1 RELEVANT LEGISLATION AND COMPETENT AUTHORITIES
1.1 What is the principal data protection legislation?
According to Art. 15 p. 4 of the Constitution of the Russian Federation (hereinafter – the "Constitution"), the universally recognised principles and rules of international law and international treaties of the Russian Federation are the integral part of its legal system, including the Strasbourg Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) (hereinafter – the "Strasbourg Convention"), which was ratified by Russia in 2005. Art. 23 of the Constitution establishes the right to privacy, including privacy of correspondence and telephone and other communications, for every individual, and Art. 24 prohibits the collection, storage, use and dissemination of the information on an individual's private life without his/her consent. The principles and requirements in the domain of data privacy and data protection are contained in the Federal Law No. 149-FZ dated 27 July 2006 on Information, Information Technologies and Data Protection (hereinafter – the "Information Protection Act"), and the Federal Law No. 152-FZ dated 27 July 2006 on Personal Data (hereinafter – the "Personal Data Act").
1.2 Is there any other general legislation that impacts data protection?
Chapter 14 of the Labour Code of the Russian Federation provides for the requirements to employers in connection with employees' personal data protection. The Code on Administrative Offences of the Russian Federation (hereinafter – the "Administrative Code") establishes liability for violation of the rules and requirements for data processing and protection. There are also the decrees of the President of the Russian Federation, the decisions of the Government of the Russian Federation and the orders of the Federal Service for the Supervision of Communications, Information Technology and Mass Media, Federal Service for Technical and Export Control ("FSTEC"), and the Federal Security Service ("FSS"), which establish administrative regulations and requirements regarding data protection in Russia.
1.3 Is there any sector-specific legislation that impacts data protection?
Provisions regarding data protection specific to certain sectors are contained, in particular, in the Federal Law No. 126-FZ "On Communication", the Air Code of the Russian Federation (Art. 85.1), the Federal Law No. 395-1-FZ on Banks and Banking Activity, the Federal Law No. 323-FZ on the Fundamentals of Protection of the Health of Citizens in the Russian Federation, the Federal Law No. 79-FZ "On State Civil Service in the Russian Federation", etc.
1.4 What is the relevant data protection regulatory authority(ies)?
The principal data protection regulatory authority is the Federal Service for Supervision of Communications, Information Technologies and Mass Media (the abbreviated appellation in Russian is "Roskomnadzor"). Its official website in English is found at http://eng.rkn.gov.ru/. Roskomnadzor reports to the Ministry of Telecom and Mass Communications of the Russian Federation (the abbreviated appellation in Russian is "Minkomsvyazy").
2.1 Please provide the key definitions used in the relevant legislation:
Any information relating directly or indirectly to an identified or identifiable individual (the data subject).
- "Sensitive Personal
Russian laws do not contain the concept of "sensitive personal data"; instead, the concept of "special categories of personal data" is envisaged by the Personal Data Act, and includes any information that relates to nationality, racial or ethnic origin, political opinions, religious or philosophical beliefs and the state of health or private life.
Any action (operation) or a set of actions (operations) towards personal data, whether or not performed by automated means, including collection, recording, systematisation, accumulation, storage, alteration (update, modification), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion or destruction.
Russian laws do not contain the concept of "data controller". However, the Personal Data Act provides for the concept of "data operator", which may be a state or municipal body, legal or physical person, that organises and/or carries out (alone or jointly with the other persons) the processing of personal data and which also determines the purposes of personal data processing, content of personal data and actions (operations) related to personal data.
Russian laws do not contain the concept of "data processor". However, the Personal Data Act refers to a party that may be acting (processing personal data), under the authorisation of the data operator on the basis of the corresponding agreement (including state contract) or by operation of the special state or municipal act and subject to data subject's consent.
An identified or identifiable individual (physical person).
