Uzbekistan: State Secrets Exemption under the Law on Personal Data

The State Secrets Exemption in Uzbekistan’s Law on Personal Data specifically excludes the application of the general data protection law to the processing of personal data classified as state secrets. This exemption is critical for maintaining national security by ensuring that such sensitive information is managed under a distinct legal framework, rather than the general data protection regime.

Text of Relevant Provisions

LRU-547 Art.3(2)(3):

"This Law does not apply to relations arising from:processing of personal data related to information constituting state secrets;"

Original (Language):

"Действие настоящего Закона не распространяется на отношения, возникающие при:обработке персональных данных, отнесенных к сведениям, составляющим государственную тайну;"

Analysis of Provisions

• State Secrets Exemption: Article 3(2)(3) of Uzbekistan’s Law on Personal Data explicitly states that the law does not apply to the processing of personal data classified as state secrets. This means that any data that falls under the category of state secrets is governed by separate legislation specifically designed to address national security concerns.
• Legal Framework and Rationale: The rationale behind this exemption is the necessity to safeguard national security by regulating sensitive information under more stringent conditions than those provided by general data protection laws. Personal data that is classified as a state secret often involves matters of national security, and its protection requires adherence to specific rules that go beyond the scope of ordinary personal data protection.
• Scope and Interpretation: This exemption applies exclusively to data officially classified as state secrets. The determination of what constitutes a state secret and the handling of such data are likely governed by the Law of Uzbekistan "On State Secrets." This specialized legal framework ensures that the handling of state secrets is subject to stricter security and confidentiality standards.

Implications

• For Businesses: Companies operating in Uzbekistan need to be particularly cautious when handling data that could potentially be classified as state secrets. Such data is excluded from the general data protection law, meaning that companies must ensure compliance with the specific regulations governing state secrets. Failure to correctly classify and manage such data could result in serious legal and security consequences.
• Compliance Challenges: Organizations must establish robust procedures to identify and segregate data that may be classified as state secrets. This includes maintaining close coordination with national security authorities to ensure that the classification and processing of such data comply with the relevant legal standards specific to state secrets.