Author:
Sergey Medvedev, PhD

Data protection in Russian Federation overview

Legislation

1. What national laws regulate the collection and use of personal data?

General laws

The main provisions of data protection and privacy law can be found in the:

The principal law in this area is the Personal Data Protection Act.

Sectoral laws

Data protection specific provisions can also be found in various sectoral laws, for example, the:

There are also certain local administrative regulations and official requirements that regulate the collection, storage and use of personal data, issued by the:

Scope of legislation

2. To whom do the laws apply?

Data protection laws apply to all data operators and third parties acting under the authorisation of data operators. Russian data protection laws do not contain the concepts of "data controller" and "data processor". However, the Personal Data Protection Act does refer to the concept of "data operator". A data operator can be a state or municipal body, legal or physical person that both:

The data processing can be shifted to a third party, subject to the data subject's consent, who will be acting under the authorisation of the data operator on the basis of the corresponding agreement, or by operation of the special state or municipal act.

3. What data is regulated?

Data protection laws regulate all personal data that is processed by data operators or third parties. Personal data is any information (directly or indirectly) related to an identified or identifiable individual (data subject).

Russian data protection legislation does not distinguish between direct personal data and indirect personal data. Therefore the personal data will be regarded as "direct" or "indirect" depending on the facts of each situation.

4. What acts are regulated?

Data protection laws apply to all acts of data processing, including collection, recording, systematisation, accumulation, storage, alteration (update, modification), retrieval, use, transfer (dissemination, provision, access), depersonalisation, blocking, deletion or destruction of data. Electronic (automated) and manual (non-automated) records of personal data will be subject to the data protection legislation.

5. What is the jurisdictional scope of the rules?

Data protection laws do not contain any express provisions regarding their jurisdictional or territorial effect. Therefore, it is generally presumed that the national data protection rules apply to:

This is regardless of where the data operators are established and located. In the context of cross-border data flow, the national data protection legislation can also be applied to a certain extent, provided the Russian individual is a party to the corresponding data transfer agreement.

6. What are the main exemptions (if any)?

The following exemptions apply to the scope of regulation of data protection laws:

Notification

7. Is notification or registration required before processing data?

A data operator that is processing personal data must notify Roskomnadzor before it begins to process personal data. The notification can be submitted by the data operator on paper or electronically.

Notification

The notification must contain the following information:

Roskomnadzor will register the data operator within 30 days of the date of receipt of the corresponding notification (in the absence of any further questions or inquiries). The information listed above (except the description of the data operator's IT systems and corresponding security measures) becomes publicly available once included in the register. Roskomnadzor maintains a register of data operators based on the information that is contained in the notifications it receives. The register of data operators is public and can be found in Russian, see http://rkn.gov.ru/personal-data/register/.

The notification/registration requirement will be applicable to every data operator that is involved in the processing of different categories of personal data in the territory of Russia (or processing personal data of Russian citizens) and uses its internal IT system or database subject to the data protection legislation. However, the data operator will be discharged of this statutory requirement and will be able to process personal data without notification/registration in certain circumstances.

For example, where the personal data:

Notification and registration does not require the payment of any official fee.

MAIN DATA PROTECTION RULES AND PRINCIPLES

Main obligations and processing requirements

8. What are the main obligations imposed on data controllers to ensure data is processed properly?

The main obligations imposed on data operators to ensure the personal data is processed properly are as follows:

9. Is the consent of data subjects required before processing personal data?

In most cases, the data subject's consent will be required before processing personal data. The data subject's consent must be specific, informed and willful.

Unless otherwise provided by the law, the data subject's consent can be obtained in any form, including online. In cases where the law requires the data subject's consent to be given in writing (for example, biometric data processing), implied or inferred consent will not be regarded as valid. E-signatures are allowed and can be used in accordance with the provisions of the applicable law on digital signatures, if the data subject's consent represents an electronic form of the document. The burden of proof that the data subject's consent has been received remains with the data operator.

There is no prescribed or approved form of consent. However, the Personal Data Protection Act specifies the information that must appear in the written consent of the data subject:

A minor's personal data can be processed under the consent provided by the lawful representative.

