Review of amendments to personal data laws

Starting March 27, 2021, liability for violations of personal data laws will increase.

Federal Law No.19-FZ dated 24.02.2021 that will take effect starting March 27, 2021 amends Article 13.11 of the Administrative Offenses Code of the Russian Federation, doubles the amount of fines and adds increased fines for repeated commitment of certain offenses:

 

The new law also amends Part 1 Article 4.5 of the Administrative Offenses Code of the Russian Federation and extends the statute of limitations period for personal data offenses from 3 months to 1 year. 

We also remind you that starting March 1, 2021, new rules for personal data dissemination took effect.  Now disseminating personal data of the subject requires obtaining their consent in the manner of a separate document. The Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) will establish specific requirements for the contents of the consent.

These amendments will apply to companies that process publicly available personal data or publish personal data themselves. The amendments also affect cases when companies publish photos and data of their employees on corporate web sites.

Taking into account the above, companies are encouraged to assess the need to obtain consent from employee for disseminating their personal data in compliance with the new rules. As specified above, starting March 27, 2021, liability for legal entities not having consent will be a fine in the amount from RUB 30,000 to 150,000 and from RUB 300,000 to 500,000 in case a of repeated offense.

 

This overview is prepared by Capital Legal Services Partner Dmitry Churin and Senior Associate Vadim Kovalyov.