- Other key definitions –
please specify (e.g., "Pseudonymous Data", "Direct
Personal Data", "Indirect Personal Data")
- "Cross-border Transfer
of Personal Data"
Transfer of personal data to a foreign state, foreign state agency, foreign national or legal entity.
An accumulation of independent materials (articles, calculations, regulations, court decisions and other similar materials) systematised so that these materials may be found and processed by an electronic computer.
- "Personal Data
An accumulation of personal data contained in personal databases and information technologies and technical means providing for processing thereof.
- "Biometric Personal
Data characterising physiological and biological particular features of a human, on the basis of which his/her identity may be ascertained.
An information system that carries out upon enquiry of a user search on the internet for information with particular content and provides to the user the information on the address of an internet site page for the purposes of access to the requested information on internet sites owned by other persons, except for information systems used for performance of state and municipal functions, provision of state and municipal services, as well as for exercise of other public authorities provided for by federal laws.
- "Cross-border Transfer of Personal Data"
3 KEY PRINCIPLES
3.1 What are the key principles that apply to the processing of personal data?
The data subject has the right to be informed when his/ her personal data are being processed by the data operator. The data operator must, inter alia, provide the data subject with information on (1) the purposes and methods of processing personal data, (2) its name and location (address), (3) the personal data being processed and the sources from which it has been received, (4) the persons who have access to personal data (except for the employees of the data operator), (5) the term of processing and retention of personal data, and (6) all other information (as applicable) required to ensure the transparent processing of personal data.
- Lawful basis for
Processing of personal data must be done on a lawful and fair basis. The Personal Data Act establishes, in particular, the following lawful grounds for the processing of personal data: (1) a consent in writing is granted by the data subject, or processing is carried out; (2) to achieve the goals provided by an international treaty of the Russian Federation or a law to exercise and perform functions and powers assigned to and obligations imposed on an operator by the legislation – to administer justice, enforce a judgment or an act of another authority or official; (3) to exercise the powers of the federal executive authorities, state extra-budgetary funds, executive state authorities of the constituent entities of the Russian Federation, municipal authorities and functions of organisations involved in the provision of relevant state and municipal services; (4) to perform professional activities of a journalist and/or the lawful activities of mass media, or scientific, literary or other creative activities, or processing is required; and (5) for performance of the contract to which the data subject is a party or a beneficiary.
Processing of personal data must be limited to the achievement of objectives (purposes) which have to be specific, defined in advance and legitimate. Processing of personal data that is not consistent with the purposes of such processing is not allowed.
Processing should be carried out only with respect to personal data that is consistent with the purposes of processing personal data. The content and volume of personal data to be processed must fully correspond to the claimed purposes of data processing. The processed personal data shall not exceed the claimed purposes of data processing.
The personal data must be accurate, sufficient and, where necessary, kept up to date in proportion to the purposes of data processing. The data operator must take all necessary measures (or procure taking the measures) requited to erase personal data, or adjust/rectify incomplete or inaccurate data.
Retention (storage) of personal data must be carried out in a form which allows defining the data subject and for a period no longer than is required for the purposes of processing personal data, unless the specific term of storage or retention of personal data is set forth by the law or by the agreement to which the data subject is a party, beneficiary or guarantor. Personal data which is processed must be destructed or depersonalised as soon as the objectives (purposes) of data processing are achieved, or in cases where the achievement of such purposes is no longer effective or necessary, unless it is otherwise provided by the federal law.
- Other key principles –
- Division of databases of
It is not permitted to consolidate databases of personal data which is being processed for incompatible purposes.
- Division of databases of personal data
4 INDIVIDUAL RIGHTS
4.1 What are the key rights that individuals have in relation to the processing of their personal data?
- Access to data
An individual has the right to access his/her data which is being processed by the data operator. The individual (or his/ her representative) may file a request with the data operator containing the details of the passport (or another identification document) of the individual or his/her representative and the information on the respective relationship between him/ her and the data operator. Such a request may be submitted as an electronic document and contain an e-signature.
