TurkmenistanLaw on Information About Private Life, localization and cross-border transfer
Law No. 519-V (), Arts. 12, 17
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app storing or processing the personal information of individuals in Turkmenistan, including a voiceprint or other biometric identifier, must store it in a database located within Turkmenistan; personal information may be transferred abroad where it is contained in that domestic database. Transfer to another country additionally requires that the destination state ensure protection of personal information, or one of four grounds: the subject's written consent, an international treaty ratified by Turkmenistan, necessity under a law of Turkmenistan to protect the constitutional order, rights and freedoms, health and morals, public order, defense or state security, or protection of the life, health or other legitimate interests of the subject or of other persons where consent cannot be obtained.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does Article 12(2) bar an operator from keeping a copy of the personal information outside Turkmenistan after a transfer under Article 17, given that it requires storage в базе личных данных, находящейся на территории Туркменистана ("in a personal data database located on the territory of Turkmenistan")?
- Who decides, and by what test, that a foreign state ensures защиты личных сведений ("protection of personal information") for the purposes of Article 17(2), a question the Law answers with no list of states and no named body?
What it makes you log
Logging duty
Article 12(2) requires the operator and a third party to hold personal information in a database located on the territory of Turkmenistan, and Article 17 allows transfer to the territory of foreign states only where those states ensure protection, with listed exceptions (the subject's written consent, a ratified treaty, a law, protection of life or health). These are conditions on where data are kept and where they may go, and none asks for a log or record of transfers. The storage period in Article 12(2) limits the data, not a record. The rule that the database sits in Turkmenistan is a localization rule and not a territorial scope clause, so the row names no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 12 requires the operator and a third party to store personal information in a personal data database located on the territory of Turkmenistan, in a form that allows the subject to be identified, with no citizen-only qualifier and no sectoral limit. Article 17 defines cross-border transfer as the transfer of personal information to the territory of foreign states.
Article 17 provides that personal information is subject to cross-border transfer where it is contained in a database located on the territory of Turkmenistan. Article 17 provides that transfer to the territory of foreign states takes place only where those states ensure the protection of personal information. Where the destination state does not ensure protection, Article 17 permits transfer with the subject's written consent to the transfer of the subject's personal information.
Where the destination state does not ensure protection, Article 17 also permits transfer in the cases provided for by international treaties ratified by Turkmenistan. Where the destination state does not ensure protection, Article 17 also permits transfer in the cases provided for by the laws of Turkmenistan where it is necessary to protect the constitutional order, human rights and freedoms, health and morals, public order, national defense and state security.
Where the destination state does not ensure protection, Article 17 also permits transfer to protect the life, health or other legitimate interests of the subject or of other persons where the subject's consent cannot be obtained. Article 17 provides that cross-border transfer may be prohibited or restricted by the legislation of Turkmenistan. Secondary reporting describes practical enforcement of this Act generally as essentially nonexistent.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .