No longer “accessible to the public”: new rules on personal data as of 2021

 

The new rules regulate the procedure for processing of personal data  permitted for dissemination: in particular, a respective explicit consent of the subject will be required for their processing. Specific requirements for the content of such consent will later be determined by Roskomnadzor. At the same time, the 519-FZ from December establishes the operator’s obligation to provide the subject “with the opportunity to determine the list of personal data for each category of personal data specified in the consent.” I.e. the personal data in the consent will apparently be divided into categories, in each of which the corresponding items will be determined (e.g. contact information: e-mail address, telephone number, residence address etc.), and the subject will be able to make a choice in respect of each such item to permit dissemination of the listed data or not. Such consent can be obtained directly from the subject or by using the Roskomnadzor information system, which must yet be developed. It should be taken into account that the silence or inaction of the data subject under no circumstances shall be considered as consent.

In addition, according to the 519-FZ, the subject has the right to prohibit in the consent to processing the transfer of the indicated data by the operator to an unlimited number of persons, as well as to prohibit the processing or specify conditions for processing of this personal data by an unlimited number of persons. This, most likely, means the right of the subject to prohibit or determine conditions for the further dissemination of his data, e.g. for the provision of copies of the subject’s data to other persons by the operator. Thereby it is impossible to prohibit or determine conditions for the “granting of access” to the specified data, i.e. the possibility of taking insight into it. Information about the processing conditions and the established prohibitions must be published by the operator within three working days from the receipt of the corresponding consent.

The innovations also cover some mechanisms for protection of personal data permitted for dissemination. In particular, if the data turned out to be disclosed to third parties by the subject himself who did not give the operator his consent to the processing of this information, then those who carried out the processing will be obliged to prove the legality of further processing of such information. A similar rule is provided for information that was disclosed as a result of an offence, crime or force majeure.

In addition, the subject has the right to demand the termination of the processing of his data at any time. To do this, he will need to send a respective request to any person processing his data, or to go to court. Such request must contain the full name of the subject, his telephone number, e-mail or postal address, as well as the list of information, the processing of which should be stopped. The operator of the specified data is obliged to stop processing it within three working days from the receipt of the above-mentioned request or within the period determined by a court decision.

Thus, the new regulations will entail a number of changes in the field of processing of data falling under the category of the data “accessible to the public” according to the current version of the Law on personal data. It is assumed that the introduced mechanisms will limit the possibilities for inappropriate use of personal data, first of all those posted on the Internet, and will give additional rights and opportunities for subjects to protect their own data.

However, the provisions of the 519-FZ were criticized by a number of business representatives. In particular, members of the Big Data Association (BDA), which includes Yandex, Mail.ru Group, Sberbank, Gazprombank, Russian telecommunication operators and others, opposed the adoption of the law. Members of the BDA noted that the document can create legal uncertainty regarding the boundaries of the permitted use of data, for example, in cases when a person gives two social networks consent to the processing of personal data under different conditions. In addition, there are concerns that the new requirements may lead to additional costs for the media for improvement of interfaces, as well as complicate the work of companies using artificial intelligence and big data (https://www.kommersant.ru/doc/4596208). It also raises doubts as to whether foreign social networks like Facebook or Twitter, which previously unwillingly complied with the instructions of Roskomnadzor in respect of localization of personal data of Russians etc., will comply with the new regulations.  In addition, the law does not establish specific sanctions for violation of the new requirements, which raises the question of liability for operators.

Operators should wait for Roskomnadzor’s approval of the requirements for the content of consent to the processing of data permitted for dissemination, publication of information about the new information system of the Federal Service, as well as further clarifications regarding the application of the new rules. 

Until then, preparations should be made to comply with the new legal requirements. In particular, it is worth taking measures to introduce new forms of consent to data processing, introduce the necessary amendments to the company’s internal regulations and familiarize employees with the new rules.