume and content of processed personal data, the type of activity and the possibility of threats to the security of personal data.
Requirements for processing of personal data
The Law sets the legal framework for processing personal data and for the relations between participants in this process: the data subject (the person to whom the data relates), the database owner (state body, individual and (or) legal entity that has the right to own, use and dispose of the personal data base) and the operator (the person performing the processing).
The Law provides for the following requirements for processing personal data:
- Lawfulness of purposes and methods. Personal data processing can only be carried out with the consent of the data subject. Personal data can be used by employees of the database owner and / or operator, as well as a third party, only in accordance with their professional, official or employment duties. Personal data should be destroyed if the data subject withdraws his/her consent to process the personal data or upon expiration of the term for processing data as allowed by the consent of the data subject.
- Data minimization. The database including personal data is formed by collecting personal data to the extent necessary and sufficient to achieve the set objectives. The scope and nature of the processed data should match the purposes and methods of their processing. The duration for processing personal data should not exceed the term allowed by the data subject’s consent.
- Purpose limitation. The objectives of the processing of personal data must comply with the objectives that are stated at the time of their collection, as well as with the rights and obligations of the database owner and/or operator. In case the purposes of processing changes, it is necessary to obtain the consent of the data subject to process the data in accordance with the changed purpose.
- Storage limitation. Personal data must not be kept in a form that permits the identification of data subjects for longer than is necessary for the purposes for which the data is processed. Upon reaching the purpose of processing, personal data should be destroyed by the database owner and/or operator, as well as by a third party.
- Accuracy and fairness. Personal data must be accurate and reliable, and, if necessary should be modified and supplemented. The data should be modified and supplemented by the database owner and/or operator (a) no later than three days if requested by the data subject and (b) without undue delay if the data is not true.
- Confidentiality and security. Persons who have access to personal data are obliged not to disclose or distribute personal data without the consent of the subject. The personal data can be used provided that the necessary level of security is provided. The obligation to protect personal data arises from the moment of collecting personal data and remains until the moment of their destruction or depersonalization.
Making decisions based on automated processing
A decision based solely on the automated processing of the data subject’s personal data can only be accomplished by the data subject’s explicit consent.
The database owner and/or the operator must explain to the data subject the procedure of making decisions based on automated processing and the possible legal consequences of such a decision.
Form of the data subject’s consent
The consent can be expressed in any form that allows verifying the fact of its receipt.
Rights of data subject
The data subject has the right to receive information concerning the processing of his personal data, including:
- confirmation from the database owner as to whether or not the database owner processes personal data;
- grounds and purpose of processing personal data;
- implemented methods for processing personal data;
- information regarding individuals who have access to personal data or who may disclose personal data on the basis of an agreement concluded with the database owner and/or operator, or on the basis of the Law;
- the composition of the processed personal data related to the relevant data subject and the source of their receipt;
- the processing time of personal data, including the storage period;
- information on the performed or intended cross-border transfer of personal data.
The data subject also has the right to require from the database owner and/or operator to suspend the processing of their personal data if the data is incomplete, outdated, inaccurate, illegally obtained or not necessary for processing purposes.
Registration of databases containing personal data
The requirement to register personal databases in the relevant registry of the authorized body is introduced. There are several exceptions to this requirement; in particular, registration is not necessary if the database contains data that is processed in accordance with labor legislation or without the use of automation facilities.
In addition, the database owner and/or operator must determine the structural unit or responsible official for the work related to the processing and protection of personal data and ensure its operation in accordance with the model procedure for processing personal data (not approved at the date of publication).
Cross-border data transfers
The personal data can be transferred over the border provided that the foreign states to which the data is transferred provide adequate protection of the data subjects’ rights.
There are exceptions when the cross-border transfer is possible without adequate protection, for example, if the data subject agrees to such cross-border transfer.
Along with the adoption of the Law on Personal Data, the Administrative Liability Code and the Criminal Code have been amended. Liability measures also come into force on October 1, 2019.
The sanctions are imposed for illegal collection, systematization, storage, modification, addition, use, provision, dissemination, transfer, depersonalization and destruction of personal data as follows:
- Administrative liability in the form of a fine from three to five minimum wages to individuals and from five to 10 wages to corporate officers according to the Article 46-2 of the Administrative Liability Code. Cases of this category are under the jurisdiction of administrative courts.
- Criminal liability arises if the same actions were committed after an administrative penalty, in the form of a fine up to 50 minimum wages or deprivation of a certain right of up to three years or correctional work of up to two years according to the Article 141-2 of the Criminal Code.
- Criminal liability of a stricter nature is applied if a crime is committed by prior conspiracy by a group of individuals, repeatedly or by a dangerous recidivist, for mercenary or other vile motives, using his official position, or entails grave consequences, with sanctions in the form of a fine from 50 to 100 minimum wages or correctional work from two to three years, or custodial restraint from one year to three years or imprisonment up to three years.
- Subjects of personal data also have the right to demand compensation for property and moral damage caused to them as a result of violation of their rights and legitimate interests.
Exemption from liability
A person accused of a criminal offense may be discharged by admitting his guilt, by reconciling himself with the victim and compensation of the caused harm (Article 66-1 of the Criminal Code). However, this rule does not apply to individuals who have unexpired convictions for committing grave or exceptionally aggravated criminal offences.