Please be reminded that it is necessary to comply with the requirements of legislation in the field of cross-border transfer of personal data. In the Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass Communications (abbreviated in Russian as “Roskomnadzor”), the first cases of failure to transfer such data were recorded.
Roskomnadzor has decided to prohibit some Russian companies (mainly in the field of finance and logistics) from transferring personal data (PD) abroad.
The decision to prohibit was owing to the discrepancy between the purpose of the cross-border transfer of PD to the purposes that were indicated when collecting them, as well as their scope and content.
Specialists of law firms note: "The procedures for checking solvency have not previously encountered considerable obstacles. However, with the tightening of the legislation in the field of PD, the discrepancy of the collection purposes is increasingly becoming a reason for imposing a prohibition."
We remind you that the cross-border transfer of PD is the transfer of such data to a foreign state (to a state authority, a foreign individual or legal entity).
Prior to the start of the cross-border transfer of PD, the Russian PD operator is obliged to notify Roskomnadzor of its intention to carry out such a transfer and make sure that the foreign partner will be able to respect the confidentiality of the transmitted information and ensure its protection during processing. The exceptions are the countries that have signed the Council of Europe Convention, as well as the countries included in the Roskomnadzor list.
The notification has to contain the following information:
Before sending a notification, the PD operator is obliged to receive information from a foreign contractor about:
data protection measures and conditions for termination of their processing;
legal regulation in the field of PD of a foreign state;
the recipient of the PD after the cross-border transfer.
If there is no prohibition from Roskomnadzor within 10 days, the company can transfer PD abroad.
In the matters of the compliance with the requirements of the legislation in the field of personal data, please contact Acsour experts.
Roskomnadzor has decided to prohibit some Russian companies (mainly in the field of finance and logistics) from transferring personal data (PD) abroad.
The decision to prohibit was owing to the discrepancy between the purpose of the cross-border transfer of PD to the purposes that were indicated when collecting them, as well as their scope and content.
Specialists of law firms note: "The procedures for checking solvency have not previously encountered considerable obstacles. However, with the tightening of the legislation in the field of PD, the discrepancy of the collection purposes is increasingly becoming a reason for imposing a prohibition."
We remind you that the cross-border transfer of PD is the transfer of such data to a foreign state (to a state authority, a foreign individual or legal entity).
Prior to the start of the cross-border transfer of PD, the Russian PD operator is obliged to notify Roskomnadzor of its intention to carry out such a transfer and make sure that the foreign partner will be able to respect the confidentiality of the transmitted information and ensure its protection during processing. The exceptions are the countries that have signed the Council of Europe Convention, as well as the countries included in the Roskomnadzor list.
The notification has to contain the following information:
- about the name of the PD operator;
- about the name of the person responsible for the organization of PD processing and their contact details;
- about the category, list and purpose of the transferred PD;
- about the list of foreign states to which it is required to transfer PD;
- about the date of the operator's assessment of compliance by the authorities of foreign states, foreign legal entities and individuals with the confidentiality of PD.
Before sending a notification, the PD operator is obliged to receive information from a foreign contractor about:
data protection measures and conditions for termination of their processing;
legal regulation in the field of PD of a foreign state;
the recipient of the PD after the cross-border transfer.
If there is no prohibition from Roskomnadzor within 10 days, the company can transfer PD abroad.
In the matters of the compliance with the requirements of the legislation in the field of personal data, please contact Acsour experts.
