In accordance with the Federal Law of 27 July 2006 No. 152-FZ on Personal Data (hereinafter referred to as the Law), personal data means any information relating directly or indirectly to a particular or identifiable person (personal data subject). Personal data processing means any action (operation) or a combination of actions (operations) performed both automatically and manually with personal data, including collection, recording, arrangement, accumulation, storage, specification (updating, changing), extraction, use, distribution (including transfer), anonymizing, blocking and destruction of personal data.
In accordance with the Item 1.1 of the Article 6 of the Law, processing of personal data is carried out with the consent of the data subject to the processing of his personal data.
In accordance with the Article 9 of the Law, a personal data subject shall decide whether or not to provide his personal data and shall give consent to the processing thereof freely, of his own will and in his own interest. Consent to the processing of personal data shall be specific, informed and conscious. Consent to the processing of personal data may be given by the personal data subject or his representative in any form which provides evidence of its receipt, except as otherwise established by federal laws.
Consent to the processing of personal data may be withdrawn by the personal data subject. In the event that a personal data subject withdraws his consent to the processing of personal data, the operator shall have the right to continue the processing of personal data without the consent of the personal data subject if any of the grounds set out in the Law.
For example, without the consent of the personal data subject, the personal data processing is carried out under to the following conditions (purposes of processing personal data):
- the processing of personal data is required for achieving the purposes stipulated by an international agreement of the Russian Federation or by a law, or for exercise and fulfillment of functions, powers and obligations imposed on operators by the Russian Federation law;
- the processing of personal data is carried out in connection with the participation of a person in constitutional, civil, administrative and criminal proceedings, and proceedings in arbitration courts;
- the processing of personal data is required for administration of justice or enforcement of a judicial act or an act of another body or official which are enforceable in accordance with the legislation of the Russian Federation concerning enforcement proceedings (hereinafter referred to as “enforcement of a judicial act);
- the processing of personal data is necessary for the execution of powers of federal executive bodies, bodies of governmental extra-budgetary funds, executive bodies of the constituent entities of the Russian Federation, local self-government bodies and the functions of the organizations participating in the provision of government and municipal services respectively as set out by the Federal Law on Organization of the Provision of Government and Municipal Services of 27 July 2010, including the registration of the personal data subject on a single portal of government and municipal services and/or regional portals of government and municipal services;
- the processing of personal data is required for performance of an agreement to which a personal data subject is a party or under which the data subject is a beneficiary or surety, or for conclusion of an agreement on the initiative of a personal data subject or an agreement under which a personal data subject shall be a beneficiary or surety;
- the processing of personal data is required for protection of life, health or other vital interests of the personal data subject in case it is not possible to obtain his/her consent;
- the processing of personal data is necessary to exercise the rights and legitimate interests of the operator or third parties, including in cases provided for by the Federal Law on the Protection of the Rights and Legal Interests of Individuals when Engaging in Activities for the Recovery of Overdue Debt and on Amendments to the Federal Law on Microfinance Activity and Microfinance Organizations, or to achieve socially significant goals, provided that the rights and freedoms of the subject of personal data are not violated;
- the processing of personal data is necessary for the purposes of professional activities of a journalist and/or the legitimate activities of the media or scientific, literary, or other creative activity, provided that the rights and legitimate interests of the subject of personal data are not violated;
- the processing of personal data is carried out for statistical or other research purposes, on the condition of the mandatory anonymization of personal data;
- the processing of personal data obtained as a result of anonymization of personal data is carried out in order to increase the efficiency of government or municipal administration, as well as for other purposes set out by the Federal Law on Carrying Out Experiment on Establishment of Special Regulation for the Purpose of Creation of Necessary Conditions for Development and Deployment of Technologies of Artificial Intelligence in the Subject of the Russian Federation - the Federal City of Moscow and Introduction of Amendments to Articles 6 and 10 of the Federal Law on Personal Data, in the order and on the terms set out by the above-mentioned Federal Law;
- the data being processed is subject to publication or compulsory disclosure in accordance with federal laws;
- the processing of personal data authorized by the personal data subject for dissemination is carried out in compliance with the prohibitions and conditions set out by the Law for the processing of such personal data.