The end of 2017 was marked with a few interesting court decisions, which may be useful for businesses to know for the assessment of their future dealings in Russia. Some of the decisions confirmed our earlier understanding of the relevant legal provisions or the earlier verbal clarifications of the regulator:

Photos on ID documents are considered biometric personal data[i]

Companies should take a closer look at the data they are processing and take this decision into account. Potentially the companies may want to delete or destroy any documents with photos from ID documents as, otherwise, such processing requires the implementation of additional compliance measures.

Consents need to be specific. Too general language should be avoided

The court confirmed[ii] that consents allowing the transfer of personal data to third parties must be sufficiently specific. In other words, it is not allowed to stipulate, for instance, that ‘the operator is allowed to transfer personal data to third parties’. It is necessary to specify the relevant third party recipients with their full names and legal addresses so that individuals can refuse to authorize such transfers. In this particular case, the relevant consent was included in the insurance policy of the insurance company. Therefore, the insurance company would now need to update its template documents in order to comply with the law.

Job applicants’ data is covered by employment purposes

In the decision of Arbitrazh Court of the Irkutsk Region the court confirmed[iii] that the collection of job applicants’ data is covered by employment purposes (and such purposes allow an exemption from the Roskomnadzor registration requirement) and no registration with Roskomnadzor is necessary.

There is no obligation to update passport data or information on residence even if a credit contracts requires this

The defendant (Russian Agricultural Bank) obliged its clients (individuals) in credit contracts to mandatorily provide information on any changes to the individual’s passport data and actual residence. Based on the Federal Law on Consumer Credits, consumers are only obliged to update their contact details if they change. There is no obligation to update passport data or information on residence. Therefore, the court ruled[iv] that such a provision obliging individuals to update their passport data and information on residence is illegal.