A draft Federal Law amending the Federal Law “On Personal Data” has been submitted to the State Duma for consideration.

In accordance with part 1 of Article 22 of the Federal Law of July 27, 2006, No. 152-FZ “On Personal Data” (hereinafter – Law No. 152-FZ), the operator, except for cases established by law, is obliged to send a notification to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) of the intention to carry out such processing prior to the commencement of personal data processing. The information specified in the notification is subject to inclusion in the register of personal data operators posted on the Internet.

Part 4 of Article 22 of Law No. 152-FZ establishes that the information contained in the register, with the exception of data on personal data security features, is publicly available.

According to Roskomnadzor Order No. 180 of October 28, 2022 “On Approval of the Forms of Notices of Intent to Process Personal Data, on Changing the Information Contained in the Notice of Intent to Process Personal Data, on Termination of Personal Data Processing”, the address (location) of the operator is a mandatory requisite of the notice. If the operator is an individual entrepreneur or a natural person, his/her address of registration at the place of residence, up to the apartment number, shall be entered in the register.

As noted by the authors of the draft law, at present, information allowing to identify and localize an individual processing personal data is published in the public domain, which creates significant risks of violation of privacy, as well as threats to the physical security of such operators.

Public disclosure of the home address contradicts the purpose of the Law No. 152-FZ, aimed at the protection of personal data; does not comply with the principle of minimizing the processing of personal data; is inconsistent with the approach in force, for example, in the Unified State Register of Individual Entrepreneurs, where the address of IE registration is not placed in the public domain.

The bill proposes to supplement article 22, paragraph 4, of Law No. 152-FZ with a provision establishing that information on an operator’s address, if it is a natural person or an individual entrepreneur, is not subject to placement in the publicly accessible part of the register.

At the same time, the obligation to provide the address in the notification remains. Such information continues to be at the disposal of the authorized body.

As stated in the explanatory memorandum to the draft law, the adoption of this draft law will eliminate the excessive disclosure of sensitive information about operators – natural persons and individual entrepreneurs, restore the balance of interests of the parties involved in the processing of personal data, and ensure the protection of the privacy of natural persons and individual entrepreneurs.

If adopted, these amendments to the Law No. 152-FZ will enter into force from the date of their official publication.

Link: https://sozd.duma.gov.ru/bill/928282-8

Draft law № 928282-8