Russia: Adopted Law No. 152-FZ on Personal Data including data protection regulation

On 14 July 2006, the Federation Council adopted Law No. 152-FZ on Personal Data, including data protection regulation. The Law establishes rules for the processing of personal data and measures to ensure the protection of the rights to privacy and personal and family information. Personal data is defined as any information relating to an individual that allows its identification, including last name, first name, patronymic, year, month, date and place of birth, address, marital, social, property status, education, profession, and income. Furthermore, the Law outlines principles of personal data processing, conditions for the processing of personal data, obligations to the confidentiality of personal data and conditions for consent to the processing of personal data to be valid. The Law specifies that entities must obtain explicit consent from individuals to process special categories of data and biometric data. Regarding cybersecurity, the Law requires entities collecting personal data to implement measures to ensure the security of personal data during their processing. In particular, the Law states that entities are required to implement organisational and technical measures, such as encryption, to ensure the protection of personal data. The authorised body for ensuring the protection of the rights of data subjects and compliance with the Law's provisions is the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor). Finally, the Law specifies that prior to the processing of personal data, the entities are required to notify Roskomnadzor regarding their intention to process data and outlines exemptions to the requirement. The Law enters into force 180 days after its publication in the Official Monitor.