Cross-border transfer of personal data - what is it?

In the conditions of development and globalization the Internet every day becoming less territorial restrictions for commercial activities. Despite the rather complicated foreign policy situation, the number of domestic enterprises cooperating with foreign partners, constantly increasing. The absence of territorial limits requires the introduction of uniform rules of interaction of all participants of relations. In particular, it concerns the process of personal information exchange. Consider further, how is cross-border transfer of personal data.

2016

Currently, the law does not contain clear rules for the exchange of information with foreign counterparties. As the source of a normative act in the sphere of communications were made by law No. 152-FZ. This law reglamentary cross-border transfer of personal data. What is it? Under this activity understand the personal information on the territory of a foreign state, a foreign organ of state power, physical or legal entities. In 2014 there was adopted the Federal law № 242. He was supposed to enter into force 01.St. 2016 in the decree, some changes were introduced in the laws in terms of clarifying the rules for processing personal information in information and communications networks. However, the state Duma was introduced bill No. 596277-6 on the adjustment of article 4 of the Federal law № 242. In accordance with these changes, the period of entry into force was postponed to January 2015, now, therefore, the Federal law № 242 already has more than a year.

Recommended

Calculation and payment of sick leave

Sick Pay provided by the legislation of the Russian Federation, in particular TC and FZ No. 255. In addition, some rules are governed by the provisions of the civil code. Any employee upon the occurrence of a certain disease should contact a health f...

Employee certification for compliance with the post: purpose, procedure, result

Employers perceive the order of certification of employees as a formality. Regulations intended for commercial organizations, were not issued. Certification is required only for employees of the organizations designated in the laws of the spheres, le...

Registration of vehicle: procedure, sample application, certificate

Every person who buys a car needs to do its registration in the traffic police. It is necessary when purchasing new or used cars, as well as no matter whether the seller of natural persons or legal entities. Check the vehicle is in the traffic police...

Limitations

In law No. 152-FZ prohibitions, which gets cross-border transfer of personal data. Are the restrictions related to the protection of the constitutional system of the Russian Federation, health, morals, rights and interests of the population, maintaining security and national defense. While in law No. 152-FZ does not provide for any other rules. In particular, there are no conditions under which countries provide adequate protection for your personal information could be limited to cross-border transfer of personal data. These are States that act as parties to the Convention ETS No. 108 and included in the list approved by the Order of Roskomnadzor № 274.

Exceptions

In law No. 152-FZ defines situations where States which, in spite of failing to ensure the adequate protection of personal information can be made cross-border transfer of personal data. This is the situation:

1. Provided in the Federal law, if the provision of information required for the protection of the constitutional foundations of security and defence, sustainable transport infrastructure, protection of the interests of society, the individual and the state from unlawful interference.
2. When executed the Treaty which acts as the carrier of the information provided.
3. When you need the protection of health, lives and other vital interests of personal data subjects and other persons failing to obtain written consent first.
4. Provided in international agreements.
5. Consent to TRANS-border transmission of personal data from the subject IPA.

Important

If you have permission from the subject of the MDP, in accordance with law No. 152-FZ, allowed cross-border transfer of personal data. This permission implies that the person is notified that information concerning him personally, will be provided to a foreign company. The need for such a document when sending information to countries that provide adequate protection, is not set by regulation. However, it is important that the subject was informed by the operator about the proposed actions.

Public policy

To avoid problems, the operator specifies:

1. What is cross-border transfer.
2. What is the volume of the information provided.
3. Individuals who are taking information.

The Operator shall also notify Roskomnadzor about what will be done cross-border transfer of personal data. This is done by completing/amending the notice. The notice shall specify the country receiving information. Prior to processing of the information the subject of the MHP is notified of the operation. This provision is reflected in the policy, contract or other document with which the person will be able to see.

Bye-laws

In the local documents reflects the operator:

1. Legal basis for the provision of personal information to foreign entities. In particular, it provides a list of normative acts on the basis of which processing and sending information.
2. Regulations on the transboundary transfer of personal data.
3. A Description of the activities and protective equipment, including technical and cryptographic.

Agreement

The Operator concludes an agreement with the organization that will be cross-border transfer of personal data that means acceptance by the handler of the responsibility to respect the confidentiality of informationto fulfill the requirements for the protection of information to ensure their safety. The contract also stipulates the list of actions executed by the parties.

Use protection

The duties of the operator included the implementation of a number of measures to prevent unauthorized access to personal information in the process of working with information. It is allowed to use uncertified cryptographic security of funds as a result of:

1. The requirements of the Convention ETS No. 108, article 12.2 which does not allow to create restrictions and to impose special control of the information streams going into the territory of a foreign state on the basis of the principle of privacy cases.
2. The Availability of the special conditions of export of vehicles from the territory of Russia, including in its membership the tools encryption.
3. The Specifics of the legislation of the foreign country of import of cryptographic equipment, obtaining permits from the relevant foreign courts on this.

FZ № 242

As stated above, in 2014, a law was passed that makes changes to a number of regulations specifying the rules on the processing of personal information in information and telecommunication networks. Of the Federal law№ 242 complements law No. 152-FZ, demanding that the data collection process, including, via the Internet, the operator needs systematizing, recording, accumulation, updating, storing and retrieving using databases located in Russia. This requirement may not be fulfilled if the processing of personal information is to:

1. Achieve the goals set by international agreement or by law, for implementation by the operator of its powers, duties and functions.
2. The administration of justice, execution of court orders, act of other body or employee, enforceable in the manner prescribed in the norms of Russian law.
3. Implementation of powers of Federal, regional, municipal Executive institutions, entities included in extra-budgetary state funds, organizations involved in the provision of services at the state and local levels.
4. Professional tasks of a journalist or media activities (legal), literary, scientific and other creative work. This should satisfy the condition about inadmissibility of infringement of interests of other entities.

As practice shows, at present, cross-border transfer of information is efficient and convenient means of communication. If used properly, operators can reduce costs in the processing of information within Russia.