BhutanInformation, Communications and Media Act of Bhutan 2018, data protection and privacy duties
Information, Communications and Media Act of Bhutan 2018, ss.336-337, 339-343, 384-386
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Bhutan, including a voiceprint, faceprint, or other biometric identifier, must obtain the subject's express written permission before collecting it and must not disclose it to a third party without authorization. An ICT or media service provider or vendor must additionally publish a privacy policy, limit collection and use to what is reasonably appropriate, store and use data only for its intended purpose, and remain responsible for data it transfers to a third party.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the definition of Personal Data or Personal information, which covers information that "is in the possession of, or is likely to come into the possession of, an ICT service provider or ICT facility provider", limit sections 384 to 386 to information held by such providers, or do those sections also bind a person who is neither?
- Does the inclusion in that definition of "any expression of opinion about that person" bring a profile or inference that an app generates about an identifiable individual within Personal Data or Personal information?
What it makes you log
Logging duty
Sections 336-343 and 384-386 set duties to respect privacy, publish a privacy policy, limit collection, use and disclosure, hold information for its intended purpose, take written consent and delete obsolete personal information. None names a log, register or record of processing that must be kept or produced, and the Act's compensation and offence sections are outside this row. The cited sections state no territorial scope clause.
- Kind
- None
- As of
What this law does
Chapter 21 imposes a general consent-for-collection duty (s.384: express written permission of the subject, unless permitted or required by law), a non-disclosure duty absent authorization or legal requirement (s.385), and a duty to delete or destroy obsolete personal information, including sensitive personal data (s.386), on "a person" generally.
Chapter 17 imposes a fuller set of duties specifically on an ICT and Media facility or service provider and vendor: a duty to respect and protect privacy (s.336), a mandatory published privacy policy disclosing data types, sources, purposes, use, disclosure recipients, and opt-out options (ss.337-338), collection and use limited to what a reasonable person would consider appropriate (s.339), storage and use limited to the intended purpose (s.340), no disclosure to affiliates or third parties beyond the transaction absent written authorization (s.341), and continuing responsibility, with contractual binding, for personal data a provider transfers to a third party (ss.342-343).
Section 2 ("Commencement") gives as the date from which the Act comes into force. Section 7 ("Transitional Clause") provides that the Act becomes effective six months from the date of adoption. The adoption date meant is the one fixed under section 2, and all existing regulations and rules continue to be effective and valid until then. Six months after is , the day the whole Act took effect, with no chapter-by-chapter schedule.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .