COMPARATIVE LEGAL ANALYSIS OF PERSONAL DATA PROCESSING REGULATION IN THE HOTEL SERVICES SECTOR

INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES Volume 02, Issue 07, 2025 Belgium, Brussels 14 INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES universalconference.us COMPARATIVE LEGAL ANALYSIS OF PERSONAL DATA PROCESSING REGULATION IN THE HOTEL SERVICES SECTOR Jurayev Anvarzhon Ilkhomzhon ogli Master of Laws Tashkent state university of Law Abstract:The article is devoted to a comparative legal study of the regulation of personal data processing in the hotel business of Uzbekistan. It examines the provisions of national legislation, including the Law "On Personal Data," and compares their practical application with international experience. The research analyzes key principles of data processing, issues of obtaining client consent, and requirements for customer notification. Special attention is given to data protection challenges and the specifics of transferring information to third parties. Based on the analysis, recommendations are proposed to improve national legal regulation and enhance information security in the hotel sector. Keywords: personal data, hotel services, comparative legal analysis, Republic of Uzbekistan, data protection, data subject consent, data processing, information security, data transfer, international experience. Жураев Анваржон Ильхомжон угли Магистр права Ташкентского государственного юридического университета СРАВНИТЕЛЬНО-ПРАВОВОЙ АНАЛИЗ РЕГУЛИРОВАНИЯ ОБРАБОТКИ ПЕРСОНАЛЬНЫХ ДАННЫХ В СФЕРЕ ГОСТИНИЧНЫХ УСЛУГ Аннотация: Статья посвящена сравнительно-правовому исследованию регулирования обработки персональных данных в гостиничном бизнесе Узбекистана. Рассматриваются положения национального законодательства, включая Закон «О персональных данных», и сопоставляется практика его применения с зарубежным опытом. Анализируются ключевые принципы обработки информации, вопросы получения согласия клиентов и требования к их информированию. Особое внимание уделено проблемам защиты данных и особенностям их передачи третьим лицам. По итогам анализа предложены рекомендации по совершенствованию национального правового регулирования и укреплению информационной безопасности в гостиничной сфере. INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES Volume 02, Issue 07, 2025 Belgium, Brussels 15 INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES universalconference.us Ключевые слова: персональные данные, гостиничные услуги, сравнительноправовой анализ, Республика Узбекистан, защита информации, согласие субъекта, обработка данных, информационная безопасность, передача данных, зарубежный опыт. INTRODUCTION The processing of personal data has become an integral element of the hotel industry, as hotels systematically collect, store, and use significant amounts of customer information for the purposes of booking, accommodation, and service provision. In the context of digitalization and the active implementation of information technologies, the protection of such data acquires an international dimension and requires a comparison of national approaches. In Uzbekistan, the main regulatory act is the Law “On Personal Data” No. ZRU-547 of July 2, 2019 [1], which entered into force on October 1 of the same year. It establishes the key principles of data processing—legality, transparency, purpose limitation, and confidentiality—which generally correspond to the provisions of the European General Data Protection Regulation (GDPR), while also reflecting certain national specificities. For instance, the requirement to obtain informed consent from data subjects for the processing of personal information corresponds with European practice; however, unlike the EU, where processing may be carried out without consent in cases of legitimate interest, Uzbekistan’s legislation places greater emphasis on formal client consent, which is particularly significant in the hotel business. A significant distinction is the requirement for mandatory storage of the personal data of Uzbek citizens exclusively on servers located within the territory of the country. This provision, introduced through the 2021 amendments, is aimed at strengthening national control over information security. In comparative terms, it aligns with the approaches of Russia and Kazakhstan, where data localization has also been introduced, but differs from the models of the European Union and the United States, where the emphasis is placed on cross-border data protection and lawful mechanisms of data transfer. Thus, Uzbekistan’s regulation demonstrates a clear intention to reinforce internal control and digital sovereignty, reflecting both national priorities and broader trends across the post-Soviet space. The legal regulation of data protection in the hotel industry is further supported by the provisions of the Code of Administrative Responsibility and the Criminal Code of the Republic of Uzbekistan, which establish liability for violations of personal data legislation, including the unlawful collection, storage, and transfer of information. INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES Volume 02, Issue 07, 2025 Belgium, Brussels 16 INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES universalconference.us The purpose of this article is to conduct a comprehensive analysis of the legal regulation of