If you managed to correct shortcomings in your information resources and submit an application to the RKN, we are very glad that we have such conscious and prudent clients :) But we suggest that you go through some points again, especially those related to websites, chat bots and other digital resources, to make sure that everything is done correctly.
At the end of the article, we tell you what we can do on your website to put the resource in order.
What does Federal Law 152 say and who does the new amendments concern?
Federal Law No. 152 “On Personal Data” regulates the protection of citizens’ personal information, establishing rules for processing such data: it requires consent to their collection and processing, obliges to ensure the confidentiality and security of information, provides for liability for violations, and also gives citizens the right to access their data, correct it and protect it in court.
Let us remind you what applies to classic personal data:
- last name, first name and patronymic;
- date and place of birth;
- floor;
- passport details;
- place of registration (residence);
- SNILS and INN numbers;
- contact details (phone, email);
- information about education.
The law also enshrines two more concepts that relate to personal data and require protection:
Biometric personal data are unique physiological characteristics of a person that are used to identify an individual, including indicators such as fingerprints and structural features of the retina (according to Article 11 of Federal Law-152).
Special personal data includes information about race and nationality, religious and political views, health status and other characteristics of a person, the processing of which is permitted only if there are special grounds (in accordance with Article 10 of Federal Law No. 152).
Thus, all companies and organizations that collect and process this information on their information resources are subject to the new amendments.
Legal requirements apply to all personal data operators without exception.
What to pay attention to on digital resources so that everything is correct.
Please note that the law applies to all resources where PD is collected: website, landing pages, chat bots, mailing services and others. Therefore, all of them need to be carefully looked at again to see if there are any unaccounted forms of data collection left somewhere.
We remove Google Analytics, GOOGLE forms and Google Tag Manager (GTM) and all other foreign services from the site. If you still want to keep any of the foreign services, then its use will be considered cross-border data transfer. In this case, when submitting an application to the RKN, you must indicate in the application that you are making such a transfer. If you continue to use foreign services without notifying the RKN, you face a fine of at least 1 million rubles.
We place a link to the documents “Personal Data Processing Policy” and “Consent to the Processing of Personal Data” in the footer of your website. Double-check that the links in the documents are correct: the Policy refers to Consent, and Consent to the Policy.
We add checkboxes with Consent and Policy, as well as consent to receive advertising and informational mailings to the forms where PD is collected. For example, if you have a form for collecting applications in the format “full name + phone number or email,” then this is already considered the collection of PD and requires the user’s consent.
Add a checkbox “I agree to receive advertising and informational materials” in the “News Subscription” form. If you collect information in the “Email” format without collecting your full name for sending promotions, offers and news, then one checkbox “I agree to receive advertising and informational materials” will be enough.
We place a checkbox “Offer or User Agreement” if the user makes a payment and/or registers on the website. If your website has a client portal in which the user registers and/or makes payment in any way, then the first checkbox in the PD collection form should contain the following text: “I accept the terms of the Offer, and also consent to the processing of personal data under the terms of the Personal Data Processing Policy.” Please note that the Offer and Data Processing Policy must be clickable and lead to the relevant documents.
We check that the site has a pop-up window notifying about the collection of cookies. If Yandex metrics or other counters are installed on the site, then there should be a notification about the collection and storage of user data.
Please note that in this way you need to check all the resources of the company/organization: landing pages for events, quizzes, mailings, chat bots. Because all of them are subject to new changes.
Storage of personal data
If you store data in Google Sheets, this is also illegal and you need to switch to other storage systems, for example, Excel or Yandex Sheets.
Notification to RKN about storage and processing of PD
It was necessary to submit an application to the RKN by May 30. After this day, new fines will apply to violators:
- from 30,000 to 50,000 rubles - for officials of organizations;
- from 100,000 to 300,000 rubles - for individual entrepreneurs and organizations.
But lawyers cautiously agree that they won’t start fining everyone right away, especially since online filing has been difficult over the past few days. But it’s better not to delay and correct it as soon as possible, before the time for inspections comes.
Our colleagues, with the help of lawyers, have prepared a large table with all the fines for violations in the field of personal data.
How can we help you in connection with the new amendments to the law?
Privacy Policy - we will develop or update a document without unnecessary language that meets all legal requirements.
Consent to data processing - we will prepare an up-to-date text that can be integrated into any form or posted as a separate page on the website.
Information page about cookies - we will create a user-friendly section explaining what cookies are, what they are used for and what benefits they bring.
Pop-up cookie window - we implement a mechanism with a clear choice of “Agree” or “Disagree”, including a link to detailed information.
Consent to marketing mailings - we will create a separate window to obtain user consent to receive advertising materials.
We will formalize the details legally correctly - we will add all the necessary company details to the relevant sections of the documents to fully comply with the requirements of regulators.
For details, we invite you to write to hello@localhost or private message to project manager Andrey Shiyanov https://t.me/Finsech