On personal data (LRU-547-son)

02.07.2019

LAW OF THE REPUBLIC OF UZBEKISTAN

Adopted by the Legislative Chamber on April 16, 2019 Approved by the Senate on June 21, 2019

Chapter 1. General provisions

Article 1. Purpose of this Law

The purpose of this Law is to regulate relations in the field of personal data.

Article 2. Legislation on personal data

The legislation on personal data consists of this Law and other legislative acts.

If an international treaty of the Republic of Uzbekistan establishes rules other than those provided for by the legislation of the Republic of Uzbekistan on personal data, then the rules of the international treaty shall be applied.

Article3. Application scope of this Law

This Law applies to relations arising from the processing and protection of personal data, regardless of the means of processing used, including information technology.

This Law does not apply to relations arising from:

the processing of personal data by an individual for personal, domestic purposes and not related to his professional or commercial activity;

the formation, storage and use of documents of the National Archival Fund and other archival documents containing personal data;

processing of personal data related to information constituting state secrets;

processing of personal data obtained in the course of operational-search, intelligence and counter-intelligence activities, combating crime, law enforcement, as well as in the framework of counteracting the legalization of proceeds of crime.

Article 4. Basic concepts

The following basic concepts apply in this Law:

personal data — information recorded on electronic, paper and (or) other tangible media relating to a specific individual or giving the possibility of his identification;

personal data subject (subject) — an individual to whom personal data relates;

personal database — a database in the form of an information system containing personal data;

processing of personal data — the implementation of one or a combination of actions to collect, systematize, store, modify, supplement, use, provide, distribute, transfer, anonymize and destroy personal data;

personal data base operator (operator) — a state body, an individual and (or) legal entity that processes personal data;

owner of a personal data base (owner) — a state body, an individual and (or) legal entity having the right to own, use and dispose a personal data base;

third party — any person who is not a subject, owner and (or) operator, but associated with them circumstances or relationships for the processing of personal data.

Article 5. Basic principles of this Law

The main principles of this Law are:

observance of constitutional rights and freedoms of human and citizen;

the legitimacy of the purposes and methods of processing of personal data;

accuracy and reliability of personal data;

confidentiality and security of personal data;

equality of rights of subjects, owners and operators;

security of the individual, society and the state.

Chapter 2. State regulation in the field of personal data

Article 6. Bodies implementing state regulation in the field of personal data

State regulation in the field of personal data is carried out by the Cabinet of Ministers of the Republic of Uzbekistan and the authorized state body in the field of personal data.

Article 7. Powers of the Cabinet of Ministers of the Republic of Uzbekistan in the field of personal data

The Cabinet of Ministers of the Republic of Uzbekistan:

ensures the implementation of a unified state policy in the field of personal data;

approves state programs in the field of personal data;

determines the procedure for maintaining the State Register of Personal Databases;

approves the procedure for registering personal data bases in the State Register of Personal Databases;

coordinates the activities of state and business administration bodies, local government bodies in the field of personal data.

The Cabinet of Ministers of the Republic of Uzbekistan on the basis of data provided by the authorized state body in the field of personal data sets:

security levels of personal data during their processing, depending on security threats;

requirements for the protection of personal data during their processing, the implementation of which ensures the established levels of security of personal data;

requirements for material consists of biometric and genetic data and technologies for storing such data outside personal data bases.

Article 8. The authorized state body in the field of personal data

The authorized state body in the field of personal data is the State Personalization Center under the Cabinet of Ministers of the Republic of Uzbekistan (hereinafter referred to as the authorized state body).

The authorized state body:

implements state policy in the field of personal data;

participates in the development and implementation of state and other programs in the field of personal data;

approves the sample procedure for processing of personal data;

approves the sample procedure for organizing the activities of a structural unit or an authorized person of the owner and (or) operator, ensuring the processing of personal data and their protection;

maintains the State Register of Personal Databases;

issues a certificate of registration of a personal data base in the State Register of Personal Databases;

within its powers, exercises state control over compliance with the requirements of the legislation on personal data;

makes proposals to the Cabinet of Ministers of the Republic of Uzbekistan on improving the regulatory framework in the field of personal data;

sends to the state bodies authorized in the field of state security, with regard to the scope of their activities, the established information;

determines the necessary level of security of personal data;

carries out an analysis of the volume and content of processed personal data, the type of activity, the reality of threats to the security of personal data;

introduces binding orders for legal and physical persons to eliminate violations of the legislation on personal data;

cooperates with competent authorities of foreign states and international organizations in the field of personal data.

