Law 152-FZ "On Personal Data"

152-ФЗ "On personal data" regulates relations relating to the use of information about citizens by authorized bodies. To authorized structures include, including state and municipal organizations. The normative act provides information protection. 152-ФЗ "On personal data" also regulates the use of information about individuals by other citizens and organizations.

Auxiliary tools

With their help, information is collected and processed. 152-ФЗ "On personal data" names automation tools as auxiliary tools. These include, among other things, components of information and telecommunication networks. A normative act also regulates relations associated with the use of information without the use of these tools, if processing without them corresponds to the nature of the operations (actions) that occur when using automation tools. In this case, it is understood that their algorithm allows you to search for the necessary information present in file cabinets, on tangible media, or other systematic collections.

Exceptions to the scope of a normative act

They are explained in Art. 1. In 2010 and 2011 changes were made to it. 152-ФЗ "On personal data" does not cover relations that arise when:

1. Organization, storage, acquisition, accounting and use of documents of the Russian Archival Fund containing personal information about citizens.
2. The processing of personal information by individuals solely for personal and family needs, if this does not infringe on the rights and interests of the owner of such data.
3. The provision by authorized bodies of information on the work of ships in the Russian Federation.
4. Processing data that are classified as state secrets.

Purpose of the normative document

As her advocates. 152-ФЗ "On personal data" acts as a guarantor of the inviolability of personal information of individuals who constitute the secret of their family and private life. In the collection and subsequent use of information, freedom and human and civil rights must not be violated.

Requirements

152-ФЗ "On personal data" formulates a number of principles in accordance with which work is carried out with personal information:

1. Legality and justice of the grounds.
2. Setting specific goals that limit data processing. Forbidden to work with information that is incompatible with the tasks.
3. It is not allowed to combine information databases in which data processing is carried out for purposes that are not consistent with each other.
4. Work is carried out only with the information that meets the tasks.
5. The volume and content of the information should be consistent with the processing objectives. They should not be redundant in relation to the stated tasks.
6. During processing, the accuracy of personal data, its adequacy, and, if necessary, relevance must be ensured. The operator should take appropriate measures to delete or clarify inaccurate or incomplete information or create conditions for such measures to be taken.

Storage

152-ФЗ "On personal data" prescribes that the content of personal information should be carried out in a form that allows the identification of the subject. Storage should be carried out no longer than is necessary for the stated purposes of working with information.This provision 152-ФЗ "On personal data" is used if the period for the content of information is not determined by a regulatory document, by agreement, to which the subject acts as a guarantor or beneficiary. The processed data must be destroyed or depersonalized upon achievement of the stated goals or if they are lost in the need to achieve them, unless otherwise specified in the regulatory enactment.

rules

Work with personal information is carried out only if the subject has given consent to this. 152-ФЗ "On personal data" allows the collection and subsequent use of personal information in accordance with the stated goals of the operator, as well as the person performing his order. In the latter case, the consent of the subject to this must be obtained. The operator is responsible for working with the information. When sending an order, it should indicate:

1. A list of operations (actions) with personal information to be performed by a person.
2. The obligation of a person to maintain the confidentiality of information, to ensure its safety during processing.
3. Objectives of working with information.
4. Additional conditions stipulated by the Law on Protection (152-ФЗ "On Personal Data").

The normative document prescribes that operators and other persons executing their instructions are required not to disclose to other entities and not to disseminate information known to them, unless otherwise provided by the legal act.

Public Sources

The Law on Protection (152-ФЗ "On Personal Data") allows the creation of address books, directories and other bases for information support. In public sources with the consent of the subject may be made:

1. FULL NAME.
2. Place and year of birth.
3. Subscriber number.
4. Address.
5. Information about the profession and other personal information.

The consent of the subject is given in writing. Information about the citizen must be removed from public sources at his request or in accordance with a decision of the court or other authorized bodies.

The need to work with information

152-ФЗ "On personal data" establishes that the use of information is carried out in accordance with the goals of execution / security:

1. International treaties of the Russian Federation for the performance of duties, tasks and functions assigned to the operator.
2. Justice, enforcement of a judicial act, resolution of another body or official.
3. Realization of powers of federal executive structures, extra-budgetary state funds, local government institutions and functions of organizations / institutions providing municipal or state services.
4. Agreements, the guarantor, the beneficiary under which the entity acts as a participant, including when the operator exercises the right to assign under such an agreement.
5. Protection of health, life, interests of a citizen, if obtaining his consent to work with his personal data is impossible.
6. The professional activities of a journalist or the media, literary, scientific or other creative work, provided that this does not violate or infringe upon the interests and rights of the subject.
7. Implementation of statistical or other research tasks with mandatory subsequent anonymization of the information received. An exception is the goals set forth in article 15 of the regulatory document in question.

The rules in accordance with which the processing of special categories of individual information, biometric personal information is established in Articles 10-11 of the commented Federal Law.

Information Categories

152-ФЗ "On personal data" allows the collection and work with information:

1. To which the subject is granted unlimited access.
2. The processing of which is carried out at the request of the person.
3. Subject to mandatory disclosure or publication in accordance with regulatory enactment.

Subject Consent

As stated above, it must be provided in writing.The following data must be present in the consent:

1. Name, address of the person, name and number of the document by which his identity is identified, information about the date when he was issued. If a representative acts on behalf of the subject, an additional paper is presented, confirming the relevant authority.
2. The name or full name and address of the operator or person who performs the processing in accordance with the instruction.
3. The purpose of working with information.
4. A list of personal data for the use of which the entity consents.
5. The period during which the permission of the person is valid, the method of recall.
6. Signature of consenting entity.

If a person is recognized as legally incompetent, permission to work with his information is given by his representative. In the event of the death of the subject, such consent is provided by his heirs, if during his life he did not give it.

Important point

The decision to provide their own personal data and their subsequent processing is carried out by the subject in his interest, freely and voluntarily. Permission to work with information must be specific, conscious. Consent may be given by a person or his representative in any form, allowing to confirm the fact of its receipt, unless otherwise specified in the regulatory document. If permission to work with information is received from a representative, the operator checks his credentials. Consent to the processing of information may be revoked by the entity. In this case, the operator has the right to continue working with the information without obtaining permission to do so on behalf of the person if there are grounds given in clauses 2–11 parts 1 of article 6, parts of the second articles 10–11 of the commented normative act.