1. Governing Texts

Data protection legislation in Uzbekistan affects a number of spheres, including that of the medicine and pharmaceutical industry. This means that there is an overlap between general privacy and data protection legislation and pharmaceutical regulation. For instance, the notion of special or sensitive personal data and that of medical secrecy both cover information concerning the physical or mental health of an individual.

1.1. Legislation

• Criminal Code of the Republic of Uzbekistan of 22 September 1994 No. 2012-XII (as amended) (only available in Uzbek and Russian here) ('the Criminal Code')
• Administrative Responsibility Code of Uzbekistan of 22 September 1994 No. 2015-XII (as amended) (only available in Uzbek and Russian here) ('the Administrative Code')
• Law of the Republic of Uzbekistan on Personal Data of 3 July 2019 No. ZRU-547 (only available in Uzbek and Russian here) ('the Law on Personal Data')
• Law of the Republic of Uzbekistan on Health of Citizens of 29 August 1996 No. 265-I (only available in Uzbek and Russian here) ('the Law on Protection of Public Health')
• Law of the Republic of Uzbekistan on Amendments and Additions to the Law of the Republic of Uzbekistan on Medicines and Pharmaceutical Activities of 4 January 2016 No. ZRU-399 (only available in Uzbek and Russian here) ('the Law on Drugs and Pharmaceutical Activities')
• Presidential Decree on Comprehensive Measures to Radically Improve the Healthcare System of the Republic of Uzbekistan of 7 December 2018 No. UP-5590 (only available in Russian and Uzbek here) ('Decree No. UP-5590')
• Decree of the Cabinet of Ministers of the Republic of Uzbekistan on the Approval of the Regulation for State Registration of Drugs, Medical Devices, and Medical Equipment and the Issuance of a Registration Certificate of 23 March 2018 No. 213 (only available in Uzbek and Russian here) ('Decree No. 213')
• Decree of the President of the Republic of Uzbekistan on Additional Measures to Deepen Reforms in the Pharmaceutical Industry of the Republic of Uzbekistan of 30 December 2019 No. PP-4554 (only available in Russian and Uzbek here) ('Decree No. PP-4554')
• Decree of the Cabinet of Ministers of the Republic of Uzbekistan on Approval of the Regulation on the State Register of Databases of Personal Databases of 8 February 2020 No. 71 (only available in Uzbek and Russian here)
• Resolution of Cabinet of Ministers of the Republic of Uzbekistan on Additional Measures for the Implementation of the Law of the Republic of Uzbekistan on the Donorship of Blood and its Components of 27 November 2014 No. 324 (only available in Uzbek and Russian here) ('Resolution No. 324')
• Regulation on Procedure of Conducting Clinical Trials of Pharmacological Products and Drugs and Expertise of Materials of the Clinical Trials approved by the Order of the Minister of Health of the Republic of Uzbekistan of 29 May 2018 No. 343 (only available in Russia here) ('the Regulation on Clinical Trials')
• Regulation on the Procedure for Informing Identified Adverse Reactions When Using Drugs of 16 April 2018 No. 3000 (only available in Uzbek and Russian here) ('the Regulation on Adverse Reactions')

1.2. Supervisory authorities

The Cabinet of Ministers of the Republic of Uzbekistan ('the Cabinet of Ministers') pass regulation in the field of personal data protection and ensures the implementation of a unified policy in the field of medicine and pharmaceutical activities. For example, the Cabinet of Ministers determines the procedure for maintaining the state register of databases containing personal data, approves the procedure for registering databases in the state register of databases containing personal data, approves state programs in the field of medicine and pharmaceutical activities and monitors their implementation, and determines the procedure for state registration of drugs, medical devices, and medical equipment.

The State Personalisation Center under the Cabinet of Ministers is an authorised state body in the field of personal data which approves the standard guidelines for processing personal data, approves the standard guidelines for activities involving the processing of personal data, and maintains the state register of databases containing personal data.

