7 steps to creating a personal data protection system

Is your organization a personal data controller?

Does your company keep personnel records of employees and recruit personnel using automation tools (information systems)? Does your company transfer personal data of employees or clients to other organizations using automation tools (information systems)? Does your company have clients who are individuals?

Every organization that deals with the processing and storage of personal information about its employees, clients, etc. using automation tools is the operator of Personal Data .

IMPORTANT! Article 22 of the Federal Law “On Personal Data” established the obligation for operators, before starting the processing of personal data, to inform the authorized body for the protection of the rights of personal data subjects about their intention to carry out such a process. Those. you are required to send a Notification to Roskomnadzor about registration as a PD operator and the start of PD processing.

The grounds under which an employer has the right to process personal data (abbreviated as PD) without notifying Roskomnadzor are listed in Part 2 of Art. 22 of the Federal Law of July 27, 2006 No. 152-FZ “On Personal Data”.

What it is

The legislation classifies as personal information any information that is related to a specific person. Moreover, we are talking not only about that which directly relates to him, but also about any indirect data. This definition is very broad. It should be noted that it does not say that the data must necessarily identify a specific person.

With this approach, it is very difficult to find information that is not subject to the law.

In order to more accurately understand what constitutes personal data, you can make a request to the appropriate authority for clarification. As is known, Roskomnadzor is dealing with this issue.

A request was made as to whether there is a minimum set of data about a particular person that can be classified as personally identifiable information. Roskomnadzor reviewed this appeal and responded as follows. Legislation was monitored and it turned out that there are dozens of regulations that include various lists of information as personal data.

At the same time, it was indicated that this issue is considered in a large number of existing documents . These include the following regulations:

• 250 documents issued by the Government of the Russian Federation;
• 75 international regulations;
• more than a hundred federal laws;
• 13 Codes.

The expanded understanding of what is involved in such data is much broader than what might be expected. At the same time, the list of personal data exceeds the minimum set of information on the basis of which a specific individual can be identified.

https://youtu.be/1C6rcr_GVaM

In connection with the above, the question arises about the need to define a clearer framework of what belongs to personal information and what is not included in it. The question of whether passport data is included in this category has an affirmative answer, but in most cases the question is much more complex.

ATTENTION! The scientific and practical commentary of Roskomnadzor indicates which approach should be followed in each specific case in order to determine what is included in personal data. To do this, you need to consider a specific list of personal data and decide whether the presented set is sufficient to identify an individual.

If this is so, then all information included in this list is considered personal. If this condition is not met, these data are not subject to the relevant law.

Protection of personal data in the organization.

Personal data of citizens is classified as information that is especially protected by Russian law. The legislation of the Russian Federation (Federal Law of July 27, 2006 No. 152-FZ “On Personal Data”) strictly defines the requirements for the protection of personal data, the features and rules for their processing without the use of automation tools and in personal data information systems.

Responsibility for the collection, processing, storage and protection of personal data of employees, clients and other persons lies entirely with the employer. Therefore, any enterprise must establish a procedure for working with personal data and develop documents and measures to organize the protection of personal data.

To do this, the enterprise must develop and approve in accordance with the law a Regulation that establishes the procedure for processing and protecting personal data.

IMPORTANT! Article 19. Federal Law No. 152-FZ. Measures to ensure the security of personal data during their processing.

When processing personal data, the operator is obliged to take the necessary legal, organizational and technical measures or ensure their adoption to protect personal data from unauthorized or accidental access to it, destruction, modification, blocking, copying, provision, distribution of personal data, as well as from other unlawful actions regarding personal data.

How consent to processing is drawn up

Consent should be drawn up according to a template, or in any form, but in compliance with all basic requirements. The form can be downloaded from the Internet, or you can use one that was created specifically for a specific organization.

In this case, the document must contain the following information:

1. The name of the company where the employment is carried out.
2. Date and place of document preparation.
3. Full name of the employee, information about his place of residence and passport details.

After specifying the basic information, the second part of the document should list the following information:

1. What personal data should be protected?
2. How is it permissible to use them, for what purposes?
3. Validity period of the document. The possibility of revoking consent is separately indicated, despite the fact that this was initially provided for by law.

Separately, a mandatory note must be made that the document was drawn up and signed without any coercion from the outside, on voluntary terms. Only after this can you put your signature in the place intended for it.

Sample consent:

You can download a blank form to fill out using the link.

Nuances you need to know when drawing up consent:

1. You can receive an application from the data owner for processing on the website, in electronic form, or in printed form - in the form of a contract - agreement.
2. Some Internet users check the “consent to data processing” box without reading the terms and conditions, and thus give the right to use the data without knowing it.
3. The request for information provided must be as complete, informative and meaningful as possible.
4. The easiest way is to use a ready-made form and enter all the basic information into the document.

The actions that are performed with personal information include the following: data collection, systematization and accumulation, distribution, use and retrieval.

Administrative responsibility for disclosure of personal data.

From July 1, 2020, fines for violation of the Federal Law “On Personal Data” dated July 27, 2006 N 152-FZ in the field of the procedure for collecting, storing, using or distributing personal data will increase.

Amendments to the Code of Administrative Offenses of the Russian Federation were introduced by Federal Law No. 13-FZ dated 02/07/2017. Based on Federal Law No. 13-FZ dated 02/07/2017, seven offenses and fines are introduced for officials and legal entities for non-compliance with the law on personal data.

Organization of personal data protection in the organization.

A general list of documents that a personal data operator must have in order to comply with the requirements of legislation in the field of personal data.

IMPORTANT! For reference, we recommend that you read the document:

The procedure for implementing measures to protect personal data contained in information systems.

Order of the Ministry of Internal Affairs of the Russian Federation dated July 6, 2012 N 678 “On approval of the Instructions for organizing the protection of personal data contained in the information systems of internal affairs bodies of the Russian Federation”

Clause 2. This Instruction determines the procedure for implementing measures to protect personal data contained in the information systems of the internal affairs bodies of the Russian Federation, establishes measures to ensure the security of personal data during their processing in personal data information systems, and also determines the responsibilities of officials.

Approximate list of documents on the protection of personal data.

In the near future, templates for documents on the protection of personal data will be presented in the table.

Obtaining personal data

The employer should remember that all personal data of the employee should be obtained from him (Clause 3, Article 86 of the Labor Code of the Russian Federation).
In some cases, consent to the processing of personal data of an employee (applicant) is not required if this information is received:

1. from the documents presented when concluding an employment contract;
2. based on the results of a mandatory preliminary medical examination regarding the state of health;
3. to the extent provided for by personal card N T-2, incl. personal data of close relatives;
4. from a recruitment agency acting on behalf of the applicant;
5. from the applicant’s resume posted on the Internet and accessible to an unlimited number of people.

If the employee’s personal data can only be obtained from a third party, the employee must be notified in advance and his written consent must be obtained.