Currently the Draft Law No. 992331-7 is considered by the Russian Federation State Duma. Perhaps it is the most anticipated document in the field of personal data since the proposed changes in 152-FZ are designed to reduce the number of pain points for both operators and consultants in the information protection sphere.
The most significant innovation is a new approach to the content of written consent. In particular, the data controller (operator) would be able to indicate two or more purposes of data processing in one consent. The lawmaking body proposes to eliminate the defect in the wording of paragraph 4, part 4, Article 9 of the Federal Law «On Personal Data», which is too inconvenient for data controllers of special categories or biometric personal data as well as which conduct the cross-border transfer of personal data into the territories of foreign states which do not provide adequate protection of the personal data subjects’ rights. Now it is possible to include several purposes in one consent form with mandatory indication of the following provisions: (1) a list of personal data to the processing of which the consent of the personal data subject is given; (2) name or surname, first name and patronymic and the address of the person who is to carry out the processing of the personal data on the instruction of the data controller; (3) a list of actions involving personal data to the performance of which consent is given, and a general description of the methods of personal data processing which are to be used by the data controller; (4) the period for which the consent of a personal data subject is given, and the procedure for withdrawal of that consent.
Another important feature of the Draft Law No. 992331-7 is possibility for data controller to specify a number of data processors (the person who is to carry out the processing of the personal data on the instruction of the data controller). The current provisions of the Federal Law «On Personal Data» provide for the right to indicate only one data processor in the written consent.
The structure of the new written consent could be graphically represented as follows:
It should be noted that Roscomnadzor already highlighted his approach regarding several purposes at the seminar held on November 26, 2020: two or more purposes could be specified in the consent in cases where there is no processing of biometrics, special categories of data, and there is no cross-border transfer of personal data into the territories of foreign states which do not provide adequate protection of the personal data subjects’ rights. Thus, after the adoption of the Draft Law as well as if additional requirements are met, it will be possible to indicate a list of purposes for any categories of personal data, as well as to entrust their processing to several persons.