Amendments to the Federal Legislation on Private Knowledge

The Russian Federal Legislation of July 27, 2006 No. 152-FZ on Private Knowledge (hereinafter the “Private Knowledge Legislation”) goals to make sure the safety of non-public information of people and applies to organizations that accumulate, use or share this information.

On March 1, 2021, the Federal Legislation of December 30, 2020 No. 519-FZ amending the Federal Legislation on Private Knowledge, which amends the Legislation on Private Knowledge, entered into pressure (apart from an article which is to enter into pressure on 1 July 2021) (“Modifications”).

The amendments considerably change the authorized panorama for entities wishing to publish private information on the Web and offline, for instance employers vis-à-vis staff. Basically, the modifications give extra management to information topics over the processing of their private information for dissemination. The introduction of a particular definition relating to private information the dissemination of which is allowed by an information topic (“Private information whose dissemination is allowed”) The next will change into a part of the relevant information legal guidelines in Russia:

Prsonal information approved for dissemination, entry to which is granted to most people as approved by the info topic by giving their consent to the processing of non-public information.

In essence, which means that any information operator will solely have the ability to depend on the consent of the info topic to put private information in publicly accessible sources and for any additional use thereof after publication. The aim of this as outlined within the explanatory notes to the amendments is to forestall “the uncontrolled assortment and use of such private information on web sites for functions apart from the unique objective for which they have been disseminated”.

The amendments additional present that the shape and content material of the consent should be established by the approved physique chargeable for the safety of the rights of knowledge topics (“Roskomnadzor”).

What consent necessities ought to information operators contemplate?

With such an emphasis on consent, we have supplied a abstract of the brand new necessities beneath:

  • Default place:

    • If the info topic authorizes the switch of knowledge to most people, the consent should comprise a direct indication that the info could also be transferred to most people. The situations and prohibitions should be expressly specified within the It is a necessary requirement.

    • The absence of situations and prohibitions within the consent signifies that the operator is allowed to course of such private information, however with out switch (distribution, provision, entry and different actions) to most people.

  • Granular: Consent needs to be given individually from different consents and be particular for every objective.

    • Relating to the publication of knowledge on staff, employers at the moment are topic to a heavier burden. Beforehand, employers might have obtained an worker’s consent for the processing of their private information for HR functions and this consent might have included permission to publish the worker’s contact particulars on the corporate’s web site, however from March 1, 2021, this consent should be obtained individually.

  • Express: The modifications state that express consent is required – the default consent will not be legitimate. Beforehand, this was solely assumed, however not clearly acknowledged within the legislation.

  • Situations and prohibitions: The information topic has the appropriate to checklist private information and to impose prohibitions on disclosure (apart from entry) and situations of processing (apart from granting entry).

    • This alteration now permits an worker to present consent to an employer to publish their private information (corresponding to picture, identify, schooling, work expertise, key {qualifications}, and many others.) on a company web site and concurrently impose a ban on one other switch of such information. This might embrace handover to potential purchasers as a part of a service supply proposal.

  • Publication: The operator is required to publish info on the situations of the processing and the existence of any prohibitions inside three working days of receiving the consent. This obliges operators to keep in mind any prohibitions or restrictions relating to the additional disclosure, switch or different processing of non-public information to most people, after which, within the pursuits of transparency, to make this info obtainable. This obligation comes into pressure on March 1, 2021.

  • Proper to withdraw consent: The modifications reconfirm the appropriate of an information topic to withdraw consent.

What are the third get together choices?

The multiplier impact of such a burden on information operators and the emphasis on consent can even be evident in relationships with third events. From March 1, 2021, third events who intend to course of Private Knowledge whose dissemination is allowed due to this fact have three choices:

  1. depend on the consent obtained by the info operator from the info topic when processing private information whose dissemination is allowed, topic to compliance with information processing guidelines;

  2. to depend on the consent supplied by an information topic to Roskomnadzor through a devoted internet platform to be arrange in accordance with the legislation, but in addition topic to compliance with information processing guidelines (this feature will change into obtainable from July 1 2021); or

It stays to be seen whether or not the consent (s) obtained earlier than March 1, 2021 are nonetheless legitimate. As well as, the query of whether or not there’s a retroactive impact of the modifications (i.e. whether or not it’s obligatory to acquire a brand new consent in accordance with the brand new necessities) stays unclear.

Roskomnadzor has printed a draft order, which describes in additional element the shape and content material of the consent, however up to now the order has not been formally permitted. It’s anticipated that we’ll quickly have extra readability on some provisions of the modifications (e.g. consent necessities as famous above; proof of legality of subsequent launch within the occasion of a leak; pressure majeure ; and the disclosure of knowledge by the info topic with out issuing the consent). To this point, Roskomnadzor has not launched such clarifications.


In gentle of the above, we advocate that operators and third events do the next:

  • Monitor updates and clarifications from Roskomnadzor relating to the regulation of the processing of non-public information whose launch is permitted.

  • Revise the insurance policies on the safety of non-public information which can be approved for launch to align them with the modifications.

  • If obligatory, assessment all consents and modify them if obligatory. Specifically, if a company has posted the small print of its staff on its company web site, their consents ought to now be obtained by making use of the necessities set out within the modifications.

  • Publish info on the situations of remedy and the existence of any prohibition in regards to the private information whose dissemination is allowed.

In gentle of those modifications, any operator wishing to have the flexibility to course of private information that’s approved for launch ought to now contemplate what modifications needs to be made to their insurance policies and consents to make sure that they’ll adjust to the modifications. We anticipate that Roskomnadzor might give some official recommendation to flesh out a few of these guidelines, particularly relating to the content material of consent and the retroactive impact of modifications, so this story will not be fully over but.

© Copyright 2020 Squire Patton Boggs (US) LLPOverview of nationwide laws, quantity XI, quantity 62

Supply hyperlink

Previous Faculty board to overview submissions on bus proposals
Next Asheville Group and Financial Growth to Host Neighborhood Conferences in Spring