Chapter 3. Processing of personal data

Article 9. Participants in the processing of personal data

The participants in the processing of personal data are the subject and the operator. Participants in the processing of personal data may also be the legal representative of the entity, the owner and third parties.

Article 10. Collection, systematization and storage of personal data

The database of personal data is formed by collecting personal data necessary and sufficient to complete the tasks carried out by the owner and (or) operator, as well as by a third party.

The procedure and principles for the collection, systematization of personal data are determined by the owner and (or) operator independently. The storage of personal data is carried out in a form that allows to identify the subject to the extent that the purposes previously stated during the collection of personal data require.

The storage period of personal data is determined by the date the purposes of their collection and processing are achieved.

Article 11. Change and addition of personal data

Change and addition of personal data is carried out by the owner and (or) operator on the basis of the appeal of the subject no later than three days from the date of such treatment.

Changes and additions to personal data that do not correspond to reality are made without delay from the moment such non-compliance is established.

Article 12. Use of personal data

The use of personal data is actions with personal data aimed at realizing the purposes of the activities of the owner, operator and third party.

The use of personal data by the owner, operator and third party is carried out only for the previously stated purposes of their collection, provided that the necessary level of protection of personal data is ensured.

The use of personal data by the employees of the owner and (or) operator, as well as a third party related to the processing of personal data, should be carried out only in accordance with their professional, official or labor duties.

Employees of the owner and (or) operator, as well as a third party, associated with the processing of personal data are required to prevent the disclosure of personal data that they have been trusted or known in connection with the performance of professional, official or labor duties.

Article 13. Providing personal data

The provision of personal data are actions aimed at the disclosure of personal data to a specific person.

The provision of personal data to government bodies is free of charge.

When refusing to provide his personal data, the subject has the right not to indicate the reasons for his refusal.

Article 14. Dissemination of personal data

The dissemination of personal data is actions aimed at the disclosure of personal data to an indefinite number of persons, including the publication of personal data in the media, posting on the Internet, or providing access to personal data in any other way.

The dissemination of personal data in cases beyond the previously stated purposes of their collection is carried out with the consent of the subject.

Article 15. Cross-border transfer of personal data

Cross-border transfer of personal data is the transfer of personal data by the owner and (or) operator outside the territory of the Republic of Uzbekistan.

Cross-border transfer of personal data is carried out on the territory of foreign states that ensure adequate protection of the rights of subjects of personal data.

Cross-border transfer of personal data to the territory of foreign states that do not provide adequate protection of personal data may be carried out in the following cases:

the subjectʼs consent to the cross-border transfer of his personal data;

the need to protect the constitutional order of the Republic of Uzbekistan, the protection of public order, the rights and freedoms of citizens, health and morality of the population;

stipulated by international treaties of the Republic of Uzbekistan.

Cross-border transfer of personal data may be prohibited or restricted in order to protect the foundations of the constitutional order of the Republic of Uzbekistan, morality, health, rights and legitimate interests of citizens of the Republic of Uzbekistan, to ensure national defense and state security.

Article 16. Anonymization of personal data

The anonymization of personal data is actions, as a result of which the determination of the ownership of personal data to a specific subject becomes impossible.

When processing of personal data for historical, statistical, sociological, scientific research, the owner and operator, as well as a third party, are required to anonymize them.

Article 17. Destruction of personal data

The destruction of personal data are actions that make it impossible to restore personal data.

Personal data shall be destroyed by the owner and (or) operator, as well as by a third party:

upon reaching the purpose of processing of personal data;

if there is a withdrawal of the consent of the subject to the processing of personal data;

after the expiration of the processing of personal data determined by the consent of the subject;

upon entry into legal force of a court decision.

Chapter 4. The procedure for processing of personal data

Article 18. Conditions for the processing of personal data

The processing of personal data should be carried out in accordance with the basic principles of this Law.

The processing of personal data is carried out in the following cases:

subject's consent to the processing of this data;

the need to process this data in order to fulfill the contract to which the subject is a party, or to take measures at the request of the subject before concluding such a contract;

the need to process this data to fulfill the obligations of the owner and (or) operator as defined by law;

the need to process this data to protect the legitimate interests of the subject or other person;

the need to process this data in order to exercise the rights and legitimate interests of the owner and (or) operator or a third party or to achieve socially significant purposes, provided that this does not violate the rights and legitimate interests of personal data subjects;

processing of these data for statistical or other research purposes, subject to the mandatory anonymization of personal data;

if this data is obtained from publicly available sources.

