The present article is an attempt to summarise the substance and main principles of the Russian privacy laws. It may prove to be useful for organizations and individuals who plan to conduct business in Russia.
Contents |
1.1 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, signed and ratified[1] by the Russian Federation on December, 19 2005;
1.2 the Law of the Russian Federation “On Personal Data” as of 27.07.2006 No. 152-FZ, regulating the processing of personal data by means of automation equipment. It is the operator who is required to comply with that Act;
1.3 the “Regulations on securing personal data being processed in personal data systems” enacted by the Russian Government Regulation as of 17.11.2007 No. 781. The Regulations contain mandatory security regulations to be complied with when processing and storing personal data;
1.4 the Federal law “On Advertisement” as of 13.03.2006 No. 38-FZ. This regulates marketing communications sent inter alia by electronic means including e-mail, SMS etc;
1.5 the Russian Code on Administrative Infractions dated 30.12.2001 No.195-FZ. This regulates issues of responsibility for commission of administrative offences in connection with processing of personal data or distribution of marketing communications.
2.1 personal data is any information related to identified or identifiable on the basis of such information individual (personal data subject), including his last name, given name, patronymic, date, month, year and place of birth, address, family, social, property status, education, profession, income, other information;
2.2 sensitive personal data means personal data relating to:
-race or ethnic origin -political opinions -religious beliefs -health condition -sexual life
2.3 processing is anything that can be done to or with personal data, including obtaining, organizing, accumulating, holding, adjusting (updating, modifying), using, disclosing (including transfer), impersonating, blocking or destroying such data;
2.4 operator is an entity which organises and/or performs data processing, as well as determines the purposes and manner of data processing. In most cases both mother company and an entity which manages the relevant facility or service offered will be operators;
2.5 personal data system is a data system which includes personal data recorded in the data base as well as information technologies and technical equipment which make possible processing of such data.