The end of 2017 was marked with a few interesting court decisions, which may be useful for businesses to know for the assessment of their future dealings in Russia. Some of the decisions confirmed our earlier understanding of the relevant legal provisions or the earlier verbal clarifications of the regulator:
Photos on ID documents are considered biometric personal datai
Companies should take a closer look at the data they are processing and take this decision into account. Potentially the companies may want to delete or destroy any documents with photos from ID documents as, otherwise, such processing requires the implementation of additional compliance measures.
Consents need to be specific. Too general language should be avoided
The court confirmed ii that consents allowing the transfer of personal data to third parties must be sufficiently specific. In other words, it is not allowed to stipulate, for instance, that 'the operator is allowed to transfer personal data to third parties'. It is necessary to specify the relevant third party recipients with their full names and legal addresses so that individuals can refuse to authorize such transfers. In this particular case, the relevant consent was included in the insurance policy of the insurance company. Therefore, the insurance company would now need to update its template documents in order to comply with the law.
Job applicants' data is covered by employment purposes
In the decision of Arbitrazh Court of the Irkutsk Region the court confirmed iii that the collection of job applicants' data is covered by employment purposes (and such purposes allow an exemption from the Roskomnadzor registration requirement) and no registration with Roskomnadzor is necessary.
There is no obligation to update passport data or information on residence even if a credit contracts requires this
The defendant (Russian Agricultural Bank) obliged its clients (individuals) in credit contracts to mandatorily provide information on any changes to the individual's passport data and actual residence. Based on the Federal Law on Consumer Credits, consumers are only obliged to update their contact details if they change. There is no obligation to update passport data or information on residence. Therefore, the court rulediv that such a provision obliging individuals to update their passport data and information on residence is illegal.
Footnotes
i Decision of the Federal Arbitrazh Court of the North-Western District No. А42-342/2017 dated 21 November 2017
ii Decision of the Arbitrazh Court of Moscow No. А40-174258/17-72-1378 dated 23 November 2017
iii Decision of the Arbitrazh Court of Irkutsk Region No. А19-17054/17 dated 21 November 2017
iv Decision of the Arbitrazh Court of Perm Region No. А50-28816/2017 dated 21 November 2017
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.