Upon receipt of the request, the data operator must confirm the fact of data processing and provide to the data subject all the necessary information, including (1) its name and location (address), (2) the purposes and methods of processing personal data, (3) the personal data being processed and the sources from which it has been received, (4) the persons who have access to personal data, (5) the term of processing and retention of personal data, and (6) all other information required by the law and requested by the data subject. If the required information has not been provided in full by the data operator within 30 days from the original request (unless a shorter period is provided for by the law), the data subject is entitled to submit a repetitive request for provision of access to his/her personal data or the information regarding it. In certain cases, the data subject's right to access may be limited, as prescribed by the federal law.
- Correction and
The data subject may request the data operator to correct or adjust his/her personal data in cases where it is incomplete or inaccurate. The data subject may request as well the data operator to block the personal data, unless it is not prohibited by the law. Furthermore, the data subject is entitled to request the data operator to delete his/her personal data if such data are incomplete, inaccurate, is being processed in violation of the law or unnecessary for the purposes of data processing.
- Objection to
The data subject may raise an objection to the processing of his/her personal data by the data operator or withdraw his/her consent to the data processing. Except where the personal data processing cannot be terminated or would result in violation of the law (e.g., labour law), the data operator must discontinue the data processing. Otherwise, the data subject will be able to enforce his/her rights by all available legal remedies.
- Objection to
Personal data may be processed for the purposes of marketing (e.g., by way of direct communications with a respective customer) only with the preliminary consent of the respective data subject. The burden of proof that the data subject's consent has been received rests with the data operator. The data operator must immediately discontinue the processing of the data subject's personal data upon the respective request of the latter.
- Complaint to relevant data
In the event that the data subject believes that the data operator is processing his/her personal data in violation of the Personal Data Act or applicable laws, or otherwise infringing upon his/ her rights and freedoms, the data subject is entitled to file a complaint with Roskomnadzor, or bring a civil action with a court. The data subject may avail herself of other legal remedies, including the reimbursement of losses and moral damages.
- Other key rights – please
- Objection to taking decisions
on the basis of personal data automated processing
It is prohibited to make decisions that involve legal consequences for a data subject or otherwise concerning his/her rights and lawful interests exclusively on the basis of automated processing of the personal data, unless the data subject has granted a specific consent in writing for this and in other cases has been provided for by the federal laws.
- Objection to taking decisions on the basis of personal data automated processing
5 REGISTRATION FORMALITIES AND PRIOR APPROVAL
5.1 In what circumstances is registration or notification required to the relevant data protection regulatory authority(ies)? (E.g., general notification requirement, notification required for specific processing activities.)
The data operator must notify Roskomnadzor of its intention to process personal data before processing, in order to be recorded with the register of data operators. The notification may be submitted by the data operator in paper form or electronically. Roskomnadzor shall enter the information contained in the notification submitted by the data operator in the register of data operators within 30 days from the receipt of such notification. The data operator may start processing personal data in accordance with the relevant purposes and methods (as described in the notification) upon registration in the register of data operators maintained by Roskomandzor. The information in the register of data operators is publicly available (except for the information on technical means of data protection) (in Russian) at http://rkn.gov.ru/personal-data/register/. The data operator is also obliged to notify Roskomnadzor of any changes in the information provided in its original notification and upon termination of the personal data processing.
5.2 On what basis are registrations/notifications made? (E.g., per legal entity, per processing purpose, per data category, per system or database.)
The notification/registration requirement will be applicable to every data operator that is involved in the processing of any categories of personal data in the territory of Russia, and which uses a personal data information system or personal data database.
