This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| Federal Law "On Personal Data" | |
|---|---|
| Title | Federal Law "On Personal Data" |
| Enacted | 2006 |
| Jurisdiction | Russian Federation |
| Status | in force |
Federal Law "On Personal Data"
The Federal Law "On Personal Data" is a Russian statute establishing rules for collection, storage, processing, and protection of personal data within the Russian Federation, balancing privacy safeguards with obligations for Ministry of Internal Affairs of Russia, Federal Service for Supervision of Communications, Information Technology and Mass Media, Federal Security Service of the Russian Federation, Russian President, State Duma, and Federation Council. It interfaces with international instruments and national statutes such as Constitution of the Russian Federation, Civil Code of the Russian Federation, Code of Administrative Offences of the Russian Federation, Criminal Code of the Russian Federation, Federal Law "On Information, Information Technologies and Information Protection", and Federal Law "On State Secrets". The law affects public bodies, private enterprises like Yandex, Sberbank, Gazprom, Rosneft, VKontakte, Mail.Ru Group, and global actors such as Google, Microsoft, Meta Platforms, Inc., Apple Inc., Amazon (company), and Huawei Technologies Co., Ltd..
The law aims to ensure rights of individuals including citizens like Vladimir Putin and residents in regions such as Moscow, Saint Petersburg, Kazan, and Novosibirsk by regulating processing consistent with principles advanced by entities like Council of Europe, Organisation for Economic Co-operation and Development, and milestones such as Convention 108. It seeks to reconcile interests of organizations including Bank of Russia, Roscosmos State Corporation, Gazprombank, VTB Bank, and Russian Railways with public safety priorities reflected in decisions by Supreme Court of the Russian Federation and directives from the Constitutional Court of Russia.
The law defines "personal data" with reference to examples involving persons such as Dmitry Medvedev, Sergei Shoigu, Elvira Nabiullina, and sectors like Ministry of Health of the Russian Federation, Federal Tax Service (Russia), Pension Fund of the Russian Federation, and Federal Migration Service. It distinguishes operators and processors including entities like Rostelecom, MTS (network provider), MegaFon, Transneft, Russian Post, and Gazprom Neft, and exempts data related to public figures highlighted in contexts like Sochi 2014 Winter Olympics, 2018 FIFA World Cup, Saint Petersburg International Economic Forum, and Spasskaya Tower Military Music Festival and Tattoo.
Core principles reference transparency requirements applied to bodies such as Moscow City Duma, Tver Oblast Administration, Sverdlovsk Oblast Government, and companies like Rosatom State Corporation and Lukoil. Principles include lawfulness and fairness invoked in rulings by the Constitutional Court of the Russian Federation, purpose limitation seen in practices at Russian Academy of Sciences, data minimization in projects by Skolkovo Innovation Center, accuracy obligations affecting Higher School of Economics (National Research University), and storage limitation relevant to institutions such as Federal Security Service of the Russian Federation and Ministry of Defence (Russia).
Individuals possess rights to access, rectify, and demand cessation of processing involving organizations like Sberbank CIB, VTB Capital, Rostec, Tinkoff Bank, Alfabank, and cultural institutions like Hermitage Museum, Tretyakov Gallery, and Bolshoi Theatre. Rights intersect with administrative remedies before agencies including Prosecutor General of Russia, Federal Service for Supervision of Communications, Information Technology and Mass Media, and adjudication by Arbitration Court of Moscow, Moscow City Court, and Supreme Court of the Russian Federation.
Operators and processors such as Yandex.Market, Ozon Holdings, Wildberries, SberDevices, Rostelecom-Solar, and cloud providers like Selectel must register databases, implement internal policies, appoint responsible officers, and coordinate with bodies like Federal Service for Supervision of Communications, Information Technology and Mass Media and Roskomnadzor. Obligations mirror compliance frameworks used by multinational firms including SAP SE, Oracle Corporation, IBM, Cisco Systems, and Accenture.
Processing requires legal grounds such as consent, contract performance, legal obligations, protection of life, and public interest—mechanisms also present in EU laws like General Data Protection Regulation and referenced by courts in cases involving European Court of Human Rights and bilateral dialogues with states such as China, Belarus, Kazakhstan, and organizations like BRICS. The consent regime affects sectors including telecommunications Rostelecom, finance Sberbank, healthcare Federal Medical-Biological Agency of Russia, and advertising firms like GroupM and Dentsu.
Security obligations require technical and organizational measures adopted by entities including Rosatom, Ministry of Digital Development, Communications and Mass Media of the Russian Federation, National Guard of Russia, Russian Academy of Medical Sciences, and private cybersecurity firms like Kaspersky Lab, Group-IB, and Positive Technologies. Measures cover encryption, access control, incident response, and localization of personal data storage often debated in forums such as St. Petersburg International Legal Forum, Moscow Digital Forum, and by regulators including Roskomnadzor.
Enforcement is conducted through administrative fines, criminal sanctions, and supervisory orders executed by Roskomnadzor, prosecutions by Prosecutor General of Russia, and judicial review in courts from District Court of Moscow to the Supreme Court of the Russian Federation. Liability affects corporations like Yandex, Mail.Ru Group, Sberbank, and executives accountable in high-profile matters adjudicated alongside regulatory action from institutions such as Central Bank of Russia and international litigation involving European Court of Human Rights or arbitration panels under treaties like Energy Charter Treaty.
Category:Russian federal laws