In late August, the Russian Ministry of Digital Development introduced the draft law "On the Introduction of Changes in Individual Legislative Acts of the Russian Federation (as Regards Combatting Offenses Committed with the Use of Information and Communions Technologies)" via the federal portal of draft regulatory legal act (project ID: 02/04/08-25/00159652) (hereinafter - Draft Law).
According to the explanatory note, the goal of the Draft Law is to comprehensively refine measures for combatting crimes committed with the use of information and communications technologies.
In our previous overview dedicated to the initiative at hand, we analyzed the changes introduced to the Federal Law "On Information and Information Technologies and on the Protection of Information". This time, we propose to analyze the amendments being introduced to the Federal Law "On Personal Data" (hereinafter, the "Personal Data Law").
Key Amendments to the Personal Data Law:
Under the draft law, consent to the processing of personal data - and its subsequent withdrawal - may be provided by the data subject through the Unified Identification and Authentication System (ESIA). The specific procedure and applicable cases will be determined by the Government of the Russian Federation;
Information regarding consents granted by the data subject directly to an operator (as well as their withdrawal) must be transmitted by operators to ESIA, in the manner and cases established by the Government of the Russian Federation;
When providing consent through ESIA, standardized forms will be used. These forms will be developed jointly by the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor) and the Ministry of Digital Development, Communications, and Mass Media (MinTsifry);
It is planned that information regarding the processing of a data subject’s personal data will be displayed in the user’s personal account on the Gosuslugi portal. Users registered in ESIA will be able to access information on the processing of their personal data (based on consents they have granted) through their Gosuslugi accounts;
If, after reviewing this information in their Gosuslugi account, a data subject believes that an operator is processing their personal data unlawfully, they will be able to file a complaint regarding the operator’s actions or omissions with Roskomnadzor through the Gosuslugi portal;
A new special category of personal data is being introduced - namely, data concerning the participation of citizens of the Russian Federation in the special military operation and / or in counterterrorism operations, as well as data on their family members. This new category will be subject to restricted processing, which will only be permitted in cases explicitly provided for by law.
Most of the proposed amendments are expected to enter into force on March 1, 2028, while the provisions introducing the new "special category" of personal data are scheduled to take effect on September 1, 2026.