On August 5, 2024, OneTrust DataGuidance Research confirmed with Vyacheslav Khayryuzov, Partner at Arno Legal LLC, that draft bill No. 992331-7 on the transfer of anonymized personal data to the Ministry of Digital Development passed the third reading on July 30, 2024, and is now in the Federation Council.

Amendments to the Law on Personal Data

Vyacheslav outlined that the draft bill will introduce the following amendments to the Law on Personal Data:

"The Ministry of Digital Development will form datasets out of anonymized personal data, provided that further processing would not allow the identification of a data subject based on the processed data. Datasets should not contain sensitive personal data (special categories) - except for datasets that are necessary to improve public administration - and no biometric data. The Ministry will send a request to data operators to transfer anonymized personal data to the state system (to be defined by the Government). The request needs to contain the list of personal data to be transferred and the term for the transfer. Upon receipt of the request, operators have to anonymize the data in accordance with the anonymization methods approved by the Government. The relevant procedure for cooperation between the Ministry and the operators shall be established by the Government. The Ministry must keep the datasets confidential. The Ministry will then form datasets in the system. Access to the system will be provided to the users in accordance with the rules, to be established by the Government.

The potential users would be:

• state and municipal bodies, as well as state budgetary funds; and
• citizens of Russia and legal entities.

The latter have to meet certain criteria:

• they have to be registered with the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor) as data operators;
• they have to be controlled either by the Russian state or a Russian citizen without citizenship of other states. The control is defined as the ability to determine the decisions of a legal entity by owning directly or indirectly more than 50% of its shares;
• no information in the state register of legal entities that the information on the legal entity is untrue;
• no information that the individuals or legal entities are on the list of terrorists or extremists, or spread weapons of mass destruction; and
• no information on criminal convictions.

The relevant procedure for the verification of users will also be established by the Government of Russia.

Any processing of datasets shall be done in the system. No extraction and recording to other systems are allowed. No transfer of datasets to foreigners is allowed unless there is a state treaty, law, or the decision of the President allowing this. Furthermore, the bill prohibits the processing of datasets which can cause various harm (e.g., harm to life, health, morality, state protected values, and public security)."

Amendments to Federal Law No. 123-FZ

Furthermore, Vyacheslav explained that "the bill introduces similar amendments to Federal Law No. 123-FZ of April 24, 2020, on conducting an experiment to establish special regulation for the purpose of creating the necessary conditions for the development and implementation of artificial intelligence technologies in the constituent entity of the Russian Federation - the city of federal significance Moscow Federation - and amendments to Articles 6 and 10 of the Law on Personal Data.

In addition, the bill allows transferring by regional data operators of individual face images obtained with photo/video cameras, as well as voice recordings obtained with audio-recording devices to the state system."

Entry into force

Vyacheslav confirmed that "the bill will come into force from the date of its official publication. However, most of its provisions (including those mentioned above) will come into force from September 1, 2025."

You can read the draft bill, only available in Russian, here.

Update: August 12, 2024

Bill signed by the President

On August 9, 2024, the National Center for Artificial Intelligence Development under the Government of the Russian Federation announced that the bill was signed by the President.

The law came into force on August 8, 2024, however, most of its provisions will only come into force on September 1, 2025.

You can read the law here and the press release here, both only available in Russian.