If it is necessary to process personal data in order to protect the rights and legitimate interests of the subject, their processing is allowed without the consent of the subject until the time it becomes possible to obtain consent.

Article 19. Requirements for the processing of personal data

The purposes of processing of personal data are determined by regulatory legal acts, regulations, constituent or other documents regulating the activities of the owner and (or) operator, and must comply with this Law.

The purposes of processing of personal data should correspond to the purposes previously stated during their collection, as well as the rights and obligations of the owner and (or) operator.

In the event of a change in the purpose of processing of personal data, the owner and (or) operator must obtain the consent of the subject to the processing of his data in accordance with the changed purpose.

Personal data must be accurate and reliable, and, if necessary, change and supplement.

The amount of personal data that can be included in the personal data base is determined by the subject in accordance with this Law. The volume and nature of the processed personal data should correspond to the purposes and methods of their processing.

Personal data is processed in a form that allows the identification of the subject or in anonymized form.

The term for processing of personal data should not exceed the period during which the subjectʼs consent to the processing of his personal data is valid.

Article 20. Procedure for the registration of personal data bases

Databases of personal data are subject to registration in the State Register of Personal Databases.

Registration of a database of personal data is carried out according to the application principle by notification. An application for registration of a personal database in the State Register of Personal Databases is submitted to the authorized state body.

The following are not subject to registration: personal data databases containing personal data:

related to the participants (members) of a public association or religious organization and processed accordingly by a public association or religious organization, provided that personal data will not be distributed or disclosed to third parties;

made by the subject publicly available;

including only the last name, first name and patronymic of the subjects;

necessary for the purpose of a single pass of the subject to the territory on which the owner and (or) operator is located, or for other similar purposes;

included in personal data information systems having the status of state automated information systems;

processed without the use of automation;

processed in accordance with labor law.

The owner and (or) operator is obliged to notify the authorized state body of each change in the data necessary for the registration of the relevant personal data base, no later than ten calendar days from the day such change occurs.

Article 21. Procedure for consent and revoking consent to the processing of personal data

The subject agrees to the processing of personal data in any form to confirm the fact of its receipt.

For the processing of special personal data, the consent of the subject in writing is required, including in the form of an electronic document.

In the event of incapacity or limitation of the legal capacity of the subject, written consent, including in the form of an electronic document, to the processing of his personal data is given by his legal representative.

For juvenile subjects, consent to the processing of their personal data in writing, including in the form of an electronic document, is given by parents (guardians, trustees), and in their absence — guardianship and trusteeship authorities.

In the event of the death of the subject, consent to the processing of his personal data in writing, including in the form of an electronic document, is given by his heirs, if such consent was not previously given by the subject during his lifetime.

The processing of personal data of an entity declared dead by a court and recognized by the court as missing is carried out with the consent of the heirs, given in writing, including in the form of an electronic document.

The subject withdraws consent to the processing of personal data in the form in which this consent was given, or in writing, including in the form of an electronic document.

Article 22. The procedure for the provision of information regarding the processing of personal data

The subject has the right to receive information regarding the processing of his personal data containing:

confirmation of the fact of processing of personal data;

grounds and purposes of processing of personal data;

applicable methods of processing of personal data;

the name of the owner and (or) operator and their location (mailing address), information about persons who have access to personal data or who may be disclosed personal data on the basis of an agreement concluded with the owner and (or) operator, or based on law;

the composition of the processed personal data relating to the relevant subject, the source of their receipt, unless otherwise provided by this Law;

terms for processing of personal data, including periods for their storage;

the procedure for the exercise by the subject of the rights provided for in Article 30 of this Law;

information about the carried out or alleged cross-border transfer of personal data.

The subject's right to receive information regarding the processing of his personal data may be limited in cases where the provision of such information violates the rights and legitimate interests of others.

The procedure for the provision of information regarding the processing of personal data of a subject to a third party is determined by the conditions of consent of the subject to the processing of personal data.

The owner and (or) operator are exempted from the obligation to provide information to the subject regarding the processing of his personal data, in cases where:

the subject was previously notified of the processing of his personal data;

personal data is made public by the subject or obtained from a public source;

the provision of such information will violate the rights and legitimate interests of individuals and legal entities.

A notice of refusal to provide of information regarding the processing of personal data is sent to the submitting subject in writing within ten days.

A decision to refuse to provide of information regarding the processing of personal data may be appealed by the subject to the authorized state body or court.

Article 23. Notification of actions in the processing of personal data

The subject, when including his personal data in the personal data base, must be notified in writing about the purposes of processing of personal data, his rights, as defined in Article 30 of this Law.

