Page 1

Rus

About Ministry Events Activity Documents Contacts

Ministry of Digital Development, Communications and
Mass Media of the Russian Federation

Report mistakes

Processing and storage of personal data in the Russian Federation.
Changes from September 1, 2015
Last update: 12 Feb. 2016

Description

From September 1, 2015, the regulation on
localization of storage and individual processing of personal data,
defined in Federal Law No. 242 of July 21, 2014 "On making
amendments to certain legislative acts of the Russian Federation in part
clarification of the procedure for processing personal data in information
telecommunication networks "
After familiarization with the presented materials with the help of a special
forms, you can send a clarifying question...

Clarifications

Explanatory note
Scope of FZ-242 on the territory and circle of persons
Scope of FZ-242 in time
Collection of personal data
Correlation of the requirement for the localization of individual processing processes
personal data with provisions on the cross-border transfer of personal
data

Answers to frequently asked
questions

Citizenship
- How to determine the citizenship of the subject of personal data for the purposes
meeting localization requirements?
Air transportation
- Are the requirements provided for by Part 5 of Article 18 of the Federal
of the Law "On Personal Data" (as amended by Law 242-FZ) for activities
air carriers, their authorized agents, as well as other persons, in terms of processing
personal data of citizens-passengers for the purposes of booking, processing and
issuing them air tickets (travel tickets), baggage receipts and other
shipping documents?
Personnel
- Does the employer have the right (with the written consent of the subject
personal data) for the cross-border transfer of personal data of their
workers?
- Does the requirement of the Law on compulsory processing of personal data of citizens apply?
RF using databases located on the territory of the RF, to the employer,
which processes the personal data of its employees for the purpose of
compliance with the labor legislation of the Russian Federation and which in
due to the specifics of the work, it becomes necessary to process the PD of its employees with
using databases outside the Russian Federation? "
Goods and services
- Will the citizens of the Russian Federation be able to post their PD in a format convenient for them and
use the services offered on the world market for goods, works, services
(for example: tourism (booking), ordering goods, banking services, etc.)?
Transboundary
- Is the Law applied extraterritorially and should those persons (including
non-residents of the Russian Federation), to which the operators or directly the subjects of personal data
(citizens of the Russian Federation) send PD, legally also process them on
territory of the Russian Federation?
- Ratification by the Russian Federation of the Council of Europe Convention on the Protection
individuals with regard to the automated processing of personal data
may lead to a conflict between the Law and the Convention: “the party must not
prohibit or subject to special permission transboundary flows
personal data going to the territory of the other Party, from the only
the purpose of protecting privacy ”. Should in this situation follow
the provisions of the Law or the Convention?
- Does the Law apply to PD of citizens of the Russian Federation who were transferred to
legal basis for their processing outside the territory of the Russian Federation before its entry
by virtue of?
- If the subject of personal data has given his consent to the operator to process it
PD in PD databases outside the Russian Federation, does it allow the operator on the basis of such
of the will of the subject of PD to process PD in databases outside the Russian Federation?
- In FZ-242 there is a wording “When collecting personal data, including
via the information and telecommunication network "Internet", operator
is obliged to ensure the recording, systematization, accumulation, storage, clarification
(update, change), extraction of personal data of citizens of the Russian
Federation using databases located on the territory of the Russian
Federation, except for the cases specified in clauses 2, 3, 4, 8 of part 1 of article 6
of this Federal Law ". Does the Law impose a prohibition on subsequent
processing (after collection, e.g. reporting, data analysis, etc.)
personal data in databases located outside the Russian
Federation?
- How justified is the interpretation of the Law, according to which the operator
personal data is obliged to ensure the recording, systematization, accumulation,
storage of personal data of citizens of the Russian Federation using databases,
located on the territory of the Russian Federation, only during the (initial) collection of personal data,
and post-processing using databases not located on
territory of the Russian Federation, as well as cross-border transfer of data to a third party is not
prohibited?
- Does the localization requirement apply to cases of entering personal
data of Russian citizens in databases that are located outside
Russian Federation, if such personal data was previously
localized in accordance with FZ-242?