personal data processing in Uzbekistan’s hotel sector, to identify the key normative acts, and to examine the existing challenges and prospects for strengthening security and enhancing the effectiveness of the legal framework. The main legislative acts regulating this matter: ⎯ Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of July 2, 2019 [1] ⎯ Amendments to the Law on Personal Data regarding data storage localization (2021) [2] ⎯ Code of Administrative Responsibility and the Criminal Code of the Republic of Uzbekistan (articles related to personal data) [3] ⎯ Resolutions of the Cabinet of Ministers regulating the state register of personal data databases and the procedure for data processing [4] This legislative framework forms the legal basis for the protection of hotel clients’ personal data and requires the practical implementation of modern monitoring mechanisms, staff training, and technical solutions for information security. The processing of personal data has become an integral part of the hotel industry, as hotels collect, store, and use significant amounts of personal information for booking, accommodation, and service provision. In the context of digitalization and the active introduction of information technologies, the protection of such data acquires particular importance. In Uzbekistan, personal data legislation is rapidly developing with the aim of ensuring the property and personal rights of citizens, as well as fostering trust in digital services. The key legislative act is the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of July 2, 2019, which entered into force on October 1, 2019. The law establishes the fundamental principles of data processing: legality, transparency, purpose limitation, and confidentiality, and also requires obtaining the consent of data subjects for processing, which is particularly relevant in the hotel sector [1]. In 2021, amendments were introduced mandating that personal data of citizens be stored exclusively on servers located within the country, thereby strengthening control and data protection. Furthermore, liability measures for violations are enshrined in the Code of Administrative Responsibility and the Criminal Code of the Republic of Uzbekistan. This article will analyze these legal norms and their application in the hotel industry, identify existing challenges, and propose ways to optimize regulation in order to enhance the protection of clients’ personal data. Methods INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES Volume 02, Issue 07, 2025 Belgium, Brussels 17 INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES universalconference.us The study employed a comparative legal method, including the analysis of regulatory and legal acts of the Republic of Uzbekistan, international standards, and best practices in the field of personal data protection. The main sources included the Law “On Personal Data” (adopted in 2019), as well as rules and standards regulating hotel operations and consumer rights. In addition, reviews of law enforcement practices and case law examples concerning the protection of hotel clients from the unlawful use of their data were examined. Results Uzbekistan’s legislation establishes clear legal principles for the processing of personal data, which include the requirements of lawfulness, purpose limitation, transparency in data collection, and ensuring data security. In particular, the Law “On Personal Data” No. ZRU-547 of July 2, 2019 regulates the collection, storage, processing, and transfer of personal information, including mechanisms for obtaining the consent of data subjects and the right to withdraw consent at any time [5]. Mandatory client notification regarding the purposes of processing their personal information and obtaining their consent are key requirements for hotels and other organizations. Clients must be informed about the purposes of data processing, the scope of information collected, the retention period, as well as the possibility of transferring data to third parties. In the hotel sector, it is recommended that consent be obtained in written or electronic form, that access to the privacy policy be provided, and that staff be trained in the rules governing the handling of personal data [6]. The legislation also provides for a system of oversight and liability for violations of personal data processing rules, which includes both administrative and criminal sanctions. Under the Criminal Code and the Code of Administrative Responsibility, penalties range from fines and corrective labor to, in some cases, imprisonment for the unlawful collection, use, or dissemination of personal data. For example, fines may amount to up to 200 basic calculation units, while penalties may include corrective labor for up to three years or restrictions on liberty [7]. In practice, the implementation of personal data legislation in the hotel industry demonstrates varying levels of effectiveness, with cases of low staff awareness regarding the details of data processing regulations, creating both technical and legal risks. Insufficient employee training and the absence of clear internal guidelines often lead to mistakes in handling personal data, which may potentially result in sanctions and a loss of client trust [8]. Particular attention is given to the risks associated with transferring personal data to third parties, such as travel agencies, payment systems, and other intermediaries. The law explicitly restricts such transfers without the client’s consent and requires INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES Volume 02, Issue 07, 2025 Belgium, Brussels 18 INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES universalconference.us notification when requests are made by state authorities. For secure transfers, appropriate legal mechanisms and compliance with cross-border data transfer rules are necessary, which remains an important challenge for the further development of legislation and practice [9]. Thus, Uzbekistan’s legislation clearly regulates the process of personal data processing, establishes a system of client notification and consent, and provides liability for violations. However, the practical implementation within the hotel sector requires improving staff training, as well as enhancing the technical and legal mechanisms of information protection. Discussion The legal regulation of personal data processing in Uzbekistan’s hotel industry is in a stage of active development and adaptation to modern requirements. Despite the alignment of legislation with international standards, in practice there remains a need to strengthen compliance mechanisms, enhance staff qualifications, and increase the accountability of hotel employees. This includes training personnel in the fundamentals of data protection and properly documenting information processing procedures, as reflected in the personal data processing policies of certain hotels in the country, such as Medina and Oscar hotels [10]. To improve security, digital access control and accounting systems are being widely implemented, including modern software and hardware solutions using RFID cards and automated hotel management systems. Their use reduces the risks of unauthorized access to personal data and enables regular auditing and monitoring of information processing [11]. A particularly important task is the development and approval of model contracts and standardized rules for personal data processing in the tourism and hotel sector. This will help unify practices, increase transparency in data management, and reduce potential legal and technical risks. Such measures will encourage businesses to comply with established requirements and allow state authorities to exercise more effective oversight of legislation enforcement [12]. Future prospects include the active adoption of advanced information technologies, such as artificial intelligence systems for detecting anomalies in data processing and expanding capabilities for protection against cyber threats. The implementation of such technologies will enhance the security and transparency of data processing, strengthen customer trust, and improve the competitiveness of the domestic hotel industry in the international market [13]. Thus, the further development of legal and technical frameworks for personal data processing in Uzbekistan’s hotel industry requires a comprehensive approach that INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES Volume 02, Issue 07, 2025 Belgium, Brussels 19 INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES universalconference.us combines legislative reforms, standardization, staff training, and the implementation of innovative digital solutions. Conclusion The legal regulation of personal data processing in Uzbekistan’s hotel industry serves as one of the key factors ensuring client security, the protection of their rights, and the building of trust in services. The national legislative framework, developed in line with international standards and aimed at safeguarding the rights of data subjects, provides a comprehensive legal basis for the processing of personal data. However, to increase the efficiency of its implementation and to adapt to the rapidly evolving digital environment, additional organizational and technical measures are required. First and foremost, it is recommended to strengthen compliance monitoring through regular inspections, audits, and reviews of data processing practices in hotels. Such oversight would help identify and promptly eliminate violations, while also encouraging businesses to maintain systematic and well-structured protection of personal information. Another crucial aspect is the improvement of legal and technical training for hotel staff. The introduction of specialized training programs and courses on information security and data protection law reduces operational risks and fosters a culture of security [14]. Equally important is the development and approval of standard consent forms and agreements tailored to the specific nature of hotel operations. These instruments would minimize the risk of violating client rights and ensure transparency in data processing [15]. Such documents should clearly outline the rights and obligations of the parties, conditions for processing and storing information, as well as rules for the transfer of personal data to third parties, subject to mandatory client consent [16]. At the current stage of development, the active implementation of digital technologies and information protection systems is essential. The use of multi-factor authentication, encryption systems, digital certificates, and automated access control and accounting