UzbekistanLaw on Personal Data, biometric and genetic data
In force since .
A biometric privacy rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes a faceprint, voiceprint, or other biometric or genetic identifier of an Uzbek data subject for identification purposes must have the subject's consent, unless the processing implements an international treaty of Uzbekistan, administers justice or serves enforcement proceedings, or another case provided for by legislation applies. Electronic biometric or genetic data kept outside an information system must be held only on media that exclude unauthorized access.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does the consent requirement in the third part of Article 26 reach biometric or genetic data that an app holds but does not use шахсини аниқлаш учун ("to identify the person")?
- Which other cases does қонунчиликда назарда тутилган бошқа ҳолларда ("in other cases provided for by legislation") in the third part of Article 26 refer to?
What it makes you log
Logging duty
Article 26 defines biometric and genetic data, lets data used to identify the subject be processed only with the subject's consent (with listed exceptions) and requires electronic biometric and genetic data used or kept outside information systems to sit on media that exclude unauthorized access. These are consent and storage-security conditions; no log, register or kept record is required, and no audit or body entitled to a record is named. The localization rule for these data is Article 27-1, coded on its own row. No territorial clause sits in the cited article.
- Kind
- None
- As of
What this law does
Article 26 defines biometric data as personal data characterizing the anatomical and physiological characteristics of the subject, and gives no illustrative list naming face, voice or fingerprint. Article 26 defines genetic data as personal data on the inherited or acquired characteristics of the subject that results from analysis of the subject's biological profile or of another element that yields alternative information.
Biometric and genetic data used to identify the subject may be processed only with the subject's consent, except in cases connected with the implementation of the international treaties of Uzbekistan, the administration of justice and enforcement proceedings, and in other cases provided for by legislation. Electronic biometric and genetic data that are used or stored outside information systems may be held only on material media that exclude unauthorized access to them.
Article 26 sets no retention or destruction period of its own for biometric data, and the grounds for destroying personal data in Article 17 apply, including achievement of the purpose of processing.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .