New law on personal data coming into force in Russia


A New Law on Personal Data (the Law) adopted by State Duma earlier this year will come into force as of January 27, 2007.

The Law will regulate processing of personal data by individuals, legal entities, local, regional and federal authorities. Principal novelties of the Law include new definitions, introduction of measures to ensure personal data confidentiality and protection, establishment of principles of personal data processing, definition of rights of individuals - personal data subjects, and rights and obligations of personal data operators. The Law also introduces the procedure for trans-border data transfer, and imposes supervision and control of compliance of personal data processing on a specially authorized body for the protection of rights of individuals with regard to personal data.

It is expected that the Law will protect rights of individuals for confidentiality of personal data collecting and processing, including any information related to an individual, such as name, date and place of birth, address of residence, information about marital and social status, property, education, profession, income etc. The Law defines special categories of personal data which cannot be processed, including nationality, political views, health and private life, etc.

Adoption of the Law was largely caused by ratification of the Council of Europe's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.