10. If consent is not given, on what other grounds (if any) can processing be justified?

The processing of personal data without the data subject's consent can be justified in certain circumstances. For example, if data processing is required for:

Special rules

11. Do special rules apply for certain types of personal data, such as sensitive data?

Under the Personal Data Protection Act, sensitive data refers to any information that relates to nationality, racial or ethnic origin, political opinions, religious or philosophical beliefs and the state of a person's health or sex life.

Sensitive data can only be processed if the:

The processing of sensitive personal data (where it is permitted by the law) will be terminated immediately if the reasons for the processing no longer exist.

RIGHTS OF INDIVIDUALS

12. What information should be provided to data subjects at the point of collection of the personal data?

At the point of collection of the personal data, the data subject must be provided with the following information:

13. What other specific rights are granted to data subjects?

The data subject has the right to access the data being processed by the data operator and reserves the right to receive the information related to data processing, including but not limited to:

In addition, the data subject has the right to:

14. Do data subjects have a right to request the deletion of their data?

Data subjects can request the deletion of personal data if the data is:

SECURITY REQUIREMENTS

15. What security requirements are imposed in relation to personal data?

The data operator must take necessary and sufficient protective measures to comply with the data protection legislation, including the following:

In any event, the data operator must take the necessary legal, organisational and technical measures for the protection of personal data against any unauthorised/illegal or accidental access, destruction, modification, blocking, copying, provision, or distribution, as well as against any other unauthorised actions with regard to personal data. Additional security measures can be established by:

16. Is there a requirement to notify personal data security breaches to data subjects or the national regulator?

In general, there is no legal requirement to report data breaches to data subjects or to Roskomnadzor. In the event of locating or detecting unauthorised processing of personal data, the data operator (or the relevant authorised person) must terminate the processing within three business days. If it is not possible to change the unauthorised processing of personal data into a lawful manner of processing, the data operator must destroy the personal data within ten business days. Following the termination of processing of personal data or destruction of personal data, the data operator must notify the data subject (or its representative). If the request for the termination or destruction has been made by Roskomnadzor, the notification must be sent to Roskomnadzor.

PROCESSING BY THIRD PARTIES

17. What additional requirements (if any) apply where a third party processes the data on behalf of the data controller?

The data subject must consent to the transfer of personal data to third parties. Third parties are subject to the same legal requirements and obligations as data operators and must comply with the data processing rules that have been defined by the law. The data operator will be liable for all acts or omissions of third parties (acting under the authorisation of the data operator), while respective third parties must take responsibility before the data operator.

ELECTRONIC COMMUNICATIONS

18. Under what conditions can data controllers store cookies or equivalent devices on the data subject's terminal equipment?

The law does not contain a definition for "cookies". There are also no official guidelines from Roskomnadzor (or other state agency) on the use or distribution of cookies.

Under the Data Protection Act, a person distributing information must provide the addressee with the explicit option of rejecting the information (when using a method that allows for the identification of the addressee), including when sending regular postal messages and electronic messages. Therefore, it is generally presumed that all types of cookies require an opt-in consent of the respective data subject (in the absence of a more specific legislation on this point).

19. What requirements are imposed on the sending of unsolicited electronic commercial communications (spam)?

Unsolicited electronic commercial communications (spam) are not allowed in Russia. Such communications can only be sent with the addressee's prior consent and must be immediately stopped on his request. Failure to comply with these requirements can lead to different types of liability (including the administrative liability).

INTERNATIONAL TRANSFER OF DATA

Transfer of data outside the jurisdiction

20. What rules regulate the transfer of data outside your jurisdiction?

Article 12 of the Personal Data Protection Act regulates cross-border data flows. In the event of an international transfer of personal data, all data operators must ensure (before the transfer is made) that the rights and interests of the respective data subject are fully protected in an adequate manner in the corresponding foreign country. All countries that are signatories to the Strasbourg Convention are considered to be jurisdictions that provide "adequate protection" of the rights and interests of data subjects.

