5 Apr 2022 20:30

Bill on possible ban on transfer abroad of Russians' personal data being submitted to State Duma - Duma's Khinshtein

MOSCOW. April 5 (Interfax) - A bill to tighten protection of Russian citizens' rights to the inviolability of their private life as personal data subjects is being submitted to the State Duma on Tuesday, head of the State Duma Committee on Information Policy Alexander Khinshtein said.

The explanatory note said that the current legislation does not, in practice, regulate the cross-border transfer of personal data, which poses a major threat in the current foreign policy situation.

At the same time, more than 2,500 operators are currently transferring the personal data of Russian citizens to unfriendly countries where these data are not properly protected, according to the Federal Communications watchdog, Roskomnadzor. This was referenced in the bill, information about which was published by Khinshtein on his VKontakte page.

The bill noted that in the case of cross-border data transfer, it is not the organizational and legal form of the recipient, but its location in a foreign country that is decisive.

It stipulates the obligation of operators to inform the competent authorities of the intention of the cross-border transfer of personal data.

The cross-border transfer of personal data may be prohibited or restricted in order to protect the foundations of the Russian constitutional system, morality, health, rights and lawful interests of Russian citizens, and to ensure the defense and security of the country.

The decision to prohibit or restrict the cross-border transfer of personal data in order to protect the morals, health, rights and legitimate interests of Russian citizens shall be made by Roskomnadzor upon the review of the operator's notice of the intention to transfer personal data across borders.

With regard to the issues of cross-border transfer of personal data in order to protect the foundations of the Russian constitutional order and national security, this is done upon the request of the Interior Ministry; with regard to personal data in order to ensure national defense - upon the request of the Defense Ministry; personal data in order to protect Russia's economic and financial interests - upon the request of federal executive authorities authorized by the Russian president or the Russian government.

The decision to prohibit or restrict the cross-border transfer of personal data shall be made within 30 days of receipt of the notice.

In exceptional cases, where there are threats to defense, security or the foundations of the constitutional order, this transfer may be restricted by a decision of an authorized government agency.

The bill introduces the extraterritorial application of the Russian legislation on personal data.

It also establishes the possibility of interference by authorized authorities with the processing of personal data of Russian citizens in other countries.