The Ministry of Health of the Republic of Uzbekistan ('the Ministry of Health') is the central governmental body for healthcare, which participates in the development and implementation of government programs in the field of drugs and pharmaceutical activities and which is responsible for licensing pharmaceutical activities and the state registration and quality control of medical devices and equipment.

The State Center for Examination and Standardisation of Drugs, Medical Devices, and Medical Equipment Agencies for the Development of the Pharmaceutical Industry under the Ministry of Health of the Republic of Uzbekistan ('the State Center') is a working body specialised in state registration, quality control, standardisation, and certification of drugs, medical devices, and medical equipment. The Pharmacological Committee is a subdivision of the State Center.

1.3. Guidelines

Not applicable.

1.4. Definitions

Biometric data: personal data that characterise the anatomical and physiological features of a person, on the basis of which their personality can be identified.

Genetic data: data related to the inherited or acquired characteristics of the data subject, which are the result of the screening of a biological sample of a subject or the screening of another element that allows obtaining equivalent information.

Operator of database: a state body, an individual, and/or legal entity that processes personal data.

Owner of database: a state body, an individual, and/or legal entity having the right to own, use, and dispose a database containing personal data.

Personal data: information recorded on electronic, paper, and/or other material carrier, relating to a specific individual or enabling to identify him.

Special personal data (sensitive personal data): data on racial or ethnic origin, political, religious, or ideological convictions, membership in political parties and trade unions, as well as data relating to physical or mental health, data on private life, and criminal past.

2. Clinical Research and Clinical Trials

The procedure of the conduct of clinical trials is primarily governed by the Regulation on Clinical Trials. Under Decree No. 213 and the Regulation on Clinical Trials, the FC is an authorised state body for the conduct and control of clinical trials. Hence, a decision on conducting clinical trials of pharmacological products and drugs is made by the Pharmacological Committee.

A party applying for the conduct of the clinical trials, after receiving a positive decision from the Pharmacological Committee, submits to the Pharmacological Committee all the relevant materials of a clinical trial for the expertise including but not limited to the information sheet on the clinical trial for a patient and the form of written consent of patients for participation in the clinical trial. The submitted materials are also examined by the Committee on Ethics.

Subject to the examination and approval of the clinical trial materials by the Pharmacological Committee and Committee on Ethics in several stages, permission to conduct clinical trials will be granted. It should also be noted that conducting clinical trials is permissible in the case of scientific research and clinical institutes, the list of which is approved by the Ministry of Health.

During the clinical trial, researchers must provide information to the Pharmacological Committee and Committee on Ethics about all the serious and unforeseen adverse effects that are identified during the clinical trial.

2.1. Data collection and retention

The Law on Personal Data provides for a broad definition of personal data and categorises it as information recorded electronically or on paper and/or any other material means, relating to a specific individual or enabling their identification. Processing of sensitive data of patients shall be carried out in accordance with rules provided for by the Law on Personal Data.

In accordance with the Law on Personal Data, processing of personal data covers certain actions, including collection and retention. Processing of personal data as well as sensitive personal data can be carried out in the following cases, among others:

• where the data subject has consented to processing of their personal data;
• where the processing of personal data is required to fulfil an agreement to which the data subject is a party, or to take measures at the request of the entity before concluding such an agreement;
• where the processing is required to meet the legal obligations of the owner and/or the operator as defined by the legislation;
• where the processing is required to protect the legitimate interests of the data subject or another person;
• where the processing is required in order to exercise the rights and legitimate interests of the owner and/or operator or a third party or in order to achieve socially significant goals, provided that this does not violate the rights and legitimate interests of personal data subjects;
• where the processing is carried out for statistical or other research purposes, subject to the mandatory depersonalisation of personal data;
• where the processing is carried out at the time of the provision of medical and social services, provision of treatment, or in establishing a medical diagnosis, provided that such data is processed by a medical professional or another person of the healthcare institution who is responsible for ensuring the protection of personal data; and
• where special personal data is made publicly available by the subject.

