From 1 March 2021 new procedures for distribution of personal data to the public came into force.1
Personal data may be distributed to an unlimited group of persons only based on the special separate consent of the person whose data it is. A person may determine in the consent which data will be available to the public, including for further distribution.
In the consent the person may establish prohibitions on transfer and processing or conditions for the processing of personal data by an unlimited group of persons. The personal data operator must publish information online on such personal prohibitions and conditions, which may be difficult from a technical perspective, since it will require the development and implementation of new technological processes.
Roskomnadzor will devise the procedure for issuing such consent.2
A person may provide consent directly to the personal data operator or using the Roskomnadzor information system, which must be in place by 1 July 2021.
Data operators that use personal data disclosed to the public must, if requested by Roskomnadzor or the relevant person, prove that they have proper legal grounds for processing the data. This means that even if personal data was made publicly available by one data operator on a lawful basis, other entities must check the consent and restrictions for data processing published online by such data operator and use the data only in the manner determined by the person in the consent.
Starting from 27 March 2021 the liability for violation of the rules established by the amendments will be increased to RUB 300,000 for legal entities.
- Data operators should review their personal data processing activities to determine the categories of personal data recipients during data transfers to third parties.
- Data operators distributing personal data to an indefinite group of persons should arrange consent in accordance with the new requirements.
- Data operators collecting personal data from open sources should review their personal data processing activities to ensure that they have legal grounds for processing personal data from such open sources.
1 Federal Law No. 519-FZ “On the Introduction of Amendments into the Federal Law “On Personal Data” dated 30 December 2020
2 The draft is available at: https://regulation.gov.ru/projects/List/AdvancedSearch#departments=47&npa=113086