Duty LXD-1402
Processes biometric data, in Turkmenistan
Law on Information About Private Life, biometric informationsince 1 line
Law No. 519-V (), Arts. 1(1), 7(7), 11(2) · Read the law's page
- An app that processes a faceprint, voiceprint, or other biometric identifier of a Turkmen data subject must treat it as confidential and limit its collection and processing to the purposes for which it was collected. The specific rules for collecting and processing biometric information are established by other legislation of Turkmenistan.
Law on Information About Private Life, localization and cross-border transfersince 1 line
Law No. 519-V (), Arts. 12, 17 · Read the law's page
- An app storing or processing the personal information of individuals in Turkmenistan, including a voiceprint or other biometric identifier, must store it in a database located within Turkmenistan; personal information may be transferred abroad where it is contained in that domestic database. Transfer to another country additionally requires that the destination state ensure protection of personal information, or one of four grounds: the subject's written consent, an international treaty ratified by Turkmenistan, necessity under a law of Turkmenistan to protect the constitutional order, rights and freedoms, health and morals, public order, defense or state security, or protection of the life, health or other legitimate interests of the subject or of other persons where consent cannot be obtained.
Law on Information and Its Protection, information-security dutyin force3 lines
Law of Turkmenistan No. 72-V, "On Information and Its Protection" (Vedomosti Mejlisa Turkmenistana 2014, No. 2, art. 72; as amended by Laws No. 234-VI of , No. 390-VI of , and No. 445-VI of ), art. 15 · Read the law's page
- This duty binds the possessor of information and the operator of an information system only in cases established by Turkmenistan legislation elsewhere; the Act does not itself name those cases.
- Where the duty is triggered, maintain administrative, technical and organizational measures that: prevent unauthorized access to information and its transfer to a person without a right of access; detect an unauthorized access event in a timely manner; prevent adverse consequences from a breach of the access procedure; prevent disruption of the technical means used to process the information; permit immediate restoration of information altered or destroyed by unauthorized access; and continuously monitor the level of the information's protection.
- A person injured by disclosure or unlawful use of restricted-access information may sue for damages, moral-harm compensation, and protection of honor and dignity; only the claim for compensation of losses is barred if the plaintiff itself took no measures to keep the information confidential or breached the information-protection requirements it was obliged to meet.