AzerbaijanLaw on Personal Data, open-category personal data and scraped public information
In force since .
A personal data rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app scraping personal data that an individual has made public in Azerbaijan, or that appears in a resource created for general use with that individual's consent to its being made public, has a lawful basis for that collection under the Art. 9.6 open-category ground.
- An app scraping personal data that was made public by someone other than the data subject, or without the subject's consent, does not benefit from the open-category ground and needs a separate lawful basis under Art. 9.6 before collecting or processing it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 5.3 defines the open category of personal data (data made public by the subject, or entered into a general-use information system with the subject's consent) and Article 9.6 lists the lawful bases for collecting and processing personal data. Neither imposes a duty to create, keep, produce or review a log or record. Other provisions of the Law, such as the written undertaking by persons handling personal data in Article 5.5, are not cited by this row. The two cited articles carry no territorial clause.
- Kind
- None
- As of
What this law does
Art. 5.3 creates a category of 'open' personal data: information made public by the data subject, or entered into a resource created for general use, with the subject's consent.
Art. 9.6 lists the lawful bases for collecting and processing personal data, and data of the open category is one of the grounds recognised there alongside the subject's consent to a particular collection, a legislative basis defining the purpose and method of processing, fully anonymised scientific or statistical research, and vital-interest necessity.
Reading Art. 5.3 together with Art. 9.6 supports treating personal data an individual has made public in Azerbaijan, or that sits in a general-use resource with that individual's consent to its being made public, as covered by the open-category ground; no single provision of the Act states this combined conclusion in so many words.
Art. 5.3's open-category definition requires the data to have been made public by the subject or entered into a general-use resource with the subject's own consent; it does not itself say what regime applies to data made public by someone other than the subject, or without the subject's consent, such as a leak or a third party's repost, and no other provision of the Act fills that gap, so such data most plausibly remains subject to the Act's ordinary lawful-basis requirement rather than the narrower open-category ground.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .