The Federation Council has approved the draft law on amendments to Article 12 of the Law on Personal Data and number of legislative acts.
Previously the Law on Personal Data established two criteria based on which a foreign state was deemed to provide “adequate” level of protection for the purposes of cross-border transfer of personal data:
The new draft law removes the first criterion. Formal membership in Convention 108 will no longer guarantee a simplified procedure for cross-border transfers of personal data. Going forward, the decisive factor will be solely the list of countries approved by Roskomnadzor.
At the same time, pursuant to the new wording of the Article 12 provides, the Roskomnadzor list shall include countries whose personal data regulations and practical protective measures are, in Roskomnadzor’s opinion, consistent with the principles of Convention 108.
Other changes introduced by the draft law:
All provisions of the draft law, except for Article 2, shall enter into force on the date of its official publication. Article 2 shall enter into force on 1 September 2027.
Previously the Law on Personal Data established two criteria based on which a foreign state was deemed to provide “adequate” level of protection for the purposes of cross-border transfer of personal data:
- the state is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108);
- the state is included in the list of countries providing adequate protection of personal data subjects’ rights, maintained by Roskomnadzor.
The new draft law removes the first criterion. Formal membership in Convention 108 will no longer guarantee a simplified procedure for cross-border transfers of personal data. Going forward, the decisive factor will be solely the list of countries approved by Roskomnadzor.
At the same time, pursuant to the new wording of the Article 12 provides, the Roskomnadzor list shall include countries whose personal data regulations and practical protective measures are, in Roskomnadzor’s opinion, consistent with the principles of Convention 108.
Other changes introduced by the draft law:
- Article 2 of the draft law introduces a provision on the creation and operation of information systems of city and municipal authorities in Moscow on a unified technological platform, upon decision of the mayor;
- The draft law also grants the Russian Government the authority, until 2030, to establish a special regulatory regime in selected regions designated by the President. This applies to postal services, telecommunications services, the state system for counter cyber-offences, and the security of critical information infrastructure.
All provisions of the draft law, except for Article 2, shall enter into force on the date of its official publication. Article 2 shall enter into force on 1 September 2027.