The personal data must be stored in a form that allows for the identification of the subject only to the extent that is required for the applicable purpose at the time of collection. The storage period for personal data is limited to the date on which the purposes of its collection and processing is achieved. Personal data shall be destroyed by the owner and/or the operator or third party upon achieving the purpose of processing, upon withdrawal of the consent of the data subject to the processing, or upon the expiration of the terms of the data processing determined by the consent of the data subject.

2.2. Consent

The participation of an individual in a clinical trial is subject to their written voluntary consent given after being fully informed as to the essence and possible consequences of the clinical trial, the features of the pharmacological products and drugs, its expected effectiveness, and the degree of risk involved.

In case the participants in a trial are minors or other individuals lacking capacity, written voluntary consent must instead be obtained from their parents or other legal representatives before involving them in clinical trials.

Under the applicable legislation, it is envisaged that a patient can withdraw their consent without explaining the reasons at any time during the clinical trial.

However, the law does not provide for any specific requirements as to the processing of personal data during clinical trials. Therefore, the general rules set out by the Law on Personal Data together with the legislation on clinical trials will be applicable. Pursuant to the Law on Personal Data, processing of sensitive personal data can be carried out in limited circumstances, including where the written consent of the data subject is provided. The written consent for the processing of sensitive personal data shall be in hardcopy or in the form of an electronic document.

For the processing of personal data of minors, consent in writing, including in the form of an electronic document, shall be given by parents/guardians or, in case of their absence, guardianship authorities.

2.3. Data obtained from third parties

The Law on Personal Data is silent as to the rules on obtaining data from someone other than a data subject (i.e. third parties). However, the Law on Personal Data does state that the procedure for providing information regarding the processing of personal data of the subject by a third party is determined by the conditions of the consent provided by the data subject for the processing of their personal data. In the case of a transfer of personal data to a third party, the owner and/or the operator must notify the data subject in writing within three days of the transfer.

With regards to the medical secrets, these can be obtained from third parties on legal grounds as detailed in the section on Biobanking below.

3. Pharmacovigilance

Under Decree No. 213, pharmacovigilance activities are vested with the Pharmacological Committee.

Under the Regulation on Adverse Reactions, medical institutions, pharmacies, and organisations producing, selling, and using drugs are required to inform the Ministry of Health in writing of all cases of adverse reactions in the form of a notification. Generally, the notification should contain the following:

• information on the patient (e.g. full name and age);
• information on the drug (e.g. name, application instructions, adverse effects, and actions taken to prevent them); and
• information on the person that examined the adverse effect.

In the event of the establishment of evidence of non-compliance with the established safety and efficacy requirements for the applicable drug, the Ministry of Health may consider the possibility of withdrawing a drug from circulation or suspending its use.

In addition, pharmacovigilance is also carried out during the examination of an application for the registration of drugs and the relevant attached documents to such applications. During this process, the Pharmacological Committee examines the administrative, pharmacological, toxicological, and clinical parts of the documentation, examines and re-examines the relevant documents with the involvement of independent experts, and makes a decision on conducting clinical trials on humans. The information provided for the examination must be kept confidential by all the relevant state bodies involved in the process.

Under the relevant regulations, there is a retention period of at least 15 years for data gathered before and during clinical trials which applies to both the institute conducting the clinical trial and the party applying for this trial to be conducted and which covers, among other things, the assessment results of the provided documentation, forms of written consent from patients participating in the trial, and a final report on the clinical trial signed by the heads of the trial and the clinical institution.

Moreover, under Decree No. PP-4554, the Concept for the Development of the Pharmaceutical Industry of the Republic of Uzbekistan in 2020-2024 has also been approved, which, inter alia, provides for the phased implementation of the requirements of Good Vigilance Practices ('GVP'), as well as Good Laboratory Practices ('GLP'), and Good Clinical Practices ('GCP').

