О персональных данных

The law creates a legal basis for handling personal data of individuals in order to implement constitutional human rights, including the right to privacy, personal and family secrets.

Personal data is any information about an individual, including his last name, first name, patronymic, year, month, date and place of birth, address, family, social, property status, education, profession, income, and other information.

The principles and conditions for the processing of personal data have been determined. By establishing a general prohibition on the processing of personal data without the consent of the subject of personal data, the law provides for cases when such consent is not required. Separately, relations are regulated for the processing of special categories of personal data (information about race, nationality, political views, religious or philosophical beliefs, health status, intimate life). The processing of these categories of information is not allowed without the prior consent of the subject of personal data, except for cases when personal data is publicly available, data processing is necessary to ensure the life and health of a person; processing is carried out in connection with the administration of justice, as well as other circumstances.

The most important guarantee of the rights of the subject of personal data is the obligation of operators and third parties who have access to personal data, to ensure their confidentiality (except for cases of their depersonalization and publicly available personal data), as well as the right of the subject of personal data to protect their rights and legitimate interests, including for damages and (or) compensation for non-pecuniary damage in court.

Control and supervision over the processing of personal data is entrusted to the federal executive body exercising control and supervision functions in the field of information technology and communications, which is endowed with appropriate rights and obligations. In particular, the authorized body has the right to check the information system for processing personal data, make demands on blocking, deleting inaccurate or unlawfully obtained personal data, establish a permanent or temporary ban on the processing of personal data, conduct administrative investigations on violations of the law.

The principles of cross-border data transfer are established, in which adequate protection of the rights of subjects of personal data should be ensured.

Operators who process personal data prior to the entry into force of the law are required to send a notification to the authorized body for the protection of the rights of personal data subjects no later than January 1, 2008.

Personal data information systems created before the date of entry into force of the law must be brought in line with its requirements no later than January 1, 2010.