The Ministry of Telecommunications and Mass Communications of the Russian Federation (‘Minsvyaz’) issued, on 25 April 2018, a draft Federal Law on Amending the Federal Law of 27 July 2006 No. 152-FZ On Personal Data (‘the Draft Law’). In particular, the Draft Law proposes to amend Articles 9 and 11 of the Federal Law of 27 July 2006 No. 152-FZ On Personal Data (‘the Personal Data Law’) in order to regulate consent for the processing of personal data, as well as to introduce a requirement to obtain consent for the processing of biometric data.
Natalia Gulyaeva and Maria Sedykh, Partner and Associate at Hogan Lovells (CIS) respectively, told DataGuidance, “[If the] Draft Law comes into force, […] private companies [may] have to amend their standard consent forms […] to allow data subjects to choose the [specific] processing purposes [for which they] provide their personal data. [Currently,] processing by data operators is usually based on a broad form of consent, which […] data subjects [must agree to], as operators simply state that without signing such broad consent, […] data subjects may not receive the required service at all.”
In particular, the Draft Law stipulates that data subjects would be granted a right of refusal when their data is being processed outside the realms of what was agreed with the data operator when consent was initially provided. In addition, the Draft Law grants data subjects the ability to amend their consent to the processing of personal data in response to changes in the purpose, the volume of personal data processed or the conditions for processing them.
The necessity to obtain consent from legal representatives to process minor’s personal data is generally in line with European legislation
Gulyaeva and Sedykh highlighted, “[Furthermore,] the Draft Law proposes that consent should be required for the processing of biometric data of minors under 14 years of age, [and that it must be] provided by their legal representatives. The necessity to obtain consent from legal representatives to process minor’s personal data is generally in line with European legislation, though the age may differ.”
Moreover, the Draft Law advances an amendment of Part 2 of Article 18.1 of the Personal Data Law in order to clarify requirements on the placement of privacy policies regarding the processing of personal data on the internet by data operators.
Gulyaeva and Sedykh concluded, “The Draft Law specifies that, […] data operators who collect personal data online, must publish their privacy policies on the same website where collection of personal data takes place. This is an important specification for data operators that have various websites targeted at different products and services for instance, as it would require private businesses to develop and publish different privacy policies for each of their online platforms.”
The public consultation on the Draft Law is open until 18 May 2018.
HOLLY HIGHAMS | Junior Privacy Analyst