UzbekistanLaw on Personal Data, special personal data
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app processing an Uzbek data subject's racial or social-origin, political, religious, ideological, party or trade-union membership, health, private-life, or criminal-record data must not process it unless a case listed in Article 25 applies, such as the subject's written consent (which may be an electronic document), a state-security purpose of the authorized state body, or data the subject has published in publicly available sources.
These lines are LexLint's reading of the law's text. Also read by: Resolution No. 21 of the Plenum of the Supreme Court of the Republic of Uzbekistan, , On the practice of application by courts of the legislation on the protection of personal non-property rights and other intangible benefits (recorded ).
Who enforces it
Settledness
- As of
- Case link
- https://lex.uz/mact/-7901164
- Case citation
- Resolution No. 21 of the Plenum of the Supreme Court of the Republic of Uzbekistan, , On the practice of application by courts of the legislation on the protection of personal non-property rights and other intangible benefits
- Open questions
- Which personal data count as data on шахсий ҳаёт ("private life") among the special personal data in the first part of Article 25, a category Article 4 does not define and Article 25 does not illustrate?
- Does a subject's acceptance of an app's terms by a click or tick meet the requirement of ёзма шаклда, шу жумладан электрон ҳужжат тарзида розилик ("consent in writing, including as an electronic document") for special personal data under the third part of Article 25?
What it makes you log
Logging duty
Article 25 defines special personal data and prohibits processing it except in the listed cases, one of which is the subject's consent given in writing, including as an electronic document. A consent required in writing is a condition of processing and states no record the operator must keep. The article requires no log or register, names no audit and no body entitled to a record. The duty to prove that consent was obtained is in Articles 21 and 31, which this row does not cite. No territorial clause sits in the cited article.
- Kind
- None
- As of
What this law does
Article 25 defines special personal data as data on racial or social origin, political, religious or ideological beliefs, membership of political parties and trade unions, physical or mental health, private life and criminal record. Article 25 prohibits the processing of special personal data except in the cases listed in its third part. The listed cases include processing by the authorized state body to protect state security against external and internal threats.
They include processing where the subject has given consent in writing, including as an electronic document. They include processing of special personal data that the subject has published in publicly available sources. They include processing to protect the rights and legitimate interests of the subject or of other persons. They also include processing by courts and law enforcement bodies in a pending criminal case or enforcement proceeding. Biometric and genetic data are not in the Article 25 list and are governed separately by Article 26.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .