New rules in the field of cross-border transfer of personal data are adopted by the Russian Government.
The Russian Government approved the procedure for prohibiting and restricting the cross-border transfer of personal data, as well as the procedure for informing operators (the Decree of the Government of the Russian Federation No. 6 and the Decree of the Government of the Russian Federation No. 24). The new rules come into effect on March 1, 2023.
On the proposal of the Ministry of Defence of the Russian Federation, the Ministry of Foreign Affairs of the Russian Federation, the Federal Security Service of the Russian Federation and other state bodies authorized by the President of the Russian Federation or the Russian Government to protect the economic and financial interests of the country, Roskomnadzor may decide to prohibit or restrict the cross-border transfer of personal data.
The proposal must include the following information:
· the name of the foreign state in respect of which it is proposed to make a decision to prohibit or restrict the cross-border transfer of personal data;
· the description of the circumstances for prohibiting or restricting the cross-border transfer of personal data, as well as the indication of specific legislation;
· the conclusion on the content of the decision proposed for adoption by Roskomnadzor;
· information about the operator (operators) carrying out the cross-border transfer of personal data;
· the date from which the cross-border transfer of personal data should be prohibited or restricted.
Operators of personal data can also send notifications to Roskomnadzor or territorial authorities at their location. After consideration, a prohibition or restriction is imposed within 10 working days.
Roskomnadzor decides to prohibit the cross-border transfer of personal data in order to protect the morality, health, rights and legitimate interests of citizens in the following cases:
а) foreign authorities, foreign individuals and foreign legal entities take no measures to protect the personal data and conditions for termination of their processing are not defined;
б) a foreign legal is an organization whose activities are prohibited in the territory of Russia based on the judgment entered into force;
в) a foreign legal entity is included in the list of foreign and international non-governmental organizations whose activities are considered undesirable in the territory of Russia;
г) the cross-border transfer and further processing of the transferred personal data is incompatible with the purposes of collecting personal data;
д) the cross-border transfer of personal data is carried out in cases not provided for by the Law on Personal Data.
The basis for restricting the cross-border transfer of personal data in order to protect the morality, health, rights and legitimate interests of citizens are:
а) the content and volume of personal data planned for cross-border transfer do not correspond to the purpose of cross-border transfer of personal data;
б) categories of personal data subjects whose personal data are planned for cross-border transfer do not correspond to the purpose of cross-border transfer of personal data.
Nadmitov, Ivanov & Partners law firm advises on the protection and transfer of personal data.
Email: info@nplaw.ru
Tel..: +7 (495) 649-87-12