Russia: Personal data protection - employment electronic document flow
Recent amendments to the Labour Code of the Russian Federation of 30 December 2001 No. 197-FZ (as amended) ('the Labour Code'), which came into force on 22 November 2021, provided for electronic document flow in labour relations. This form of interaction has been widely used by employers in relation to remote employees, but now it may apply to all employees. According to the Federal Law of 22 November 2021 No. 377-FZ on Amendments to the Labor Code of the Russian Federation ('the Law'), employers are now authorised to create, sign, use, and store documents related to work in an electronic form without duplication on paper. Such document flow refers to documents that, according to the labour legislation, are drawn up on paper and with which employees (or candidates) must be familiarised in writing, subject to some exceptions. Andrey Slepov and Elena Morozova, from ADVANT Beiten, provide a summary of the impact of the new law on document flow in relation to personal data protection on both employers and employees.
In summary, the Law gives the employer the right to introduce electronic document flow through a local act. The transition to electronic interaction between the employer and the employee is possible upon written notification of the employee and subject to their written consent. However, the consent of employees, who do not have a work record and are hired for the first time after 1 January 2022, is not required.
Written consent to personal data processing
An employee's written consent to the processing of their personal data is required, for example:
- when transferring their personal data to third parties, except for the cases provided for by federal laws;
- when processing special categories of the employee's personal data (such as information on race, nationality, political views, religious and philosophical beliefs, health status, intimate life), if the processing of this data is not explicitly dictated by the law; and
- when transferring personal data to the U.S. or other jurisdictions (including China, India, etc.) that do not provide adequate protection of data subjects' rights in terms of the Russian law.
The possibility of giving written consent in the electronic form (including in a form of simple electronic signature, if so agreed between the parties) was provided by the Federal Law of 27 July 2006 No. 152-FZ on Personal Data (as amended) and confirmed by the Federal Service for Supervision of Communications, Information Technology, and Mass Media ('Roskomnadzor') in the sphere of personal data protection before the introduction of the Law1. The Law confirms the possibility of using a simple electronic signature of an employee for signing written consent to personal data processing.
As many interviews with candidates are nowadays held only, or at least initially, via video calls, the question of how to obtain the written consent of such candidates (when they are needed, for example, in case of transfer of data to the U.S.) has become more of an issue. As the use of a simple electronic signature requires a handwritten agreement between the parties, an alternative to written consent could be a combination of (i) a non-written (simple) consent that may be provided by way of ticking a checkbox on the website (that covers all aspects of processing candidates' data, except for transfer to the jurisdiction that does not provide adequate protection of data subjects' rights); and (ii) an acceptance of a user or information services agreement (the core condition of which shall be a necessity of transfer of data to the U.S., etc. for the purpose of fulfilling the agreement between the parties). Both consent and agreement may be placed, e.g. at the website, where a candidate should register.
Approval of data protection policies and bringing them to the attention of employees against signed receipt
The Law legitimises the use of the electronic signature of the employer (its representative) to sign resolutions on approval of internal policies related to personal data protection. For this purpose, employers may use an enhanced qualified electronic signature or enhanced unqualified electronic signature (in the latter case – if so agreed with the employee).
It is notable that electronic signatures created in accordance with foreign legislation and international standards are recognised as corresponding to the features of an enhanced electronic signature created in accordance with Russian legislation, if there is an appropriate international agreement with the participation of the Russian Federation. Due to the absence of such agreements with the U.S., the EU, and the EU Member States, the legal use of a foreign enhanced electronic signature (including a qualified one) is currently not possible. Thus, the possibility of the use of such foreign services by employers for employment law purposes is limited.
Employees may confirm receipt of local policies with the use of simple electronic signatures.
Thus, it is now legally possible to place local policies, e. g. on the intranet of a company, and avoid the collection of physical signatures of employees as an acknowledgement of signed receipt.
1. Please also refer to: https://www.dataguidance.com/opinion/russia-new-consent-requirements-data-processing