MOSCOW, August 8 Russian President Vladimir Putin has signed a law improving the procedure for depersonalizing personal data, its processing and circulation. The corresponding document has been posted on the portal for the official publication of legal acts.
The law improves the mechanism for processing personal data obtained as a result of their depersonalization. It establishes the specifics of processing personal data obtained as a result of depersonalization when forming the composition of such data and providing access to them. It establishes the procedure for forming the composition of personal data obtained as a result of their depersonalization, grouped according to a certain characteristic, provided that subsequent processing of such data does not allow determining their belonging to the subject of personal data.
A direct ban is being introduced on the formation of the composition of personal data and special categories and biometric personal data. The government, in agreement with the FSB, will establish requirements for the depersonalization of such data.
The personal data operator will be required, at the request of the Ministry of Digital Development, to depersonalize the processed data and provide it to the state information system (GIS), and the Ministry of Digital Development will have to ensure the confidentiality of this data.
Special requirements are being introduced for GIS users who will have access to information, but it will be prohibited to provide the results of processing data compositions to foreign persons and foreign organizations, as well as persons with an unexpunged criminal record, involved in extremist crimes and terrorist crimes.
It is envisaged to create a regional state information system in Moscow, which will receive non-anonymized personal data from regional personal data operators, which the authorized body of Moscow will anonymize in accordance with the requirements established by the highest executive body of Moscow in agreement with the FSB of Russia.
A ban is established on the processing of data compositions if the result of such processing may result in harm to life, health of people, insult to morality, violation of the rights and legitimate interests of citizens and organizations, harm (damage) to the environment, national defense and state security, cultural heritage sites, and other values protected by law. The law comes into force on the day of its official publication.