Video surveillance and personal data: where the archive may legally be stored

The Law of the Republic of Uzbekistan «On Personal Data» No. ZRU-547 of 2 July 2019 defines personal data as information recorded on an electronic, paper or other medium that relates to a specific individual or makes it possible to identify them. The phrase «makes it possible to identify» is the key: a recording in which a person's face is distinguishable falls under that definition.

From this follows a conclusion many find unexpected: an ordinary office recorder is a personal data database, and the company that installed and configured it for itself acts as the operator, with all the duties that people tend not to consider until the first inspection or complaint.

The law singles out biometric data: personal data characterising the anatomical and physiological features of the subject. Face recognition at a turnstile, a fingerprint on a time-attendance terminal, an iris template — all of it is biometrics in the legal sense, not merely «a convenient way to open a door».

The difference is practical. An access card is impersonal: lose it and you are issued another. A biometric template cannot be changed, and a leak of such a database is irreversible. That is precisely why the law places separate requirements on processing biometric data, and why a face recognition terminal should not be installed simply because it is available.

This is the part that decides equipment choice. The law was supplemented with Article 27-1 on special conditions for processing the personal data of citizens of the Republic of Uzbekistan. Under it, when processing the personal data of the republic's citizens using information technologies, including over the internet, the owner or operator must ensure their collection, systematisation and storage in personal data databases on technical facilities physically located in the territory of the Republic of Uzbekistan and registered in the established manner in the State Register of Personal Data Databases.

The authorised state body in this area is the State Personalisation Centre under the Cabinet of Ministers. It maintains the State Register of Personal Data Databases, issues the certificate of registration of a database and, within its powers, oversees compliance with the legislation.

The mass-market cloud services offered by camera manufacturers are convenient: mount the camera, link it to the app, watch from anywhere. The question is where the recording physically resides. If the system identifies citizens of Uzbekistan while the server sits outside the republic, the arrangement runs against the requirement to keep the database within the country.

Hence our engineering position, which we explain to every client: a local recorder or an on-site server is neither conservatism nor an attempt to sell hardware. Remote access does not disappear — you can still watch from a phone through a local recorder; the only difference is where the archive is kept.

First, notification. When their personal data is entered into a database, the subject must be notified in writing of the purposes of processing and of their rights. In practice that is the familiar «video surveillance in progress» sign, but the duty does not end with a sign: employees whose biometric data enters an access control system need a document.

Second, transfers. If personal data is passed to a third party, the owner or operator notifies the subject in writing within three days. Third, timing: the duty to protect the data arises at the moment of collection and lasts until the data is destroyed or de-identified. «We simply keep an archive and show it to nobody» does not remove the obligations.

SAT Solutions designs systems so that the archive and biometric templates stay at the client's site or on their server in Uzbekistan: local recorders, surveillance servers, access control with a local database. Remote access is set up over a secured connection rather than by moving the database abroad.

This article describes the requirements of the law in general terms and does not replace legal advice on a specific site: the composition of the data, the range of subjects and the processing scheme differ from client to client. If you need an assessment of a particular configuration, send us the system description and we will go through it together with your lawyer.