TurkmenistanLaw on Information About Private Life, comprehensive regime
Law No. 519-V (), in force , Arts. 1, 3, 6-9, 14
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects or processes the personal information of individuals in Turkmenistan must obtain the subject's written consent unless a case listed in Article 9 applies, may use the information only for the purposes defined when it was collected, and may not contract with another person to perform its collection or processing.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Which methods count as иным способом с применением защитных действий ("another method using protective actions") in Article 8(1), so that a consent given in an app counts as the consent that Article 7(1) requires to be written, a phrase Article 1 does not define?
- Does the bar in Article 7(9) on a contract about передаче другому лицу выполнения действий по сбору и обработке личных сведений ("transfer to another person of the performance of the collection and processing of personal information") reach an operator's use of a hosting or cloud service provider that processes the information on the operator's behalf?
What it makes you log
Logging duty
The articles this row covers (the definitions, the scope, the accessibility of personal information, the conditions for collection and processing, the way consent is given or withdrawn, collection without consent and the limit on use) require the operator to obtain the subject's written consent and say what that consent must contain (Article 7(2)), but none of them requires the operator to make, keep or produce a log or record. Article 27(2)(6), which puts on the operator the burden of proving that consent was obtained, and Article 24(1)(2), which requires measures for the timely detection of unlawful access, sit outside the articles this row cites, so the row states no record duty of its own. Article 3 says which relations the Law governs (collection, processing and protection by operators) and names no territorial hook.
- Kind
- None
- As of
What this law does
Law 519-V regulates the collection, processing and protection of personal information carried out by operators. Article 1 defines the operator as a state body or another legal or physical person that collects, processes and protects personal information and determines the purposes and content of those actions. Article 3 does not apply the Law to collection, processing and protection of personal information by the subject for personal and family needs.
Article 3 also does not apply the Law to personal information classified as a state secret. Article 6 divides personal information by accessibility into publicly available information and restricted-access information. Article 7 requires the operator to collect and process personal information with the subject's written consent, except in the cases provided for by Article 9.
Article 7 sets the content of the subject's written consent, including its period of validity and the procedure for revoking it. Article 7 provides that the operator needs no license, certificate or other permit to collect and process personal information. Article 7 requires employees of operators to notify their supervisors before collection and processing begin. Article 7 bars the operator from concluding a contract that transfers to another person the performance of collection and processing.
Article 8 lets the subject give or withdraw consent in writing, as an electronic document, or by another method that uses protective measures permitted by the legislation of Turkmenistan. Article 8 provides that the subject cannot withdraw consent where that would conflict with the laws of Turkmenistan or where an obligation remains unperformed. Article 9 lists the cases in which personal information is collected and processed without the subject's consent.
Article 14 permits the operator and a third party to use personal information only for the purposes defined when it was collected.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .