On the 24th of May 2022 State Duma approved in the first reading a draft law No. 101234-8 “On amendments to the Federal Law “On personal data” and other legislative acts of Russian Federation on the matters of protection of personal data subjects” (the Draft). The Draft was created in order to increase the protection of privacy of the subject of personal data.
The Draft introduces the following changes to the Federal Law “On personal data”:
|
Art. 11. Prohibition of service refusal |
|
|
Subsec. 3 |
Introduces a ban for operators to refuse provision of services if a client refuses to give access to personal information (including biometric data) and is not obliged by law to provide it. |
|
Art. 11. Biometric data of underaged persons |
|
|
Subsec. 1.1 |
Introduces a ban on processing biometric data of people under 18 years old. |
|
Art. 12. Notification of Roscomnadzor |
|
|
Subsec. 3 |
Introduces an obligation of the operators to inform Roscomnadzor about the operator’s intention to perform a cross-border data transmission. |
|
Art. 12. Prohibition of cross-border data transmission |
|
|
Subsec. 5 |
Allows prohibition or restriction of cross-border data transmission by Roscomnadzor in order to guarantee protection of civilians’ rights and legal interests, the protection of constitutional order or the provision of national security. |
|
Subsec. 10 |
Constitutes that a decision on the prohibition or restriction is announced in 30 days after the notification of Roscomnadzor. |
|
Subsec. 12 |
Bans cross-border data transmission to the foreign countries while Roscomnadzor is processing the notification. |
|
Art. 14. Changes in the provisions on obligation periods |
|
|
Subsec. 1.2 |
Introduces an obligation of the operators to stop the processing of personal data in 30 days after receiving such request from the subject of aforementioned data. |
|
Subsec. 3 |
Reduces the deadline of the response period to the questions about illegal processing of personal data from 30 days to 10 days. |
|
Art. 21. Notification of Roscomnadzor |
|
|
Subsec. 3.1 |
Introduces an obligation of the operators to inform the governmental bodies about illegal or accidental emissions, transfers or provisions of personal data. |
|
Subsec. 7 |
Introduces an obligation to prove the destruction of personal data in accordance with Roscomnadzor’s provisions. |
Furthermore, it is important to note the inclusion of para. 2.1 in art. 3, which contains a definition of the “subject, which processes personal data” or, in other words, “the processor by commission”. Previously the experts of personal data did not actively use this term in practice, however, unlike the «processor» in GDPR, the status of such a subject is not much different from the operator. When constructing the model of cooperation in processing of personal data, a vast majority of companies (especially foreign ones) use the model of “the processor by commission” to minimize their liability. However, Roscomnadzor did not distinguish between these subjects and acknowledged the latter the same as the full-fledged operators. Probably, in the case of implementation of the Draft, Roscomnadzor’s approach is due to change.
In addition, the Draft introduces the following changes to the Federal Law No. 218-FL “On State registration of Real Estate” from 13.07.2015:
The Draft proposes to introduce article 36 in the Federal Law "On State Registration of Real Estate" under the title "Provisions on making an entry in the Unified State Register of Real Estate about the possibility of providing personal data of the owner of a real estate object contained in the Unified State Register of Real Estate".
This article introduces the possibility to provide personal data contained in the Unified State Register of Real Estate to third parties with the consent of the subject of personal data. The change will allow third parties to gain access to information about the restriction of the real estate right or encumbrance.
|
The proposed algorithm of providing personal data to third parties: |
||
|
|
Registered real estate object |
Unregistered real estate object |
1. |
The subject submits an application of consent to the Unified State Register of Real Estate on paper in person or in electronic form through a personal account. |
The subject puts a mark in the application of state registration of the right to real estate. |
2. |
Unified State Register of Real Estate notifies the subject of the application through a personal account or email address on the day of application receipt. |
|
3. |
A record of consent to the provision of personal data is entered in the Unified State Register of Real Estate within no more than 3 working days from the date of the application receipt. |
|
The circumstances that are sufficient to obtain an extract include:
-
Contract for the performance of works in relation to the real estate object;
-
Preliminary agreement on the alienation of a real estate object;
-
Intention of a third party to file a claim to protect their right to participate in the privatization of real estate;
-
Intention of a third party to file a claim to compensate the damage caused to his person or property;
-
Existence of grounds for a third party to file a claim against the copyright holder;
-
Whether a third party has grounds for foreclosure of a real estate object.
The provision of the extract is also possible at the request of the subject of personal data.