Compliance with the requirements of the law:
Amendments were made to Art. 18 of the Federal Law "On Personal Data", in clause 5 of which it is indicated that when collecting personal data, the operator is obliged to ensure the recording, systematization, accumulation, storage, clarification and extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.
Based on the interpretation of the norm, it can be concluded that there is a mandatory requirement for the implementation of actions named in the law on the territory of Russia. That is, these types of operations must be carried out with the fulfillment of the requirement for “localization” on the territory of Russia.
“Localization” can be done in any form, both electronic and paper.
In clause 5 of Art. 18 provides for a number of exceptions:
- Processing necessary for the implementation of the functions assigned by law to the operator. At the same time, this fact will be established and verified in each specific case by Roscoe supervision
- Processing is necessary for the administration of justice or the execution of an act
- Processing is necessary for the fulfillment of the powers of federal executive bodies
- Processing is necessary for the implementation of the professional activity of a journalist or the legitimate activity of the media or scientific, literary or other creative activity, provided that this does not violate the rights and legitimate interests of the subject of personal data
Currently, the legislation does not provide for any special rules establishing responsibility for violation of the rules for localizing personal data.
However, the following sanctions may be imposed on entities violating the localization rules:
a) Article 13.11 of the Administrative Code of the Russian Federation establishes a fine for violating the procedure for collecting, storing, using or distributing personal data. The fine for such violations is not more than 10 thousand rubles
b) As another sanction, the possibility of entering domain names and network addresses into the register of violators of the rights of subjects of personal data may be applied
Cross-border data transfer:
According to Article 3 of the Law on Personal Data, cross-border transfer of personal data is the transfer of personal data to the territory of a foreign state to a foreign state authority, a foreign individual or a foreign legal entity.
In addition to the possibility of prohibiting the cross-border transfer of personal data in order to protect the foundations of the constitutional system of the Russian Federation, morality, health, rights and legitimate interests of citizens, ensuring the country's defense and state security, there are no restrictions on the transfer of personal data to countries that provide adequate protection of the rights of subjects in the law.
Countries that provide adequate protection are countries that are parties to the Convention, as well as foreign states, the list of which was established by Roskomnadzor in Order No. 274 “On Approving the List of Foreign States Not Parties to the Council of Europe Convention on the Protection of Natural Persons with regard to Automated Processing of Personal Data and ensuring adequate protection of the rights of subjects of personal data "
The authorized body compiles a list of foreign states that are not parties to the Council of Europe Convention for the Protection of Individuals with regard to Automated Processing of Personal Data and that provide adequate protection of the rights of subjects of personal data.
The law also obliges the operator to make sure that the foreign state, to whose territory the transfer of personal data is carried out, provides adequate protection of the rights of subjects of personal data.
At the same time, in accordance with clause 4 of article 12 of the Federal Law of July 27, 2006 No. 152-FZ "On Personal Data", cross-border transfer can be carried out in the following cases:
- The presence of the written consent of the personal data subject
- Provided by international treaties of the Russian Federation
- Provided by federal laws, if necessary in order to protect the foundations of the constitutional order of the Russian Federation
- Execution of an agreement to which the personal data subject is a party
- Protection of life, health, other vital interests of the subject of personal data or other persons if it is impossible to obtain written consent of the subject of personal data
- Notify Roskomnadzor of the ongoing cross-border transfer
- Inform the subject of personal data before the start of processing of his personal data about the ongoing cross-border transfer
- Reflect the conditions for the cross-border transfer of personal data in the internal regulatory documents of the operator
- Provide data link protection
The new law prohibited the cross-border transfer of personal data to databases located outside of Russia. However, in accordance with the explanations of the Ministry of Communications, the amendments to the Federal Law "On Personal Data", introduced by the Federal Law No. 242, did not affect the provisions of the law on cross-border data transfer.
Therefore, the cross-border transfer of personal data outside Russia is allowed, as before, subject to the conditions specified in Art. 12 of the Federal Law "On Personal Data".
Nadmitov, Ivanov and Partners Law Firm provides legal services and represents interests of clients in the field of data protection, localization of personal data in Russia and cross-border data transfer.