In addition, Roskomnadzor has adopted an official list of countries (including Australia, Argentina, Canada, Israel, Mexico and New Zealand) that may secure the adequate protection level for the purposes of cross-border transfers of personal data. International data transfer to any jurisdiction with the adequate protection level is not subject to any restriction, provided that the consent of the respective data subject has been received.

Cross-border transfers of personal data to countries that do not provide a level of adequate protection is only permitted if the:

Typically, companies that are acting as data operators will check for the adequate protection level of data protection before transferring any personal data abroad. In addition, companies will obtain written consent from the respective data subjects or execute international data transfer agreements with the respective data subjects. Following these steps, companies will proceed with cross-border data transfers in accordance with their internal corporate rules or policies (as applicable).

21. Is there a requirement to store (certain types of) personal data inside the jurisdiction?

On 21 July 2014, the President of the Russian Federation signed Federal Law No. 242-FZ on Amendments to Certain Legislative Acts of the Russian Federation for Clarification of Personal Data Processing in Information and Telecommunication Networks (New Data Protection Law), which became effective on 1 September 2015.

The New Data Protection Law amends the Personal Data Protection Act by mainly addressing two issues:

Specifically, the New Data Protection Law introduces an obligation on all data operators to "ensure recording, systematisation, accumulation, storage, change and extraction of personal data of Russian citizens with the use of data centres located in the territory of the Russian Federation in the course of collection of relevant personal data of individuals, including via the Internet". This means that any personal data of Russian citizens collected by data operators will need to be stored in servers, IT systems or data centres located in Russia. The New Data Protection Law does not expressly stipulate this, but the requirement is interpreted as prohibiting the storage of personal data on Russian citizens outside of Russia (without locating the personal data of Russian citizens in Russia at first). Therefore, through a literal interpretation of the New Data Protection Law, local and foreign companies (data operators) are required to process or organise the processing of personal data of Russian citizens in Russia, subject to compliance with all other general requirements of the data protection legislation. In addition, the New Data Protection Law does not:

Data transfer agreements

22. Are data transfer agreements contemplated or in use? Have any standard forms or precedents been approved by national authorities?

Data transfer agreements are not specifically regulated by the law, but they are widely used in practice, especially when foreign parties are involved. Roskomnadzor has not adopted a standard form of a data transfer agreement. Hence every such agreement will be subject to the facts of each situation and executed under the principle of freedom of contact.

23. Is a data transfer agreement sufficient to legitimise transfer, or must additional requirements (such as the need to obtain consent) be satisfied?

A data transfer agreement is sufficient to legitimise the international transfer of personal data, provided the data subject's consent is expressly stated in the agreement. In addition, the data operator must notify Roskomnadzor about its right to cross-border data transfer at the time of sending the notification for the purposes of registration.

24. Does the relevant national regulator need to approve the data transfer agreement?

Roskomnadzor does not need to approve or register the data transfer agreement. The data transfer agreement must be executed by the relevant data operator and data subject in writing in order to be effective and enforceable.

ENFORCEMENT AND SANCTIONS

25. What are the enforcement powers of the national regulator?

Roskomnadzor has certain enforcement powers and is responsible for the following:

26. What are the sanctions and remedies for non-compliance with data protection laws?

In Russia, non-compliance with data protection laws can be punishable with:

Finally, it is important to note that Russian data protection laws have been enforced quite heavily in recent years, and data subjects have sent many complaints to Roskomnadzor. There has also been a growing number of appeals by data operators against the orders and decisions of Roskomnadzor imposing different sanctions on data operators and blocking their Internet resources. As a result, the national case law and court practice relating to sanctions for non-compliance with Russian data protection laws continues to develop constantly. In the near future, the Russian Government may strengthen the sanctions for data breaches, at least from the administrative liability perspective, by amending the applicable law.

REGULATOR DETAILS

Communications, Information Technologies and Mass Media (Roskomnadzor)

Main areas of responsibility. Supervision of legitimate data processing, accepting notifications, performing registration and maintaining the register of data operators, carrying out inspections and enforcement, adopting official regulations and guidelines. The website is available in English and Russian.