Separate consent required by new rules for processing publicly available personal data
On 1 March 2021 amendments to the Federal Law “On Personal Data” will take effect. These latest changes prohibit personal data obtained from public sources from being processed without the subject’s consent. There is an exception for processing personal data obtained from publicly available sources in the state, public or other public interest.
The law introduces a new term: personal data permitted for dissemination. This means personal data to which the data subject has granted public access by giving consent to process the personal data which the data subject has permitted for dissemination.
Starting 1 March, additional consent from the data subject must be obtained in order to publish personal data. The subject must grant express permission to disseminate their personal data.
In contrast, the current version of the law allows personal data obtained from publicly available sources to be processed without the subject’s consent. Nevertheless, the courts have not considered personal data that are publicly available to be publicly accessible in all cases (Decision of the Arbitration Court of Moscow of 5 May 2017 in case No. A40-5250/17-144-51). The new amendments eliminate the legal uncertainty in this matter.
If personal data have been disclosed to the public as a result of an offence, crime or force majeure, each person who has disseminated or otherwise processed such personal data must furnish proof that the subsequent dissemination or other processing of personal data were lawful.
Any transfer (dissemination, provision, access) of personal data which the data subject has permitted for dissemination shall end within three business days of receipt of the data subject’s request. The request must include the subject’s surname, first name, patronymic (if any), contact information (phone number, e-mail or mailing address), as well as a list of the personal data that must stop being processed. The personal data specified in the request can be processed only by the operator to whom it is sent. If the operator fails to comply with this requirement, the data subject will be entitled to seek redress in court.
The new amendments set clear criteria for the lawful processing of personal data obtained from public sources; however, the requirement to obtain the subject’s separate consent to such processing may significantly complicate the work of personal data controllers.