President of Uzbekistan Shavkat Mirziyoyev signed the Personal Data Bill into Law, which was passed by the Legislative Chamber of the Oliy Majlis on April 16 and was approved by the Senate on June 21. The law will take effect on October 1, 2019.

The personal data means data “electronic, paper and (or) other material relating to a specific individual or enabling his identification”.

The processing of personal data includes collection, organize, storing, alteration, supplementing, using, presenting, dissemination, transmission, depersonalization and destroying.

The State Personalization Center under the Cabinet of Ministers has been established as the authority the field of personal data. The authority keeps the State register of personal data bases, issues a certificate of registration of the personal data database in the register and, within its authority, exercises supervision over compliance with the requirements of the legislation on personal data.

The personal data base is formed by collecting personal data necessary and sufficient for the tasks performed by the owner and (or) the controller, as well as by a third party.

Personal data can be used only for the priorly stated purposes of their collection, provided that the necessary level of data security is ensured.

When processing personal data for historical, statistical, sociological, scientific research, the owner and the controller, as well as a third party, are obliged to depersonalize them.

Processing of personal data is carried out only with the consent of the owner to its processing in any form after having received information. If it is necessary to process in order to protect the rights and legitimate interests of the owner, their processing is allowed without his consent until the moment when consent becomes available.

When personal data is added to a database, the owner must be notified in writing of the purpose of processing the data and his rights. In the case of transmission of data to a third party, the controller must notify the subject in writing within three days.

The law prohibits the processing of special personal data - these are data on racial or social origin, political, religious or ideological convictions, membership in political parties and trade unions, as well as data relating to physical or mental health, information about private life and criminal record.

The processing of special personal data is allowed only for the purpose of ensuring state security from external and internal threats by the authorized body, if the entity has agreed in writing to the processing, if the data are published by the entity in publicly available sources, in order to protect the rights and legitimate interests of the entity or other persons and some other cases.

The state guarantees the protection of personal data. The owner and operator, or another person who has obtained access to personal data, must comply with the requirement that their disclosure and dissemination is unacceptable without the consent of the subject or the availability of other legal grounds.

The law does not apply to relationships arising from: the processing of personal data by an individual for personal, domestic purposes and not related to his professional or commercial activity; formation, storage and use of archival documents containing personal data; processing of personal data related to classified information; processing of personal data obtained in the course of investigation, intelligence and counterintelligence activities, the fight against crime, law enforcement, as well as in the framework of countering the legalization of income derived from criminal activities.