Roskomnadzor requirements for the content of consent given by data subjects for the dissemination of their personal data
Roskomnadzor requirements[1] (further the “Requirements”) for the content of consent given by data subjects for the dissemination of their personal data become effective on September 1, 2021. Amendments requiring personal data operators to obtain a separate consent from data subjects for the dissemination of their personal data were introduced to the Law On Personal Data[2] on March 1, 2021.
The dissemination of personal data is defined as any actions intended to disclose personal data to the public[3] (e. g. posting employees’ data on corporate websites, when an operator use a sample application completed by a data subject for public purposes, etc.)
Companies that would like to publish information about their employees on their website must obtain a separate consent from their employees before doing so, and the content of this consent must meet the Requirements set out by Roskomnadzor.
Roskomnadzor also requests operators to get their consent template for the dissemination of personal data approved. Using Roskomnadzor service, operators only need to fill out the required fields. The template will then be reviewed by Roskomnadzor, and recommendations for revising the consent template will be given to operators if necessary.
The Law On Personal Data also sets out that data subjects may provide their consent for personal data dissemination both directly to operators and using Roskomnadzor information system[4] although Roskomnadzor has yet to make this information system available.
It should be noted that data subjects are entitled to impose restrictions and prohibitions on operators and the public. In such case, operators must publish the conditions for personal data processing as well as the prohibitions and conditions for personal data processing by the public[5].
If you have any further questions, please feel free to write to Ekaterina Belyaeva.
Truly yours,
[1] Federal Service for Supervision of Communications, Information Technology and Mass Media Order No. 18 dated February 24, 2021 Approving the Requirements for the Content of Consent to Process Personal Data Allowed by Data Subjects to be Disseminated
[2] Federal Law No. 152-FZ On Personal Data dated July 27, 2006
[3] Article 3(5) Federal Law No. 152-FZ On Personal Data dated July 27, 2006
[4] Article 10.1(6) Federal Law No. 152-FZ On Personal Data dated July 27, 2006
[5] Article 10.1(9,10) Federal Law No. 152-FZ On Personal Data dated July 27, 2006