Server room data center

Developments in the field of protection of personal data

22 Dec 2021
Subject Tax Alert
Categories Law
Jurisdictions Uzbekistan

Currently, the Republic of Uzbekistan ("Uzbekistan") is working on the phased implementation of an effective mechanism for the protection of personal data. In particular, administrative and criminal liability measures have recently been tightened in Uzbekistan for violations related to personal data.[1] In this issue of the newsletter, we review the key new amendments concerning personal data protection.

On January 30, 2022, enhanced measures to hold persons liable when they violate personal data legislation will come into force.

Administrative liability

Article 46(2) of the Code of Administrative Liability lists the following as administrative offences: 

  • illegal collection, systematization, storage, amendment, supplementing, usage, provision, dissemination, transfer, depersonalization and destruction of personal data;
  • failure to comply with the requirement that technical media containing a database of personal data be physically located and registered in Uzbekistan.

This offense is punishable by a fine of 7 specified base values (the "SBV")[2] (equivalent to USD 175) for individuals and 50 SBV (equivalent to USD 1,250) for officials.

Criminal liability

Article 141(2) of the Criminal Code of Uzbekistan provides that, in order for criminal liability for a violation of personal data legislation to apply, an individual must have previously been held administratively liable for the same actions.

Criminal punishment for this offence consists of:

  • a fine of 100 to 150 SBV (equivalent to USD 2,500-3,750); or
  • deprivation of a right for up to 3 years (e.g., the Company's website may be blocked, slowed down or otherwise restricted within Uzbekistan); or
  • correctional labor for up to 2 years

If these actions are committed with aggravating circumstances, namely:

a) by conspiracy
b) repeatedly or by a dangerous repeat offender
c) out of selfish or other base motives
d) using one’s official position; or
e) entailing grave consequences

then the law provides for punishment in the form of:

  • a fine of 150 to 200 SBV (equivalent to USD 3,750-5,000); or
  • correctional labor from 2 to 3 years; or
  • restriction of liberty from 1 to 3 years or imprisonment for up to 3 years

Due to the tightening of liability for personal data–related violations, we once again recommend assessing the compliance of your company’s personal data–related processes in the following key areas:

  1. A detailed list of personal data processed by the company
  2. Storage of personal data of Uzbek citizens in Uzbekistan
  3. A detailed procedure for the receipt, transfer (both domestic and international), storage, and destruction of personal data
  4. A list of persons (i) having access to personal data, (ii) responsible for the registration of personal data databases, and (iii) responsible for working with personal data within the company

These aspects require that a set of local company documents be prepared, including orders, policies and procedures.

The EY team can assist both in preparing such documentation and in verifying its compliance with the requirements of legislation.

 

[1] Law of Uzbekistan No. ZRU-726, dated October 29, 2021.

[2] As of the date of publication of this alert, an SBV is equivalent to 270,000 soums (~$25).

 

Authors:
Dinara Tanasheva
Aziza Sharipova
Oydin Kattakhodjaeva