- Is it possible to store personal data (PD) of citizens of the Russian Federation outside its borders when
provided there is a duplicate (copy) database of PD of citizens of the Russian Federation on the territory of the Russian Federation (and
on the contrary, when the PD database outside the Russian Federation is a copy (or part) of the database
data generated and located on the territory of Russia?), or PD processing
on the territory of another state is, in principle, prohibited?
- When consent to the cross-border transfer of personal data is considered
stopped? Under the laws of some countries, the transmitted information
must be kept in foreign companies even after the expiration of contracts with
counterparties.
- Is it possible to transfer personal data of employees to foreign
companies belonging to the same group of companies as the Russian
employer, on the basis of a free data transfer agreement. Does it carry in
in this case, the responsibility of a Russian legal entity that is not
controls the actions of a foreign legal entity without defining goals and
the amount of data processing?
- What is the maximum allowable period during which the data can
be located on foreign servers of third parties after their transfer?
Does the Law differentiate between the concepts of "temporary storage of personal data" for
the purposes of data transmission or their use outside the Russian Federation and "constant
storage"?
- Are any prior approvals from Roskomnadzor required for
opportunities to carry out cross-border transfer of personal data?
Terminology
- Taking into account the Explanatory Note to the Law, which states that the purpose of
such is the improvement of the institution of personal data processing
citizens of the Russian Federation in information and telecommunication networks, it is necessary to clarify
whether the requirements of the Law apply to all persons who meet the concept of "operator" for
the meaning of Art. 3 Federal Law of the Russian Federation No. 152-ФЗ dated July 27, 2006, or only to operators whose
the main activity can be recognized as the processing of PD with
using information and telecommunication networks?
- In an explanatory note to the bill, as well as when covering amendments
the press mentioned that the purpose of the draft law is to restrict the processing
personal data exclusively via the Internet, while
the final version of the bill, which was adopted by the State Duma of the Russian Federation,
contains a more broad and ambiguous interpretation of this rule.
Does the law really apply to any processing of personal
data (and not only on the Internet) and, if not, are they planning to accept
any bills clarifying this point?
- What is meant by the collection of personal data in the context of the requirements
law?
- New requirements (clause 5 of Article 18) sound “When collecting personal data, including
including through the information and telecommunication network "Internet",
the operator is obliged to ensure the recording, systematization, accumulation, storage,
clarification (update, change), extraction of personal data of citizens
Of the Russian Federation using databases located on the territory
Russian Federation…". Does this mean that these requirements apply
exclusively for the collection process, but does not apply to any subsequent
actions with personal data?
- Please clarify in regulatory enactments the concept of personal data in
due to the fact that in the law it is rather vague.
- Considering that using databases located in Russia, the operator when
collection of PD is obliged to ensure the recording, systematization, accumulation, storage,
clarification (update, change), extraction of the PD of citizens of the Russian Federation, and the concept
"Processing of personal data" in addition to these actions also includes
collection, use, transfer (distribution, provision, access),
depersonalization, blocking, deletion, destruction of PD, are we right
we understand that such processing of personal data as collection, use, transfer,
depersonalization, blocking, deletion, destruction, possible using
databases located outside the Russian Federation? Please clarify which
actions are included in the concept of "use of personal data".
- According to paragraph 2 of Article 3 of Law No. 152-FZ, the concept of "operator" includes
a legal entity that alone or jointly with others
organizes and (or) carries out the processing of PD, and also determines the purposes of processing
PD, the composition of PD to be processed, actions performed with PD. If
a legal entity only partially meets this definition (for example, not
carries out PD processing, but only determines the purposes of PD processing), is it considered
such a legal entity a person as a PD operator?
- Is there really no need for repeated or additional notification of
processing of personal data after September 1, 2015. If necessary
additionally inform where the databases are located?
- Is the initial collection of personal data on paper
carriers with their subsequent entry into the electronic database under the requirements
Part 5 of Article 18 of Federal Law No. 152-FZ?

Documentation

Attention! Links lead to an external Internet resource: "Official Internet
portal of legal information ".
Federal Law No. 242 of July 21, 2014 "On Amendments to Certain
legislative acts of the Russian Federation in terms of clarifying the processing procedure
personal data in information and telecommunication networks "
Federal Law No. 149 of July 27, 2006 "On information, information
technologies and information protection "
Federal Law No. 152 of July 27, 2006 "On Personal Data"

Ask a Question

If you did not find the answer to your question, send an appeal to specialists
The Ministry of Telecom and Mass Communications of the Russian Federation.

Ministry of Digital Development,
Communications and Mass Media of the
Russian Federation

About Ministry

Contacts

About the site

Open data

Contacts for press

Attendance statistics

Subscription

Report an issue

Address: Presnenskaya
Embankment 10, building
2, Moscow, 125039,
Russian Federation
Reference: +7 (495) 771-81-00

Rus

