E-Privacy: New Law of the Russian State: what to do?

By | Monday September 21st, 2015
1 Comment

The September 1, 2015 came into force the Russian Federal Law n. 242 of 21 July 2014.
The new law on the location of personal data requires that all personal data of Russian citizens treated by foreign companies, are stored and processed in Russia without exemptions for trade data. The operator must ensure that foreign recording, systematization, saving, storing, updating and retrieving personal data of Russian citizens should be made only in databases located in the State Russian.

The subjects covered in this law are foreign companies with legal presence in Russia and foreign companies not legally present in Russia but that provide online services to Russian citizens (eg. E-commerce).
The main actions are:
• Risk Assessment to determine whether the company will process data as provided by Russian Law Localisation
• internal policies and to define where the data reside in Russia
• specific information and consents
• Local notification to the DPA (Roskomnadzor)
• Data Transfer Agreement

Category: Open Forum Tags: ,

About Agostino Oliveri

Agostino Oliveri Data Protection Officer – Privacy Consultant e Auditor Certificated (Num. Reg. DPO 1529 secondo gli standard UNI CEI EN ISO IEC 17024:2012 e 17065:2012 e disciplinato ai sensi legge 4/2013) We work mainly in the field of IT SECURITY with the provision of services and solutions to some penetration testing and security baseline. We provide consultancy to achieve the adjustments required under the law in the area of ​​security of data processed by computer equipment, law 196/2003 (the new Privacy Code undergoing change), law 231/2001 (protection from company computer crimes), adaptation of security bodies to DM 1.12.2010 num. 269, preparation of the feasibility study and business continuity plan in accordance with Article. 50-bis of the Administrative Code digital support for all matters related to the DL 33/2013 on Transparency and L. 190/2012 Anticorruption, we offer consultancy for achieving quality certification according to ISO 9001 and safety according to ISO 27001 certification for information and services for STAR mode CLOUD COMPUTING. I think the significant experience gained with multinational companies has allowed us to achieve a certification of expertise in some areas and very important issues and I think it can be a path to significant and important to share. Then in the light of the many regulatory changes that will have a very important impact on companies, I believe we need a prudent approach and prior verification and certification of existing solutions adopted in order to avoid incurring heavy fines in addition to the guarantee of safety of its corporate assets.

One thought on “E-Privacy: New Law of the Russian State: what to do?”

  1. Sergio Fumagalli

    It is really interesting that in these years when cloud computing makes data location unrelevant from a technical point of view, data location is becoming more and more a key issue from a political point of view.
    Also the new EU GDPR tries to submit Personal Data to the EU jurisdiction. Article 3, second paragraph of the version approved by the EU Council states as follows: “2. This Regulation applies to the processing of personal data of data subjects residing in the Union by a controller not established in the Union, where the processing activities are related to: ….”.
    The lawsuit between Microsft and the US Department of Justice refers, again, to the relevance of the place where data are stored in relation with the applicable jurisdiction.
    We could say that what is feasible from a technical point of view doesn’t match with the sovereignty principle which nations and States are based on.
    The data protection legislation is becoming, worldwide, the intersection between tech and politics.

    ↓

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.