Turkmenistan

Biometric data sits outside the Art. 21 special-category list and is instead governed by three scattered provisions. Art. 1(1) defines it generally, with no illustrative list: information characterizing the physiological and biological features of a person and permitting establishment of the identity of the person. Art. 11(2) makes biometric data, along with data held in electronic information resources generally, automatically confidential and limited to the purpose for which it was collected.

Art. 7(7) defers the specifics of biometric information collection and processing entirely to unnamed other Turkmen legislation, the same deferral pattern this batch also finds word for word in Kazakhstan's Art. 11(3) and Tajikistan's Art. 11.

Law No. 519-V applies to the operator, defined broadly to include state bodies and other legal or physical persons collecting, processing, or protecting personal information, and to the third party.

Art. 7 requires the subject's written consent for collection and processing, bars purpose expansion without further consent, requires no license or permit of the operator, requires operator staff to notify their supervisors before beginning collection or processing, and bars an operator from subcontracting collection or processing duties by contract, a restriction not seen elsewhere in this batch.

Art. 8 sets consent form requirements (written, electronic document, or another compatible method) and a revocation right, subject to exceptions not fully extracted. Art. 6 splits personal information into publicly available and restricted-access categories by accessibility.

Art. 12(2) is an unconditional domestic-storage duty, with no citizen-only qualifier and no sectoral limitation: storage of personal information is carried out in a database of personal information located in the territory of Turkmenistan. Art. 17, read in full, makes the domestic database an explicit precondition for any transfer, not merely an alternative to it: personal information is subject to cross-border transfer only where it is contained in a database located in Turkmenistan.

Transfer to a state ensuring protection is then permitted; where the destination does not, transfer may still occur on written subject consent, a ratified treaty, statutory necessity, or protection of vital interests or constitutional rights where consent cannot be obtained. No enforcement history for either duty was found; secondary reporting describes practical enforcement of this Act generally as essentially nonexistent.

Art. 28(2), read in extract, gives the Cabinet of Ministers of Turkmenistan only a discretionary power ("may," not "shall" or "must") to establish an authorized body for the protection of subjects' rights and determine its status and powers; no located source confirms that power has ever been exercised.

Absent that, Art. 29 assigns generic state bodies, within their existing competence, the powers to draft implementing regulations, hear complaints, and take measures to hold violators liable as established by other Turkmen law. Art. 31, read in full, is a single bare sentence naming no fine schedule, no authority, and no private cause of action. Art. 32 provides that disputes are resolved in the manner established by Turkmen legislation, again naming no forum.

Secondary reporting describes the Cabinet of Ministers and the Prosecutor General's Office as the de facto oversight bodies, with penalties described as very low and practical enforcement as essentially nonexistent, the weakest data-protection framework reported among the Central Asian states in this batch.

Art. 21, read in full, prohibits by default processing data concerning nationality, skin color, attitude toward religion, political convictions, state of health, or intimate life.

The prohibition lifts for written subject consent, publicly available data, health necessity to protect vital interests where consent is unobtainable, medical purposes by a professional bound to confidentiality, processing by an association or religious organization of its own members' data, necessity for the administration of justice, or operational-investigative activity and criminal-sentence enforcement.

Biometric data is not among the Art. 21 categories; it is governed separately, see the biometric_privacy instrument for this jurisdiction.

Article 379(1) punishes the unlawful destruction of legally protected information in an information system or passing through an information-telecommunication network, the creation of a computer program intended to disrupt the normal operation of a computer, a subscriber device, another computer program, an information system, or an information-telecommunication network, and, separately, the production of, or unauthorized alteration, blocking, reformatting, or copying of, such information or software, along with the deliberate use or distribution of a program built for that purpose.

Article 379(2) raises the penalty where the act targets a national information source, the national information system, or a critically important information-communication infrastructure object, or is committed using one's official position. Article 379(3) raises it further where the acts caused grave consequences or were committed by a group by prior conspiracy or an organized group.

Article 373(1) punishes illegal access to information stored on electronic media and protected by law, to an information system, or to an information-telecommunication network, where the access substantially violates the rights or legitimate interests of a person or the protected interests of society or the state.

Article 373(2) raises the penalty where the same acts target sources of national electronic information, the national information system, or important information-communication infrastructure objects. Article 373(3) raises it further where either act negligently caused grave consequences or was committed by a group by prior conspiracy or an organized group.

A communications operator (a category that under this Act may be a state entity or a legal or natural person) must implement technical and organizational methods to protect communication networks, telecommunications facilities, restricted-access information about the organization of communication networks, and information transmitted by those networks.

The operator must, together with law-enforcement bodies, protect communication facilities and structures from unauthorized access, and a developer building or reconstructing communication facilities must likewise provide for protection against unauthorized access. Separately, a communications operator must ensure and bear responsibility for the safekeeping of subscriber information obtained on contracting and about services rendered, including duration, content, and routing.

The operator must also protect that information during automated processing. The Ministry of Communications of Turkmenistan exercises general regulatory and licensing authority over the sector, including, by its own Art. 8(1)(11), licensing of activity in the field of communications and cybersecurity, though no separate implementing act setting cybersecurity licensing requirements was located.

Neither Art. 18 nor Art. 43 states a fixed penalty; a violation carries liability under other Turkmenistan legislation the Act does not itself quantify.

A possessor of information (defined to include the state and any natural or legal person of Turkmenistan) and an operator of an information system must, in cases established by Turkmenistan legislation, maintain safeguards that prevent unauthorized access to information and its transfer to a person without a right of access.

The same duty requires the possessor or operator to detect unauthorized access in a timely manner, prevent adverse consequences of a breach of access procedure, prevent disruption of the technical means that process the information, permit immediate restoration of information altered or destroyed through unauthorized access, and continuously monitor the level of the information's protection.

The Act does not itself identify which other legislation triggers this duty for a given information holder outside the state-information-system context it separately regulates. A person whose rights were violated by disclosure or other unlawful use of restricted-access information may sue for damages, moral-harm compensation, and vindication of honor and dignity, though that claim is barred against a plaintiff who did not itself meet its own confidentiality or protection obligations.

Violation of the Act's requirements carries liability under other Turkmenistan legislation, which this Act does not itself quantify.

Article 7 lists reports of events and facts of an informational character among the categories not protected by copyright, alongside official documents, state symbols, and folklore, so news of the day as such is never a protected work under Turkmenistan's law.

Article 19(1) permits quotation in the original or in translation from lawfully published works for scientific, research, polemical, critical, and informational purposes, to the extent justified by the purpose of the quotation, and expressly includes reproducing excerpts from newspaper and magazine articles in the form of press reviews; the exception carries no headline-length or short-extract cap distinct from that purpose test.

Article 19(3) separately permits reproducing, in periodicals, or communicating by broadcast or cable, lawfully published newspaper and magazine articles on current economic, political, social, or religious topics, or broadcast works of a similar character, unless the author or other rightholder has specifically prohibited that reproduction or communication; this reservation right is the closest Turkmenistan's law comes to a publisher opt-out, and it attaches to the author or rightholder rather than to a press-industry body.

No primary source located states a day-precise commencement date for this Law beyond its own Art. 33's entry into force upon official publication.