The Evolution of Personal Data Regulation in Russia
Specialists in personal data protection have been actively working with Federal Law No. 152-FZ since 2013. Prior to the introduction of Article 10.1, experts, guided by data processing principles and requirements of Articles 5 and 6, recommended obtaining a separate consent for the dissemination of personal data. This contrasted with the then-common practice of including a clause in general consent forms stating that all personal data was considered publicly available, a practice now largely obsolete.
Article 10.1 Enactment and Initial Reactions
March 1, 2021, marked the effective date of Article 10.1, which mandates that consent for processing personal data permitted by the subject for dissemination must be obtained separately from other consents. Initially, this amendment was seen as a validation of prior recommendations. However, a more detailed analysis revealed several questions and ambiguities.
Difficulties arose in interpreting key terms such as “conditions” and “prohibitions.” The mechanisms for data transfer “excluding access provision” and processing “excluding access acquisition” remained unclear. Furthermore, the form, designed primarily for internet resources, proved inadequate for situations where personal data is displayed on physical media, such as honor boards.
Seeking Meaning and Reasons Behind the Changes
Months were spent attempting to understand the new legislative construct as a cohesive system. It became evident that a standard textual interpretation was insufficient. A complete understanding required reconstructing the history of the bill: who, when, and why changes were made between the first and second readings, what problem its authors sought to solve, and what they intended by the new dissemination regime. It was discovered that the law’s concept was significantly revised within days, without public discussion, raising concerns about the practical applicability of the resulting text.
The analysis of Article 10.1’s evolution highlights critical gaps in legislative drafting, particularly regarding the ambiguity of ‘conditions’ and ‘prohibitions’ for data dissemination. The lack of clarity around ‘excluding access provision’ mechanisms poses significant operational challenges for compliance officers, especially when balancing digital and physical data display requirements. Such rapid, undiscussed revisions between readings often lead to the practical inconsistencies now being observed in Federal Law No. 152-FZ’s implementation.