The Insider’s View: Personal data protection in Uzbekistan

The date of 15 April 2021 will mark a significant point in the history of personal data protection enforcement in Uzbekistan as it sees changes to the personal data protection law, adopted in late 2020, now entering into force.

At the end of last year, the government of Uzbekistan adopted amendments to the “Law on Personal Data”, mandating the following:

• personal data of citizens of Uzbekistan to be processed using technical means physically located on the territory of Uzbekistan and listed in the Register of the State Data Protection Authority (data localisation);
• the requirement for data localisation to apply to data processing using information technologies, including via the internet;
• to lay the responsibility for compliance on the owner or operator of the database. The owner is an entity that owns the database containing the personal data whereas operator is an entity that, in some way, processes the personal data (gambling operators may fall under each category depending on the way they store and manage the personal data);
• extend the requirement for data localisation to include collection, processing and storage of personal data.

The liability for failing to comply with the new requirements of the Personal Data Protection Law is defined in both the administrative and the criminal codes of the Republic of Uzbekistan. In both of them there are provisions relevant to the data protection enforcement that have also been amended and are due to be released after a round of public discussions that will have completed by the time this gets published. This means the changes outlined below may soon enter into force as well.

The amended Article 46(2) of the administrative code imposes fines (approximately €100-€200 on regular citizens, and approximately €200-€1,000 on corporate officials) if found guilty of illegal disclosure, distribution, possession, change, production of personal data; failure to take the necessary legal, organisational and technical measures established by law to protect personal data on the part of the owner and the operator; and failing to notify the authority in the event of a change in personal data records.

In cases where the above-mentioned wrongdoing has been taking place on the internet, according to the draft regulations that are yet to be adopted, the entity found guilty of the wrongdoing is subject to a fine ranging from approximately €800-€1,500 and subsequent limitation of its activity on the territory of the Republic of Uzbekistan (i.e. blocking the service).

The amended Article 141(2) of the criminal code of the Republic of Uzbekistan introduces an additional liability in a form of either fine (approximately €2,000-€3,000) or deprivation of a certain right (usually in relation to the ability to occupy certain positions in enterprises or organisations; or restriction from conducting a certain activity, as per the order of the Court) for up to three years or corrective labour for up to two years for cases when an entity is repeatedly found guilty of failing to comply with the requirements of the Personal Data Protection Law and had already been sanctioned with an administrative fine on charges detailed in the Article 46(2).

Nowadays, it’s a common practice for the online services to collect and process personal data of its audience in order to improve their service and customer experience of their clients, although cases of abuse of personal data are not rare.

Secure storage

Until recently in Uzbekistan, it was up to a service provider to choose the location and ensure the security of its infrastructure, including the measures to collect, store and process personal data of its users.

For companies working on the Uzbekistan market this may mean infrastructure expenditures, increase of costs associated with running the online infrastructure in the local environment as well as shortages of the network real-estate sufficient to comply with the requirements imposed by the authorities.

The State Center for Personalization under the Cabinet of Ministers is yet to release the details of the enforcement procedure, clarify responsibility and clarify other points for the market to better understand the implications of the amended law.

We will follow all further development on the legislative landscape of the Republic of Uzbekistan to bring more updates as the process moves forward.