systems represents the minimum requirement for effective protection of personal data in the hotel business. Recent innovations in biometrics and artificial intelligence can further enhance security levels and provide more precise access management, which is critical for preventing unauthorized access and data leaks. The legal regulation of personal data transfers to third parties also requires further refinement. Clear legal rules and technical requirements must be established for hotel partners, including travel agencies, payment systems, and other service providers that process client data. The creation of oversight and accountability mechanisms in this area will strengthen overall protection and reduce the risks of unlawful data usage. INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES Volume 02, Issue 07, 2025 Belgium, Brussels 20 INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES universalconference.us Another important direction involves raising client awareness about their rights regarding personal data processing and the available protection mechanisms. Educating users fosters a culture of digital trust and empowers clients to monitor how their personal data is utilized. The implementation of all these recommendations will provide a foundation for the sustainable development of the hotel industry in the digital age, strengthen customer trust, enhance the quality and security of services, and ensure the protection of citizens’ rights and freedoms in the context of active digital transformation and international integration. List of References 1. Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of July 2, 2019. https://nrm.uz/contentf?doc=593113_&products=1_vse_zakonodatelstvo_uzbekistan a 2. Amendments to the Law on Personal Data regarding data storage localization (2021). https://kun.uz/ru/27906139 3. Code of Administrative Liability and the Criminal Code of the Republic of Uzbekistan (articles related to personal data). https://anhor.uz/vzglyad-iznutri/datasecurity/ 4. Resolutions of the Cabinet of Ministers regulating the State Register of Personal Data Databases and the procedure for data processing. https://lex.uz/docs/4732190?ONDATE=03.03.2025&ONDATE2=05.04.2022&action =compare 5. Standard procedures in the field of personal data processing. https://azizovpartners.uz/ru/memos/tipovye-poryadki-v-sfere-obrabotki-personalnyhdannyh/ 6. Protection of personal data in hotels. https://searchinform.ru/resheniya/bizneszadachi/zaschita-personalnykh-dannykh/realizaciya-zashchity-personalnyhdannyh/perechen-personalnyh-dannyh-podlezhashchih-zashchite/zaschitapersonalnykh-dannykh-v-gostinitse/ 7. Tougher penalties for violation of the Personal Data Law, social networks face fines. https://www.gazeta.uz/ru/2021/11/01/personal-information/ 8. Compliance with personal data legislation by private companies. https://legalclinic.uz/tpost/mm2pgom8s1-soblyudenie-zakonodatelstva-o-personalni INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES Volume 02, Issue 07, 2025 Belgium, Brussels 21 INTERNATIONAL CONFERENCE OF NATURAL AND SOCIAL-HUMANITARIAN SCIENCES universalconference.us 9. New standards for personal data processing approved in Uzbekistan. https://gratanet.com/ru/news/new-standards-for-personal-data-processing-approvedin-uzbekistan 10. Medina Hotel. Terms and Conditions. https://medinahotel.uz/ru/terms_and_conditions 11. Access control and security in hotels. https://zkteco.uz/ru/solutions/upravleniedostupom-i-bezopasnostyu-v-otelyakh/ 12. Compliance with personal data legislation by private companies. https://legalclinic.uz/tpost/mm2pgom8s1-soblyudenie-zakonodatelstva-o-personalni 13. Personal data security in Uzbekistan: current state and prospects. https://repost.uz/nemnogo-o-kiberbezopasnosti 14. Achilova, L. (2020). The impact of COVID-19 on hotel services: national and foreign experience. Review of Law Sciences, (2), 96-101. 15. Achilova, L. (2020). Genesis of sources of legal regulation of relations in the provision of hotel services. Research results in the context of the pandemic (COVID19), 1(06), 101-106. 16. Рахматов, Ф. О., & Нуриев, К. К. (2022). Исследование плодов дыни как объекта технической переработки. Илмий мақолалар тўплами, 330. 17. Нуриев, К. К., Рахматов, О., Кадирова, Р. С., & Рахматов, О. О. (2015). Биоконверсия органических отходов растительного происхождения в условиях Узбекистана. In Проблемы рекультивации отходов быта, промышленного и сельскохозяйственного производства (pp. 468-470). 18. Джураев, А. Ж., Нуриев, К. К., & Юсуфалиев, А. (2003). Разработка высокоресурсных лап для культиваторов. Тракторы и сельскохозяйственные машины, 2, 42-43. 19. Raxmatov, F. O., Raxmatov, O., Nuriev, K. K., & Nuriev, M. K. (2021, October). Combined dryer with high efficiency for drying high-moist agricultural products. In IOP Conference Series: Earth and Environmental Science (Vol. 868, No. 1, p. 012076). IOP Publishing. 20. Nuriev, K. K., Nuriev, M. K., Rakhmatov, O., & Rakhmatov, F. O. (2022, August). Comprehensive assessment of the degree of flooding of soil-cutting working bodies (on the example of plow shares). In IOP Conference Series: Earth and Environmental Science (Vol. 1076, No. 1, p. 012069). IOP Publishing. 21. Achilova, L. (2021). Digital economy in tourism and hotel industry: a comparative analysis. Legal Bulletin (Yurist axborotnomasi), 2(6), 92-98.