(Apr. 21, 2021) On December 30, 2020, the president of the Russian Federation, Vladimir Putin, signed Federal Law No. 519-FZ on Amendments to the Federal Law on Personal Data. The law became effective on March 1, 2021.
The amendments provide for the introduction of consent-based restrictions on any organization (“entity”) or individual that publishes personal data initially, as well as on those that collect and further disseminate in the public sphere personal data that has been distributed on the basis of consent, including social media, blogs, or any other sources. Under the new amendments, making personal data publicly accessible and using it after the original publication are allowed only if the data subject consents to the dissemination. (Federal Law No. 519-FZ art.1, § 1, amending art. 10.1 of the Law on Personal Data.) The consent should be “specific, affirmative and separately received from the data subject, whose existence must be proved at any point in the use and further use [of the data].” (Art. 1, § 1.) Individuals have the right to withhold their information from dissemination and allow only the processing of their personal data. (§ 4.) Silence or inaction of a data subject cannot be taken to indicate consent to the processing of personal data for dissemination. (§ 8.)
The form and content of the consent are to be established by the federal agency responsible for oversight in the field of communications, information technologies, and mass media (Roskomnadzor). A special, centralized information system for recording received consent must be set up by Roskomnadzor. Each individual will have a chance to opt out of the dissemination of personal data at any time. (Art. 1(5), amending art. 10.1, § 1; art. 10.1, §§ 6, 7, 14.)
Among the requirements for the dissemination of personal data established by this law are the following:
- The data subject has the right to select what type of personal data can be processed for distribution. (Art. 1(5).)
- If personal data was disclosed by its owner to an indefinite number of individuals before publication and without expressing consent, or was disclosed due to an offense, crime, or matter of force majeure, the persons who distributed or otherwise processed the data are obligated to prove the legality of their actions. (§§ 2, 3.)
- Data operators cannot disregard conditions, restrictions, or prohibitions on the processing and distributing of data established by the data subject. (§ 9.)
- Restrictions on data transfer, processing, and distribution established by a data subject do not apply to cases in which personal data is processed in the interest of the state or the public, as defined by Russian law. (§ 11.)
- The data operator is required to publish information on the terms of the processing and the existence of any restrictions within three business days from the receipt of the consent. (§ 10.)
- The data operator must consider the data subject’s consent to process and distribute his or her personal data terminated and must stop the transfer of the personal data (i.e., the distribution of, provision of, or access to the data) immediately upon receiving the data subject’s withdrawal of consent and his or her request to stop transfer of the data. (§ 12.)
The explanatory note prepared by the drafters of Law No. 519-FZ states that the aim of the legislation is to prevent “the collection, and subsequently the uncontrolled use of personal data placed on internet sites for purposes other than the purpose of its initial distribution, by third parties.” In a news release issued by Human Rights Watch, the newly adopted amendments were assessed as “part of the broader effort to regulate information shared online and its availability to the public in the Russian Federation.”