Personal data: new working rules from March 1, 2021

A number of significant amendments was adopted in December 2020 in the field of personal data protection, the majority of these amendments entered into force on March 1, 2021. The remaining changes will take effect on July 1, 2021.

We would like to bring to your attention the main legislative changes in this area.

1. No personal data can be published rather than with the express consent of a person.

The exception are the cases where a state or public interest is present.

Previously, the processing of personal data could be carried out even without the personal consent of a person, if access to such personal data was provided, for instance, by posting it on a social network.

• The concept of “publicly available personal data” is excluded.

A new concept has been introduced – “personal data allowed for dissemination”, that is, such data to which access by third parties is allowed.

Access of an unlimited number of persons to such data may be granted by a person by giving consent to the processing of personal data for the purpose of its subsequent use and dissemination.

• Consent to the dissemination of personal data does not have to be necessarily made in writing.

In accordance with the draft regulation of the Federal Service for Supervision of Communications, Information Technologies and Mass Communications, consent shall be issued separately and can be provided using an IT-system or in writing.

When registering consent in electronic form, an electronic signature of the person giving consent to the processing of personal data is necessary.

• The subject of personal data has the right to establish prohibitions on the transfer of data to specific entities.

It is possible to specify certain entities who are prohibited from transmitting personal data, as well as establish prohibitions on data processing in the consent to data processing. The operator’s refusal to establish these prohibitions by a person is not allowed.

Nevertheless, data transfer is allowed even if the person has indicated that he does not allow the transfer of his data to third parties if the information is requested by the Russian Pension Fund, the Federal Tax Service or the military enlistment office.

• A person’s silence or inaction cannot be qualified as the consent to the processing of personal data.

Under no circumstances can the inaction of a person who is the subject of personal data be regarded as an expression of the consent to the data processing and dissemination.

Moreover, even if the person has previously agreed to the dissemination of personal data, such consent is invalid from the moment when the person requested to stop the transfer of his data.