In the case of the transfer of personal data to a third party, the owner and / or operator within three days notifies the subject in writing.

Notification in writing of the subject is not made when:

exercise of authority by government bodies;

transfer of personal data for processing for historical, statistical, sociological or scientific purposes;

collection of personal data from publicly available sources.

Article 24. Automated processing of personal data

The subject has the right not to be subject to a decision on the basis of exclusively automated processing of his personal data, affecting his rights and legitimate interests, giving rise to legal consequences, with the exception of cases provided for in the second part of this article.

A decision based on exclusively automated processing of the subjectʼs personal data can be made in the following cases:

the presence of the consent of the subject in writing, including in the form of an electronic document;

if the decision is made pursuant to an agreement between the owner and the subject or fulfillment of the conditions of a previously concluded agreement;

prescribed by law.

The owner and (or) operator is obliged to explain to the subject the decision-making procedure on the basis of exclusively automated processing of his personal data and the possible legal consequences of such a decision, provide an opportunity to object to this decision, and also explain the procedure for the subject to protect his rights and legitimate interests.

The owner and (or) operator is obliged to consider the objection specified in the third part of this article and notify the subject in writing of the results of the consideration of such an objection within ten days.

Article 25. Processing of special personal data

Special personal data are data on racial or social origin, political, religious or ideological beliefs, membership in political parties and trade unions, as well as data relating to physical or mental (psychic) health, information about private life and criminal record.

The processing of special personal data is prohibited, with the exception of cases provided for in the third part of this article.

The processing of special personal data is allowed:

in order to ensure state security from external and internal threats by the authorized state body;

if the subject has agreed in writing, including in the form of an electronic document, to process his special personal data;

if special personal data is published by the subject in publicly available sources;

in order to protect the rights and legitimate interests of the subject or other persons;

in the activities of the courts and relevant law enforcement agencies in the framework of a criminal case, enforcement proceedings;

in the implementation by the prosecution authorities of measures aimed at countering the legalization of proceeds from crime and the financing of terrorism;

when carrying out activities of state statistics bodies, as well as when using other state bodies of personal data for statistical purposes with the obligatory condition of their anonymization;

when providing medical and social services or establishing a medical diagnosis, treatment, provided that such data is processed by a medical professional or other person of a health care institution who is responsible for ensuring the protection of personal data;

in the exercise of rights and obligations in the field of labor relations;

in ensuring the protection of the legitimate interests of the subject or a third party in the event of incapacity or limited legal capacity of the subject;

upon disclosure of personal data, including personal data of candidates for elected public office;

when carrying out activities by a non-governmental non-profit organization, religious organization, political party or trade union, provided that the processing concerns exclusively the personal data of members or employees of these organizations and associations, and personal data is not transferred to a third party without the consent of the subjects;

in the processing of personal data of children left without parental care, when they are placed in foster care for families of citizens (on patronage) and in the implementation of other measures to ensure guardianship and trusteeship;

when processing of personal data in order to ensure state security;

when processing data on criminal records by state bodies, as well as by other persons within their powers.

Article 26. Processing of biometric and genetic data

Biometric data is personal data characterizing the anatomical and physiological characteristics of the subject.

Genetic data is personal data related to the inherited or acquired characteristics of the subject, which are the result of the analysis of the biological face of the subject or the analysis of another element that allows to obtain equivalent information.

Biometric and genetic data that are used to identify the subject can be processed only with the consent of the subject, with the exception of cases related to the implementation of international treaties of the Republic of Uzbekistan, the administration of justice, enforcement proceedings, as well as in other cases provided by law.

The use and storage of biometric and genetic data in electronic form outside information systems can only be carried out on tangible media that exclude unauthorized access to them.

Chapter 5. Protection of personal data

Article 27. Guarantees for the protection of personal data

The state guarantees the protection of personal data.

The owner and (or) operator, as well as a third party, take legal, organizational and technical measures to protect personal data, ensuring:

realization of the subject's right to protection from interference in his private life;

integrity and safety of personal data;

maintaining confidentiality of personal data;

prevention of illegal processing of personal data.

Article 271. Special conditions for processing personal data of citizens of the Republic of Uzbekistan

When processing the personal data of citizens of the Republic of Uzbekistan using information technologies, including processing in the global information network Internet, the owner and (or) operator must ensure that such data is collected, systematized, and stored in technical means physically located on the territory of the Republic of Uzbekistan and in personal data bases registered in the State Register of Personal Data Bases in the established manner.