The data operator is exempt from the obligation to notify Roskomnadzor in the cases provided for by the Personal Data Act, in particular, on processing of the personal data:
- obtained in accordance with the labour law;
- received under a contract to which the respective data subject is a party, provided that such personal data are not transferred to third parties without the data subject's consent, and only used to perform the contract or to enter into further contracts with the data subject;
- relating to a certain type of processing by a public association or religious organisation acting under the applicable laws, provided that such personal data are not distributed or disclosed to third parties without the data subject's consent;
- made by the data subject publicly available;
- consisting only of the surname, first name and patronymic of the data subject;
- which is necessary for granting the data subject onetime access into the premises where the data operator is located, or in certain other cases;
- contained in the state automated information systems or in the state information systems created for the purposes of state security and public order;
- processed without the use of automatic systems under the applicable laws subject to the compliance with the rights of the data subject; and
- processed in accordance with the laws and regulations related to the transport security.
5.3 Who must register with/notify the relevant data protection authority(ies)? (E.g., local legal entities, foreign legal entities subject to the relevant data protection legislation, representative or branch offices of foreign legal entities subject to the relevant data protection legislation.)
Under the Personal Data Act, an entity deemed a data operator is under an obligation to file a notification with Roskomnadzor in order to be registered in the register of data operators. According to the official position of Roskomnadzor, the notification/registration requirement applies to Russian legal entities and representatives/ branch offices of foreign legal entities that are involved in data processing in the territory of Russia. At the same time, foreign legal entities are subject to compliance with the other rules of Russian laws regarding data protection if they process personal data of citizens of the Russian Federation (please see question 16.2 below). Furthermore, in the event that a data operator commissions processing of personal data to a third party (subject to consent in writing of the respective data subject), the data operator is still under the obligation to notify Roskomnadzor on personal data processing.
5.4 What information must be included in the registration/ notification? (E.g., details of the notifying entity, affected categories of individuals, affected categories of personal data, processing purposes.)
The following information must be included in the notification:
- the name and address of the data operator;
- the purpose of processing personal data;
- the categories of personal data;
- the categories of data subjects whose data are being processed;
- the legal grounds for processing personal data;
- the list of actions towards personal data;
- the description of methods of processing personal data;
- the description of the information systems and the security measures (including encryption) being taken for the protection of personal data;
- the full name and contact details of the Data Protection Officer;
- the start date of processing personal data;
- the term of processing or the condition for termination of processing personal data;
- whether or not the cross-border data transfer of the personal data is carried out in the course of the personal data processing; and
- the location of the databases containing the personal data of the citizens of the Russian Federation.
In the event that incomplete or inaccurate information is provided in the notification, Roskomnadzor may require the operator to make the information precise before it is entered into the register of data operators.
5.5 What are the sanctions for failure to register/notify where required?
A failure to provide notification to Roskomnadzor on the processing of personal data for the registration in the register of data operators may result in an administrative fine up to RUB 5,000 on a legal entity. Also, processing of personal data without notification of Roskomnadzor, where such notification is required under the Personal Data Act, will result in an administrative fine up to RUB 10,000 for a legal entity (regarding the administrative fines effective from 1 July 2017, please see question 16.1 below).
5.6 What is the fee per registration (if applicable)?
Registration in the register of data operators does not require the payment of any state or official fee.
5.7 How frequently must registrations/notifications be renewed (if applicable)?
Registration in the register of data operators is carried out on a permanent basis and does not require renewal. However, the data operator must notify Roskomnadzor of any amendments of information in the register of data operators, as well as the termination of the data processing within 10 working days from the respective amendment or termination date.
5.8 For what types of processing activities is prior approval required from the data protection regulator?
The data operator must obtain the data subject's consent (unless it is released from such obligation under the law) and implement the necessary organisational/technical measures provided for by the Personal Data Act, the requirements to the protection of personal data in the course of processing thereof in the personal data information systems approved by the Decision of the Government of the Russian Federation dated 1 November 2012 No. 1119 and other applicable regulatory acts. Prior approval by Roskomnadzor is not required in order to perform the processing of personal data.
5.9 Describe the procedure for obtaining prior approval, and the applicable timeframe.
Please see question 5.8 above.
Originally published by The International Comparative Legal Guide to: Data Protection 2017, Global Legal Group.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.