The Armenian government initiated establishing a nationwide International Mobile Equipment Identity (IMEI) registration system that would require all mobile phones imported into the country to be registered in a centralised database before they can access mobile network services. The draft legislative package, approved by the government in June and sent to the National Assembly for adoption, aims to address illegal imports, tax evasion, and the circulation of counterfeit or stolen devices by linking mobile phone identifiers with information held by mobile operators, customs authorities, and border management systems. While the Government presents the proposal as a measure to improve market regulation and public security, experts are concerned that the draft creates a broad personal data processing system without clearly defining its scope or providing sufficient legal safeguards.
What is being proposed?
The draft amendments to the Law on Electronic Communications and related laws introduce a legal framework for creating a centralised IMEI database containing information on mobile phones' IMEI numbers, their users, associated SIM/eSIM cards, and the legal circulation status of devices. Under the proposed amendments, importers and users of mobile phones manufactured during the current or previous calendar year would be required to register the device’s IMEI number in the state database within 90 days of bringing the phone into Armenia and to pay the prescribed state registration fee. Mobile network operators would, in turn, be required to deny service to devices whose IMEI numbers have not been registered.
The proposal also establishes an Administrator jointly created by mobile operators to manage the technical operation of the system and enables interoperability between the IMEI database, customs records, and the state's border electronic management information system. According to the explanatory note, the Government expects the system to reduce the shadow economy, improve tax administration, prevent the circulation of stolen devices, enhance cybersecurity, and align Armenia with international practices.
The draft was published by the Ministry of High-Tech Industry for public consultation on the e-draft platform in February, and approved by the Government decision on 25 June 2026. Within a two-month period, the government plans to present it to the parliament for discussion and final adoption.
Why have the draft amendments raised concerns?
The proposed amendments have been criticised by digital security and personal data protection experts, who argue that the draft does not match with the principles of Armenia's Law on Personal Data Protection and creates significant risks in terms of data protection and possible leaks. According to the statement issued by dpHub, many of the objectives cited in the explanatory note, such as improving cybersecurity, reducing security risks, and strengthening tax administration, are broadly formulated and do not clearly justify the collection and processing of extensive personal data.
The organisations further argue that the draft package establishes a centralised database linking IMEI numbers, SIM/eSIM information, device users, and border-crossing data without defining key safeguards in the law itself. The draft does not specify data retention periods, procedures for correcting or deleting information, limits on secondary use of the data, or clear rules governing access to the database. The amendments allow the Administrator to use IMEI database information to develop and provide other digital services to state bodies, local authorities, legal entities and individuals but do not clearly define the nature of these services, their legal basis, or requirement for additional consent or legal authorisation.
Experts see multiple issues with the amendments:
- They question the necessity and proportionality of collecting data on mobile phone users, noting that the draft fails to demonstrate why less intrusive alternatives would not achieve the stated objectives.
- They point out that the proposal appears to have been developed without conducting a publicly available Data Protection Impact Assessment.
- There is a significant security risk associated with the created database, as it could become a target for cyberattacks.
- The establishment of registration fees will create additional financial burdens for the citizens and importing companies.
If adopted in its current version, the amendments would create one of Armenia's largest centralised databases linking mobile devices with identifiable users and information from multiple government systems. For individuals, this would mean that access to mobile communication services with newly purchase phones would become conditional on registration of their device in the IMEI database, while the expanded scope of state-held information on individual's mobile device with unclear accountability and potential arbitrary use of the data undermines their right to privacy.
- CSOs recommend that essential safeguards, such as purpose of data processing, specific limitations, data minimisation, retention periods, access controls, and oversight mechanisms are established directly in the law to avoid disproportionate personal data usage and processing.
Despite government approval, policymakers are open to further discussions
Based on the government decision, the draft legislation will proceed through the legislative process in the National Assembly. At the same time, government representatives and members of parliament have indicated their readiness to further discuss the draft with interested stakeholders and experts. On July 7, the Chair of the Standing Committee on Economic Affairs initiated a meeting with representatives of state bodies, private companies and independent experts to discuss different approaches to the issue and agreed to continue consultations.
It will be important for both the government and parliament to consider the recommendations of civil society experts and reflect them in the final version of the law. This would help ensure the proportionality of the proposed IMEI registration system and safeguard the protection of fundamental rights.