Written by: Shaxrizoda Mamasoliyeva
Image source: www. getsix-services.eu
June 14, 2021
 

The official website of the United Nations Conference on Trade and Development (UNCTAD) has published a list of governments that have enacted laws to protect personal data. According to it, as of 2021, 128 out of 194 countries have national data protection legislation, which is 66%. Also, while 10 percent of states are on the verge of drafting legislation to protect personal data (draft legislation), the remaining 19 percent are governments that do not have data protection legislation at all. These numbers show that the protection of personal data, the formation of a legal framework for this and the increase of confidentiality are becoming increasingly important around the world.

Due to this urgency, in order to regulate relations in the field of personal data in Uzbekistan, the Law on Personal Data was adopted in 2019. It is shown that new Law applies to the relations arising regardless of the means of processing, including information technology, used in the transmission and protection of information. On the basis of the law adopted on the initiative of the State Center for Personalization under the Cabinet of Ministers on January 14, 2021, Article 27-1 was added to the law with the following content:

Owner and (or) operator in the processing of personal data of citizens of the Republic of Uzbekistan using information technology, including the processing of the Internet in the global information network, their physical means located in the territory of the Republic of Uzbekistan and in the prescribed manner must ensure the collection, systematization and storage of databases in the databases of the person registered in the state register.

What does the introduction of a new norm mean?

According to the Article 27-1, social networks and Internet services are required to store the personal data of Uzbek citizens on servers located in Uzbekistan. In other words, Facebook, Google, Telegram, and other services require the storage of personal data of citizens of Uzbekistan in the territory of Uzbekistan. There is also a view that the entry into force of this norm is nothing more than a certain restriction of freedom of speech and opinion in society, and this blog post will discuss this issue and provide a valid conclusion.

What does the government want to achieve by building data centers on its territory: restricting freedom of speech and expression under the pretext of protecting personal data, or gaining economic benefits? It should be noted that the introduction of Article 27-1 in the legislation and the implementation of this law show that the government has built huge data centers on its territory, which will store information about Internet users, as well as the population. It plans to store personal information in these databases, which can be seen in a number of countries, including the Russian Federation, China and Scandinavian countries.

Facebook has also lamented that storing personal information inside the state is not good for the economy and human rights, that data localization around the world poses a significant threat to users’ privacy, freedom of thought, security and human rights. The Government’s response was that it had studied the experience of a number of foreign countries, including the United States, Europe, Australia, India, Kazakhstan, Indonesia and Turkey, before introducing the article into law. Government officials explained the inclusion of this provision in the legislation as follows:

the government cannot monitor compliance with legal requirements. Even if Uzbek companies store personal information in another country, the government cannot control the implementation of the rules because it does not have the capacity to conduct inspections in another country.

In addition, in order to ensure the collection and storage of personal data of Uzbek citizens on technical devices located in the territory of Uzbekistan, “Facebook Inc.” (Facebook Messenger, Instagram, WhatsApp), Google (Google Messenger, YouTube), Mail.ru (Vkontakte, Odnoklassniki), Microsoft (Skype), Telegram, Tencent (Wechat), TikTok, Twitter, Yandex -mails were sent. In order to ensure new law`s implementation, the Cabinet of Ministers adopted Resolution No. 255 and the Statute as an appendix to it.

Why data localization is everywhere in the world?

Let me discuss pros and cons of data localization and their background. First of all, about positive aspect of data localization.

Firstly, data localization helps store personal information and protect its privacy. In particular, in the Russian Federation (Russia) on September 1, 2015, the rules established by Law FZ-242 came into force, which means that personal data operators process and store Russian personal data using databases located in the territory of the Russia. In other words, it can be seen that foreign companies intend to store personal data in large data centers located in the territory of the Russia. In addition, the Regulation “On localization of certain processes of storage and processing of personal data” in Russia defines the activities of data centers. If we look at the statistics, we can see that the data protection index compiled by EMC: Global Data Protection Index has been published, and the Russia is the 15th in this list. This, of course, indicates that the protection of personal data is sufficiently ensured.

