Look But Don't Touch — Russia To Restrict Processing Of Public Data

This article was first published on the IAPP Privacy Advisor.

Beginning March 1, 2021, Russia will impose restrictions on the processing of personal data publicly available on the internet and offline. The legislative changes are aimed at fighting the uncontrolled dissemination of personal information.

Change of lawful basis

Under current Article 6(1)(10) of the federal law "On Personal Data" No.152-?? dated July 27, 2006, any data operator (the Russian equivalent of the term controller) may process personal data if the data subject made it publicly accessible or instructed another person to do so. In contrast with Article 6(1) of the EU General Data Protection Regulation, there is no need to ground the processing on legitimate interests, the performance of a contract, data subject's consent or other common lawful bases. When "Amendments to the Federal Law on Personal Data" No.519-?? dated Dec. 30, 2020, goes into effect, this rule and the term publicly