4. Biobanking

Currently, biobanking is one of the least regulated medical activities in Uzbekistan. However, Uzbek legislation provides for the regulations focusing on the donation of blood and its components and their storage.

Collection, preparation, processing, and storage of blood and its components is carried out by blood service consisting of specialised medical entities of the government healthcare system of the Republic of Uzbekistan.

Although there are no detailed rules for the storage of blood and its components, there exist general conditions applicable to its transportation.

According to Resolution No. 324, the decision regarding transportation is made after blood and its components are documented, and if the following have been completed:

• identification of blood and its components;
• a study of blood samples and samples of its components on transfusion-transmitted infections; and
• an inspection of the external condition, the integrity of the packaging, and registered data regarding the storage of blood and its components.

Uzbek legislation does not set any specific regulation on data management in the process of blood donation. Thus, the rules established by the Law on Personal Data shall govern the data management and protection.

5. Data Management

The Law on Personal Data does not provide for the term 'controller', instead of using the concepts of the owner and the operator and providing for the following obligations on the same:

• to comply with personal data legislation;
• to provide upon request of the data subject information regarding the processing of their personal data;
• to approve the content of personal data necessary and sufficient for the performance of their tasks;
• to take measures to destroy personal data once the purpose of the processing has been achieved, as well as in other cases provided by the Law on Personal Data;
• to provide evidence of the consent of the data subject to the processing of their personal data in instances stipulated by law;
• to temporarily suspend processing or destroy personal data if there is information as to a violation of the conditions for the processing;
• to notify in writing the data subject, as well as other participants in the processing of personal data in instances of changes, destruction of personal data, and restrictions on access to data;
• to notify in writing the data subject in instances of the transfer of their personal data to a third party;
• to register owned and/or processed personal databases; and
• to take the necessary legal, organisational, and technical measures to protect personal data.

Obligations in respect of disclosure of records to other medical professionals (e.g. individuals' General Practitioners) or to family members/representatives

The provision of information subject to medical secrecy without the consent of a citizen or his legal representative is allowed in the following cases:

• when it is required in order to medically examine and treat a citizen who is not able, due to their condition, to express their own will;
• if there is the threat of the spread of infectious diseases, mass poisoning, and injuries;
• when at the request of the bodies of investigation, the prosecutor's office, and the court in connection with the investigation or trial;
• when required in order to assist a minor under the age of 14 in order to inform their parents or legal representatives; and
• if there are grounds to believe that damage to the health of a citizen will be caused as a result of illegal actions or an accident.

Data security requirements

The owner and/or the operator or other person who has gained access to personal data will be obliged to comply with the requirement against disclosing and distributing personal data without a valid legal ground to do so (e.g. the consent of the data subject to such disclosure and distribution).

Anonymisation/pseudonymisation

The Law on Personal Data does not use the terms 'anonymisation' or 'pseudonymisation.' However, it does provide for the concept of 'depersonalisation'. The depersonalisation of personal data is an action that makes the determination of the data subject impossible. When processing personal data for historical, statistical, sociological, or scientific research, the owner and the operator, as well as third parties, are required to depersonalise such data.

Data Protection Officer requirements

The Law on Personal Data stipulates that the owner and/or the operator shall appoint the structural unit or official responsible for the work related to the processing and protection of personal data, and ensures its work is in accordance with the standard guidelines for processing personal data.

6. Outsourcing

Pursuant to the Law on Personal Data, the owner and/or the operator are entitled to assign the processing of personal data to a third party in the following cases, among others:

• where the data subject has consented to such assignment in writing; and
• where the decision on such assignment is made pursuant to the fulfilment of contractual obligations between the owner and the data subject or fulfilment of the terms of a previously concluded agreement.

