Operators will not be able to use personal data by default. Consent will have to be obtained for specific data use actions

A law changing the rules of processing publicly available personal data will come into force on March 1. It was published on the official legal data portal.

Publicly available personal data means data from social media pages or ad sites. Usually, it is the first name, last name, city of residence, phone number, e-mail, or personal photos. In this case, the data operator is the owner of the site, who processes data about their users.

According to the changes, such information will not be disseminated by default: citizens should be able to choose which specific data can be used publicly. For data that can be publicly disclosed, the operators will have to issue a separate consent.

However, if a person will be “silent or inactive” due to their personal data, it will not be considered their consent to its dissemination. If there is no such separate consent for dissemination, it is considered prohibited. Consent will be required for each action, such as transferring data to third parties or publishing it in the public domain.

The new law substantially tightens the rules concerning the processing and distribution of personal data for operators and businesses, Aleksandr Nadmitov, Managing Partner at the law firm Nadmitov, Ivanov and Partners, told RBC. Notably, it will be necessary to ascertain whether the person has given their consent to the distribution of personal data from open sources before its processing. In addition, it will be necessary to check whether there are any conditions and restrictions related to the processing of data by other operators, said Nadmitov. The new law spells out the conditions of processing the personal data that Russians will be allowed to distribute, said Ekaterina Tyagai, partner of the board of lawyers Pen & Paper, in a conversation with RBC.

How will the consent be given?

Russians will be able to give consent directly to the operator or using the information system of the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), said Yekaterina Tyagai. In the special consent form, the subject will have to determine the list of personal data that can be distributed by the operator. The operator will be obliged to allow the subject to make such choices for each category of personal data allowed for dissemination and indicated in the consent to their processing, clarified the lawyer.

Nadmitov noted that the law does not require a mandatory written form of consent to dissemination. He stated that requirements to the contents of the consent to dissemination will be established by Roskomnadzor. As of today, there are no corresponding regulatory acts. In any case, the operators will have to amend and specify their standard consent to personal data processing, the lawyer stated.

The new law will especially affect owners (operators) of online resources and services that allow users to share information with the general public. It will also impact those who use in their activity information from open sources, particularly the media and companies that employ systems that monitor behavior on the Internet, said Nadmitov.

How will personal data be deleted under the new law?

Russians will be able to demand at any time to stop the transfer or distribution of personal data, Nadmitov reminded about the provisions of the law. The validity of consent to personal data processing will cease upon receipt by the operator of the request from the owner of the data.

At the same time, the ban on the use of personal data does not apply to cases of data processing in governmental, social, and other public interests defined by law said the lawyer.

In early December, the Big Data Association (which unites Yandex, Mail.ru Group, SberBank, Gazprombank, and mobile operators) asked the State Duma to reject the amendments to the law on personal data. The companies were concerned that the law would complicate the processing of publicly available personal data. In particular, they said in a statement that the law may create legal uncertainty in the use of data when a user gives consent to two social networks to process their data with different parameters.

To add to it, the requirements may lead to additional costs for sites to refine interfaces, and Russian resources will be at a disadvantage since it will be impossible to monitor compliance by foreigners, the business argues. Alexander Zhuravlev, Chairman of the Commission on Legal Support of the Digital Economy of the Moscow branch of the Association of Lawyers of Russia, said that the changes might complicate the work of companies that employ artificial intelligence and big data.

Source: RBC