In summary, the Law gives the employer the right to introduce electronic document flow through a local act. The transition to electronic interaction between the employer and the employee is possible upon written notification of the employee and subject to their written consent. However, the consent of employees, who do not have a work record and are hired for the first time after 1 January 2022, is not required.

Written consent to personal data processing

An employee's written consent to the processing of their personal data is required, for example:

• when transferring their personal data to third parties, except for the cases provided for by federal laws;
• when processing special categories of the employee's personal data (such as information on race, nationality, political views, religious and philosophical beliefs, health status, intimate life), if the processing of this data is not explicitly dictated by the law; and
• when transferring personal data to the U.S. or other jurisdictions (including China, India, etc.) that do not provide adequate protection of data subjects' rights in terms of the Russian law.

The possibility of giving written consent in the electronic form (including in a form of simple electronic signature, if so agreed between the parties) was provided by the Federal Law of 27 July 2006 No. 152-FZ on Personal Data (as amended) and confirmed by the Federal Service for Supervision of Communications, Information Technology, and Mass Media ('Roskomnadzor') in the sphere of personal data protection before the introduction of the Law¹. The Law confirms the possibility of using a simple electronic signature of an employee for signing written consent to personal data processing.

As many interviews with candidates are nowadays held only, or at least initially, via video calls, the question of how to obtain the written consent of such candidates (when they are needed, for example, in case of transfer of data to the U.S.) has become more of an issue. As the use of a simple electronic signature requires a handwritten agreement between the parties, an alternative to written consent could be a combination of (i) a non-written (simple) consent that may be provided by way of ticking a checkbox on the website (that covers all aspects of processing candidates' data, except for transfer to the jurisdiction that does not provide adequate protection of data subjects' rights); and (ii) an acceptance of a user or information services agreement (the core condition of which shall be a necessity of transfer of data to the U.S., etc. for the purpose of fulfilling the agreement between the parties). Both consent and agreement may be placed, e.g. at the website, where a candidate should register.

Approval of data protection policies and bringing them to the attention of employees against signed receipt

The Law legitimises the use of the electronic signature of the employer (its representative) to sign resolutions on approval of internal policies related to personal data protection. For this purpose, employers may use an enhanced qualified electronic signature or enhanced unqualified electronic signature (in the latter case – if so agreed with the employee).

It is notable that electronic signatures created in accordance with foreign legislation and international standards are recognised as corresponding to the features of an enhanced electronic signature created in accordance with Russian legislation, if there is an appropriate international agreement with the participation of the Russian Federation. Due to the absence of such agreements with the U.S., the EU, and the EU Member States, the legal use of a foreign enhanced electronic signature (including a qualified one) is currently not possible. Thus, the possibility of the use of such foreign services by employers for employment law purposes is limited.

Employees may confirm receipt of local policies with the use of simple electronic signatures.

Thus, it is now legally possible to place local policies, e. g. on the intranet of a company, and avoid the collection of physical signatures of employees as an acknowledgement of signed receipt.

Andrey Slepov Partner
[email protected]
Elena Morozova Associate
[email protected]
ADVANT Beiten, Moscow

1. Please also refer to: https://www.dataguidance.com/opinion/russia-new-consent-requirements-data-processing