7. Data Transfers

Pursuant to the Law on Personal Data, cross-border transfers of personal data may be carried out when the foreign state ensures adequate protection of rights of the individuals whose personal data is to be transferred. In the absence of such a level of protection, the cross-border transfer of personal data is allowed, inter alia, if the individual has consented to the cross-border transfer of their personal data. However, in relation to data relating to medical secrets, these should be transferred only after obtaining the written consent of the data subject.

8. Breach Notification

Uzbek law is silent on the procedure for notifying data subjects as to breaches affecting them. Relevant requirements on breach notification may be provided for by specific agreements between the data subject and the owner and/or the operator.

9. Data Subject Rights

According to the Law on Personal Data, data subjects have the following rights:

• the right to be aware of the fact that the owner and/or the operator, as well as any third parties, have in possession the data subject's personal data and the composition of such data;
• the right to receive, upon request, information on the processing of personal data from the owner and/or the operator;
• the right to receive information on the conditions for providing access to their personal data from the owner and/or the operator;
• the right to apply for protection of rights and legitimate interests in relation to their personal data to an authorised state body or court;
• the right to give consent to the processing of their personal data and withdraw such consent, except as otherwise provided by the Law on Personal Data;
• the right to give consent to the owner and/or the operator, as well as to a third party, to distribute their personal data to publicly available sources of personal data;
• the right to require the owner and/or the operator to temporarily suspend the processing of their personal data in the event where the personal data is incomplete, outdated, inaccurate, illegally obtained, or is not necessary for the purpose of processing.

The personal data of the subject recognised as disabled or partially incapacitated shall be disposed of by its legal representative.

In the event of the death of the data subject, consent to the processing of their personal data in writing, including in the form of an electronic document, is given by their heirs, if such consent was not previously given by the data subject during their lifetime.

10. Penalties

The Law on amendments and additions to some regulatory acts of the Republic of Uzbekistan No. ЗРУ-726, dated 29 October 2021 (only available in Uzbek here) ('the Law on Amendments') introduces new administrative and criminal sanctions for violation of personal data protection laws.

Accordingly, illegal collection, systematisation, storage, modification, addition, use, provision, distribution, transfer, depersonalisation, and destruction of personal data, as well as non-compliance with the requirements for the collection, systematisation, and storage of personal data when processing personal data of Uzbek citizens using information technologies, including the internet, on technical means located on the territory of Uzbekistan, and in databases registered in the State register of personal data databases, will entail a fine in the amount of 7 basic calculation values (approx. €155) for individuals, and 50 basic calculation values (approx. €1,110) for officials.

The wrongdoings listed above, committed after application of administrative fines, will entail:

• a fine in the amount from 100 to 150 basic calculation values (approx. €2,210 to €3,315);
• deprivation of a certain right for up to three years; or
• correctional labour for up to two years.

The same wrongdoings committed by prior agreement by group of persons, or repeatedly or by a dangerous recidivist, or committed from mercenary or other vile motives, or entailing grave consequences, or committed using official position entail:

• a fine from 150 to 200 basic calculation values (approx. € 3,315 to €4,420);
• correctional labour from two to three years;
• custodial restraint from one to three years; or
• imprisonment for up to three years.

These Amendments came into force following a three-month period after publication of the Law on Amendments, which was published on 29 October 2021.

11. Other Areas of Interest

According to the Concept of Development of Healthcare System of Uzbekistan for 2019-2025 which was approved by Decree No. UP-5590, the following targeted primary innovations related to data management have been envisaged:

• implementation of an 'e-healthcare' system, creating a complex information system and databases integrated under unified national standards which facilitate the optimisation of work processes by introducing digital document management (i.e. digital health records and electronic prescriptions); and
• development in the field of telemedicine within the healthcare institutions to promote the exchange of information between medical organisations and the conduction of long-distance medical and educational services (i.e. consultations, operations, and master classes).

Anora Turakhujaeva Senior Associate
[email protected]
Parvina Bashirova Associate
[email protected]
Dilorom Yuldasheva Counsel
[email protected]
GRATA Law Firm LLP, Tashkent