Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Biometric privacy
What it requires →
Biometric data sits outside the Art. 21 special-category list and is instead governed by three scattered provisions. Art. 1(1) defines it generally, with no illustrative list: information characterizing the physiological and biological features of a person and permitting establishment of the identity of the person. Art. 11(2) makes biometric data, along with data held in electronic information resources generally, automatically confidential and limited to the purpose for which it was collected.
Art. 7(7) defers the specifics of biometric information collection and processing entirely to unnamed other Turkmen legislation, the same deferral pattern this batch also finds word for word in Kazakhstan's Art. 11(3) and Tajikistan's Art. 11.
Comprehensive regime
What it requires →
Law No. 519-V applies to the operator, defined broadly to include state bodies and other legal or physical persons collecting, processing, or protecting personal information, and to the third party.
Art. 7 requires the subject's written consent for collection and processing, bars purpose expansion without further consent, requires no license or permit of the operator, requires operator staff to notify their supervisors before beginning collection or processing, and bars an operator from subcontracting collection or processing duties by contract, a restriction not seen elsewhere in this batch.
Art. 8 sets consent form requirements (written, electronic document, or another compatible method) and a revocation right, subject to exceptions not fully extracted. Art. 6 splits personal information into publicly available and restricted-access categories by accessibility.
Cross border transfer
cite Law No. 519-V (20 March 2017), Arts. 12, 17
stage IN FORCE in force since 2017-07-01
binds public and private bodies
source official text, Human Rights Ombudsman of Turkmenistan (converted from the site's RTF publication)
What it requires →
Art. 12(2) is an unconditional domestic-storage duty, with no citizen-only qualifier and no sectoral limitation: storage of personal information is carried out in a database of personal information located in the territory of Turkmenistan. Art. 17, read in full, makes the domestic database an explicit precondition for any transfer, not merely an alternative to it: personal information is subject to cross-border transfer only where it is contained in a database located in Turkmenistan.
Transfer to a state ensuring protection is then permitted; where the destination does not, transfer may still occur on written subject consent, a ratified treaty, statutory necessity, or protection of vital interests or constitutional rights where consent cannot be obtained. No enforcement history for either duty was found; secondary reporting describes practical enforcement of this Act generally as essentially nonexistent.
Enforcement supervision
What it requires →
Art. 28(2), read in extract, gives the Cabinet of Ministers of Turkmenistan only a discretionary power ("may," not "shall" or "must") to establish an authorized body for the protection of subjects' rights and determine its status and powers; no source found in this research confirms that power has ever been exercised.
Absent that, Art. 29 assigns generic state bodies, within their existing competence, the powers to draft implementing regulations, hear complaints, and take measures to hold violators liable as established by other Turkmen law. Art. 31, read in full, is a single bare sentence naming no fine schedule, no authority, and no private cause of action. Art. 32 provides that disputes are resolved in the manner established by Turkmen legislation, again naming no forum.
Secondary reporting describes the Cabinet of Ministers and the Prosecutor General's Office as the de facto oversight bodies, with penalties described as very low and practical enforcement as essentially nonexistent, the weakest data-protection framework reported among the Central Asian states in this batch.
Sensitive categories
cite Law No. 519-V (20 March 2017), Art. 21
stage IN FORCE in force since 2017-07-01
binds public and private bodies
source official text, Human Rights Ombudsman of Turkmenistan (converted from the site's RTF publication)
What it requires →
Art. 21, read in full, prohibits by default processing data concerning nationality, skin color, attitude toward religion, political convictions, state of health, or intimate life.
The prohibition lifts for written subject consent, publicly available data, health necessity to protect vital interests where consent is unobtainable, medical purposes by a professional bound to confidentiality, processing by an association or religious organization of its own members' data, necessity for the administration of justice, or operational-investigative activity and criminal-sentence enforcement.
Biometric data is not among the Art. 21 categories; it is governed separately, see the biometric_privacy instrument for this jurisdiction.
