Law note · Bhutan
Information, Communications and Media Act of Bhutan 2018, data protection and privacy duties
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Bhutan, including a voiceprint, faceprint, or other biometric identifier, must obtain the subject's express written permission before collecting it and must not disclose it to a third party without authorization. An ICT or media service provider or vendor must additionally publish a privacy policy, limit collection and use to what is reasonably appropriate, store and use data only for its intended purpose, and remain responsible for data it transfers to a third party.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
What we found
Chapter 21 imposes a general consent-for-collection duty (s.384: express written permission of the subject, unless permitted or required by law), a non-disclosure duty absent authorization or legal requirement (s.385), and a duty to delete or destroy obsolete personal information, including sensitive personal data (s.386), on "a person" generally.
Chapter 17 imposes a fuller set of duties specifically on an ICT and Media facility or service provider and vendor: a duty to respect and protect privacy (s.336), a mandatory published privacy policy disclosing data types, sources, purposes, use, disclosure recipients, and opt-out options (ss.337-338), collection and use limited to what a reasonable person would consider appropriate (s.339), storage and use limited to the intended purpose (s.340), no disclosure to affiliates or third parties beyond the transaction absent written authorization (s.341), and continuing responsibility, with contractual binding, for personal data a provider transfers to a third party (ss.342-343).
No phased-commencement language was found for these chapters; this instrument is not recorded as currently in effect for lack of a confirmed primary commencement date, though the chapters function as operative law in practice.
Primary source
official Act text
via a journalist-federation mirror of the government-issued PDF (samsn.ifj.org), since the government's own hosting domains had live TLS failures this pass