Uzbekistan's Law on Personal Data (LRU-547) explicitly excludes data processing activities related to national security, law enforcement, and related areas from its scope of application.

Text of Relevant Provisions

LRU-547 Art.3(2)(4):

*"This Law does not apply to relations arising from:

processing of personal data obtained in the course of operational-search, intelligence and counter-intelligence activities, combating crime, law enforcement, as well as in the framework of counteracting the legalization of proceeds of crime."*

Original (Uzbek):

"Ushbu Qonun: operativ-qidiruv faoliyati, razvedka va kontrrazvedka faoliyati, jinoyatchilikka qarshi kurashish, huquqni muhofaza qilish faoliyati jarayonida, shuningdek jinoiy faoliyatdan olingan daromadlarni legallashtirishga qarshi kurashish doirasida olingan shaxsga doir ma'lumotlarni qayta ishlash bilan bog'liq munosabatlarga nisbatan tatbiq etilmaydi."

Analysis of Provisions

Article 3 of LRU-547 defines the law's scope of application. While the law generally applies to personal data processing, Article 3(2) lists specific exceptions. Notably, Article 3(2)(4) exempts the processing of personal data obtained during activities related to:

• Operational-search activities: This broadly encompasses investigative activities carried out by law enforcement and security agencies.
• Intelligence and counter-intelligence activities: This includes gathering and analyzing information related to national security threats.
• Combating crime: This covers a wide range of activities aimed at preventing and investigating criminal offenses.
• Law enforcement: This refers to the activities of agencies responsible for enforcing laws and maintaining public order.
• Counteracting the legalization of proceeds of crime: This involves activities aimed at preventing money laundering and terrorist financing.

The rationale for this exemption is to avoid hindering the State's ability to effectively perform functions related to national security, law enforcement, and crime prevention. These activities often involve processing personal data, and subjecting such processing to the full scope of data protection regulations could potentially compromise investigations, intelligence gathering, or law enforcement operations.

However, it is important to note that the exemption in Article 3(2)(4) applies only to data processing activities directly linked to the specified purposes. Any processing of personal data beyond these purposes, even by the same entities, would still fall under the purview of the Uzbekistan Law on Personal Data.

Implications

The exemption for national security and law enforcement activities has significant implications:

• Broad scope: The exemption is phrased broadly, potentially encompassing a wide range of data processing activities by various state agencies.
• Lack of specific safeguards: The law does not explicitly mandate specific safeguards or oversight mechanisms for data processing activities falling under this exemption.
• Potential for abuse: The broad and unqualified nature of the exemption raises concerns about potential abuse and lack of accountability in the processing of personal data for national security and law enforcement purposes.
• Impact on data subject rights: Individuals whose data is processed under this exemption may have limited or no recourse to exercise their data subject rights under the law.
• Limited guidance for businesses: The law provides limited guidance for businesses that may be involved in data processing activities related to national security or law enforcement, potentially leading to uncertainty regarding compliance obligations.