Article 28. Confidentiality of personal data

Confidentiality of personal data is a requirement for the owner and (or) operator or other person who has gained access to personal data to comply with the requirement that it should not be disclosed and disseminated without the consent of the subject or other legal grounds.

The owner and (or) operator and other persons who have gained access to personal data must not disclose or disseminate personal data without the consent of the subject.

Article 29. Publicly available personal data

Publicly available personal data is personal data, access to which is free with the consent of the subject or which is not subject to confidentiality requirements.

In order to provide information to the population, publicly accessible sources of personal data may be created (including biographical directories, telephone, address books, public electronic information resources).

With the written consent of the subject, publicly available personal data may include his surname, first name, middle name, year and place of birth, address, subscriber number, profession information and other personal data communicated by the subject.

Information about the subject can be excluded from publicly available sources of personal data on his appeal, submitted in the form in which consent was given, or in writing, including in the form of an electronic document, as well as by decision of the authorized state body or court.

Chapter 6. Rights and obligations of participants in the processing of personal data

Article 30. Rights and obligations of the subject

The subject of personal data has the right to:

know that the owner and (or) operator, as well as a third party, have their personal data and their composition;

receive, upon request, information on the processing of personal data from the owner and (or) operator;

receive information on the conditions for providing access to their personal data from the owner and (or) operator;

apply for protection of rights and legitimate interests in relation to personal data to the authorized state body or court;

give consent to the processing of their personal data and withdraw such consent, except as otherwise provided by this Law;

give consent to the owner and (or) operator, as well as to a third party, to distribute their personal data in public sources of personal data;

require the owner and (or) operator to temporarily suspend the processing of his personal data, in case the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the purpose of processing.

The personal data of the subject recognized as legally incompetent or limited in legal capacity shall be disposed of by their legal representative.

The subject's duty is to provide his personal data in order to protect the foundations of the constitutional order of the Republic of Uzbekistan, morality, health, rights and legitimate interests of citizens of the Republic of Uzbekistan, to ensure the country's defense and state security.

Article 31. Rights and obligations of the owner and (or) operator

The owner and (or) operator have the right to process personal data.

The owner and (or) operator must:

comply with personal data laws;

provide upon request of the subject information regarding the processing of his personal data;

approve the composition of personal data necessary and sufficient for their performance of tasks;

take measures to destroy personal data in case of achievement of the purpose of their processing, as well as in other cases established by this Law;

provide evidence of the consent of the subject to the processing of his personal data in cases stipulated by law;

change and (or) add personal data subject to documentary confirmation of the reliability of the new data or destroy it if it is impossible to make such changes and (or) additions;

temporarily suspend processing or destroy personal data if there is information about a violation of the conditions for their processing;

provide the opportunity for the subject to submit documents in electronic form to temporarily suspend the processing and (or) destruction of his personal data;

notify in writing the subject, as well as other participants in the processing of personal data in cases of changes, destruction of personal data and restrictions on access to them;

notify in writing the subject in case of transfer of personal data to a third party;

register owned and (or) processed personal data bases;

take the necessary legal, organizational and technical measures to protect personal data.

The owner and (or) operator has the right to entrust the processing of personal data to a third party in the following cases:

the presence of the consent of the subject in writing, including in the form of an electronic document;

if the decision is made pursuant to an agreement between the owner and the entity or fulfillment of the conditions of a previously concluded agreement;

prescribed by law.

The obligations of the owner and (or) operator, as well as a third party to protect personal data, arise from the moment of collection of personal data and are valid until their destruction or anonymization.

The owner and (or) operator determines the structural unit or official responsible for the work related to the processing and protection of personal data, and ensures its work in accordance with the sample procedure for processing of personal data.

Chapter 7. Final provisions

Article 32. Settlement of disputes

Disputes arising in the field of personal data are resolved in the manner prescribed by law.

Article 33. Responsibility for violation of personal data legislation

Persons guilty of violating the legislation on personal data are liable in the prescribed manner.

Article 34. Ensuring the execution, communication, clarification of the essence and significance of this Law

The authorized state body, jointly with other interested ministries and departments, shall ensure the execution of this Law, its delivery to the executors, and the clarification of its essence and significance among the population.

Article 35. Bringing legislation into line with this Law

The Cabinet of Ministers of the Republic of Uzbekistan:

to bring government decisions in accordance with this Law;

to ensure the review and annulment by government bodies of their normative legal acts that contradict this Law.

Article 36. Entry into force of this Law

This Law shall enter into force on October 1, 2019.

President of the Republic of Uzbekistan Sh. MIRZIYOYEV

Tashkent city,

July 2, 2019

No. LRU-547