Secondly, data localization gives an economic advantage to Russia and can also be a new growth factor for the IT industry. In particular, the construction of data processing centers (DPC) offering cloud and location services will be a new growth factor for the Russian IT industry, as well as the value of the Russian data centers market in 2019 will increase by 27% year on year. sib is $ 561 million, according to a recent report by market research agency iKS-Consulting. The report also noted that the Russian data centers and cloud services market is showing good performance, with a growth rate of 10% for location services and almost 25% for cloud services. The report also showed that the number of shelves increased by 11% to 43.5 thousand.

Next, about cons of data localization. There are also disadvantages to data localization, which we can see in the following:

Firstly, storing data centers across the country can create a number of barriers and difficulties in online shopping, as well as limited consumer choice. How do you say? In today’s age of technology, online sales of goods and services are becoming increasingly important for commerce on a global scale. If we look at the statistics, in 2019, online sales in the United States amounted to about $ 150 billion, which is 11% of retail sales.  Similarly, 12 percent of global trade in goods is done online.  Not only does data localization affect the commercial flow, but there is also the risk of stopping innovation and preventing the technological advantages of unimpeded data flow. Such requirements can disrupt the Internet and data flow by placing barriers that limit consumer choice, burdening new entrants, and giving up the benefits of free and open Internet. These can be particularly evident in specific areas such as the financial sector.  In addition, the European approach, which includes the General Regulation on Data Protection (GDPR) and localization requirements, creates additional barriers for American technology companies, as well as non-technological companies that use data. It is also causing difficulties for the increase in the number of As a result, protectionist barriers have been created in the country or region that increase the cost of doing business and reduce the benefits of cross-border flows.

Secondly, data localization also implies a partial restriction of freedom of speech and thought. As data shifts to a cloud-based computing system and emerging technologies lead to an increase in connected devices and data, data localization could threaten the spread of the Internet from a single global system to a number of limited regional systems.

When authoritarian regimes make such demands, it restricts the freedom of speech and knowledge exchange supported by the global Internet. In China, for example, there are strict localization requirements, which result in tight government controls and limited access to information that others experience online. Increasing data localization in countries such as China, Vietnam, and Russia may limit free speech and consumer preferences associated with the digital age. Demands for data can occur when the data are much more convenient for an authoritarian regime. In particular, Facebook co-founder and CEO Mark Zuckerberg responded to governments that have built data centers in their territories by saying that such laws are not enforced and that he strongly opposes data localization, which is considered a direct restriction of freedom of speech. While in democracies or fairly governed countries, laws can protect users ’privacy and help governments have more influence over technology companies, in countries where the government can use military force to view data, leads to similar laws. This can help China to increase their observation skills, disrupt activity, or hunt down dissidents.

Thirdly, data localization makes it difficult for innovative products and services to reach other countries. This is because the requirements for local availability or retention of local content increase the costs for small and medium-sized businesses seeking to enter a new market. For example, a 2015 study by Leviathan Security Group found that data localization requirements increase the cost of data deployment by 30-60 percent.

Analysis: Possible repercussions of legal changes on data localization in Uzbekistan

There are the following advantages behind data localization in Uzbekistan:

1. Strengthening the security of personal data storage;

2. Increasing the economic potential of the state;

3. Being a new growth factor for the IT industry in Uzbekistan.

The disadvantages of data Localization for Uzbekistan are:

  1. Storing data centers in the country creates a number of barriers and difficulties in online trading;
  2. Leading to a partial restriction of consumer choice;
  3. Building data centers means restricting certain forms of freedom of speech and opinion on social networks;
  4.  Creating a number of barriers and difficulties in the entry of innovative products and services into other countries.

As far as I think in addition to requiring the Uzbek government to build data centers with huge economic potential, favorable climate conditions, political preparation and communication with major foreign investors and partners, the world community, in particular, large foreign companies, Facebook, Twitter, Yandex, Telegram. Additionally, data localization could lead to authoritarian government restricting Uzbekistan’s political image and freedom of speech and expression. It is true that data localization can help increase Uzbekistan’s economic potential and keep personal data safe inside the country, but building data centers inside the country might lead to some challenges related to cost. 

Cite as: Shaxrizoda Mamasoliyeva, “Data protection in Uzbekistan: challenges and opportunities”, Uzbekistan Law Blog, 14.06.2021