Central Bank of Uzbekistan mandates storage of client biometric data exclusively within the country

New rules regarding the storage of biometric data of clients working in the financial sector have come into force in Uzbekistan. The Central Bank board's resolution was officially registered by the Ministry of Justice on August 1 and became mandatory upon its publication.

The new requirements oblige payment system operators, payment service providers, electronic factoring platforms, and credit bureaus to keep biometric information of individuals used for identity verification and client authentication strictly within the territory of Uzbekistan.

However, the legislation allows for the storage and processing of other types of personal data that are not biometric outside the country, provided that the provisions of the third part of Article 27¹ of the 'On Personal Data' Law are observed.

The goal of introducing these norms is to create a unified legal approach to managing biometric information in the financial market, ensure the actual implementation of personal data protection measures, and strengthen cybersecurity and information protection.

The Cabinet of Ministers of Uzbekistan has decided to approve a list of foreign states that guarantee a level of personal data protection comparable to that established in Uzbekistan. This list includes 49 countries and territories, among which are Russia, the USA, Germany, the United Kingdom, Japan, Singapore, and South Korea.

The adopted resolution aims to create a unified procedure for the cross-border transfer of personal data. Now, personal and anonymized information can be automatically transferred to states included in the approved list using information systems based on international agreements. In this case, the operator is not required to obtain additional permits or notify the authorized body, but they must guarantee the protection of data against any leaks.

For data transfers to jurisdictions not included in this list, stricter requirements will apply. Such transfers are permissible only if the legal, organizational, and technical conditions established by the authorized body are met.

In the event of a personal data leak during cross-border transfer, the database operator must notify the authorized body within one day of discovering the incident. Furthermore, detailed information about the causes of the incident and the measures taken must be provided within the following 72 hours.

Additionally, the Ministry of Internal Affairs, together with other agencies, must develop requirements for standard contractual terms and corporate data protection rules when sending data to countries not included in the list. Concurrently, the Ministry of Foreign Affairs has been instructed to prepare proposals for Uzbekistan's accession to the Council of Europe Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data, as well as for including the country in relevant international registries.

The approved list includes states such as Austria, Andorra, Argentina, Belgium, Bulgaria, Brazil, Hungary, Hong Kong, Greece, Denmark, Spain, Iceland, Italy, Canada, Cyprus, Latvia, Lithuania, Liechtenstein, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Slovakia, Slovenia, Uruguay, Faroe Islands, Finland, France, Croatia, Czechia, Switzerland, Sweden, Estonia, New Zealand, as well as the previously mentioned countries.

It is important to note that for the USA, this decision applies exclusively to companies participating in the EU–US Data Privacy Framework program. Previously, in February, the Senate of the Oliy Majlis approved amendments to the 'Personal Data Law,' which removed major obstacles to the functioning of PayPal and other global digital payment systems in Uzbekistan, laying the foundation for freelancers to legally earn income and for the country to integrate into the global digital economy.

Uzbekistan has updated the digital security certificates used in biometric passports by integrating changes into the International Civil Aviation Organization system.

Goals of the System Update

This update is designed to facilitate faster document control at border crossings and reduce the likelihood of technical issues when scanning these passports outside the country, thereby enhancing overall travel security for citizens.

Delegation Visit and Technical Details

A delegation from the Personalization Center, which is part of the Ministry of Internal Affairs of Uzbekistan's Migration and Personalization Department, traveled to the headquarters of the International Civil Aviation Organization located in Montreal, Canada, on July 21. During this visit, specialists modernized crucial digital certificates that ensure the protection of biometric passports.

The update concerned the PKI system—Public Key Infrastructure—as well as the international ICAO PKD registry, which serves as a channel for information exchange between states for the verification of electronic documents. All completed work complies with the requirements of ICAO standard Doc 9303.

Results and Benefits for Citizens

Upon completion of the process, the certificates gained automatic availability for all countries that are participants in the ICAO PKD system. This guarantees that border services of various countries can promptly and without failures verify the authenticity of Uzbek biometric passports. Representatives of the Ministry of Internal Affairs emphasized that this work will strengthen the integrity of the information contained in the documents, increase their security, and make citizens' foreign travels more comfortable and safe.