Legal guarantees for the protection of employee personal data in the labor legislation of the Russian Federation

The Labor Code of the Russian Federation defines personal data of an employee as personal information about an employee, the collection, processing and use of which is regulated by the norms of this code and other regulations. The article we offer will tell you about all these points.

Regulatory acts and documents on personal data (Labor Code of the Russian Federation, Law No. 152-FZ, by-laws)

Definition and list of processed personal data of an employee in the organization

Rules for working with personal data that are mandatory for the employer

What is meant by the protection of personal data, what are the sanctions for violating the rules of working with it for organizations from July 1, 2017?

Regulatory acts and documents on personal data (Labor Code of the Russian Federation, Law No. 152-FZ, by-laws)

Articles 86–90 of the Labor Code of the Russian Federation are devoted to issues of working with personal data of employees. However, when applying the listed articles, practitioners should take into account that the main regulatory act that regulates the procedure for working with personal information of employees is the Law “On Personal Data” dated July 27, 2006 No. 152-FZ.

You can find more complete information on the topic in ConsultantPlus. Full and free access to the system for 2 days.

This Federal Law contains a definition of the basic terms used in the processing of personal information, a list of measures aimed at protecting the rights of employees and the procedure for their application in the organization, as well as an approximate list of internal documents of the organization that are necessary to regulate the work of employees with personal data.

In addition to the norms of Federal Law No. 152, the following are mandatory for the organization:

• provision approved by the Decree of the Government of the Russian Federation “On approval...” of September 15, 2008 No. 687, applied when manually processing personal information about employees;
• requirements for the operation of automated data processing systems, which are established by the Decree of the Government of the Russian Federation “On approval...” dated November 1, 2012 No. 1119.

In turn, the norms of the Labor Code of the Russian Federation complement the requirements of the listed regulations and specify their provisions that apply specifically to employees of the organization. In addition, in addition to regulatory documents, local acts can also be applied in an organization - their approximate list and grounds for development are contained in Part 1 of Article 18.1 of Federal Law No. 152.

Among them:

• the organization's policy in the field of personal data protection;
• regulation on the processing of such data;
• various instructions and regulations governing access to information media, the procedure for filling them out, storing, disposing of them, etc.

Employee rights to ensure the protection of personal data

In order to ensure the protection of personal data stored by the employer, employees have the right to:

1. full information about their personal data and the processing of this data;
2. free free access to your personal data, including the right to receive copies of any record containing the employee’s personal data, except in cases provided for by federal law;
3. identifying your representatives to protect your personal data;
4. access to medical data relating to them through a medical professional of their choice;
5. requirement to exclude or correct incorrect or incomplete personal data, as well as data processed in violation of federal law. If the employer refuses to exclude or correct the employee’s personal data, he has the right to declare in writing to the employer his disagreement with the appropriate justification for such disagreement. The employee has the right to supplement personal data of an evaluative nature with a statement expressing his own point of view;
6. the requirement that the employer notify all persons who were previously informed of incorrect or incomplete personal data of the employee about all exceptions, corrections or additions made to them;
7. appealing to the court any unlawful actions or inaction of the employer in the processing and protection of his personal data.

Persons guilty of violating the provisions of the legislation of the Russian Federation in the field of personal data when processing an employee’s personal data are brought to disciplinary and financial liability in the manner established by this Code and other federal laws, and are also brought to civil, administrative and criminal liability in the manner established by federal laws.
0

Definition and list of processed personal data of an employee in the organization

According to Article 3 of Federal Law No. 152, personal data is any personal information about a person that allows him to be identified among other citizens. At the same time, neither the Labor Code of the Russian Federation nor Federal Law No. 152 contains an exhaustive list of data that can be recognized as personal, so usually this includes the person’s full name, address and telephone number, information about qualifications, level of education, marital status , income level, etc.

Article 86 of the Labor Code of the Russian Federation restricts an organization from collecting personal data of its employees. In particular, the employer is permitted to process such data solely for the following purposes:

Subscribe to our newsletter

Read us on Yandex.Zen Read us on Telegram

• compliance with labor legislation (for example, when drawing up an employment agreement and other work-related documents);
• assistance in finding a job;
• obtaining special or other education, advanced training and professional (career) growth;
• ensuring labor safety, monitoring qualitative and quantitative indicators, ensuring the safety of the organization’s property.

At the same time, paragraph 3 of this article indicates that all the necessary data for an organization about its employee can only be obtained from the employee himself. In addition, paragraphs 4 and 5 directly prohibit the organization from collecting information about the employee’s membership in trade unions or other public organizations, as well as information that relates to special categories of personal data (according to Articles 10 and 11 of Federal Law No. 152, these include data on religious and political beliefs, nationality, personal life, health, etc.).

Comments on the article

Important provisions regulating the procedure for inspecting organizations are contained in ILO Convention No. 81 “On Labor Inspection in Industry and Commerce” (1947) and the 1995 Protocol to this Convention, ratified by Federal Law No. 58-FZ of April 11, 1998. In accordance with Art. 1 of the Law on the Protection of the Rights of Legal Entities and Entrepreneurs, the specifics of organizing and conducting inspections regarding the type, subject, conditions of inspections, timing and frequency of their conduct, notifications of unscheduled on-site inspections and coordination of unscheduled on-site inspections with the prosecutor’s office may be established other federal laws in the implementation of federal state supervision over compliance with labor legislation and other regulatory legal acts containing labor law norms.

In addition, if an international treaty of the Russian Federation establishes rules other than those provided for by this Law, the rules of the international treaty of the Russian Federation apply.

Thus, when conducting inspections, state labor inspectors are obliged to be guided by generally recognized principles and norms of international law (see Article 10 of the Labor Code).

General requirements for organizing and conducting inspections of compliance with labor laws are enshrined in the Law on the Protection of the Rights of Legal Entities and Entrepreneurs.

The inspection is carried out on the basis of an order or order from the head, deputy head of the state control (supervision) body. The standard form of an order or order of the state control (supervision) body, municipal control body on conducting an inspection of a legal entity, individual entrepreneur is approved by Order of the Ministry of Economic Development of Russia dated April 30, 2009 N 141 “On the implementation of the provisions of the Federal Law “On the protection of the rights of legal entities and individual entrepreneurs in the implementation of state control (supervision) and municipal control.”

Article of the Law on the Protection of the Rights of Legal Entities and Entrepreneurs gives the state labor inspector the right to carry out control (supervision) measures if he has the appropriate order (order), a copy of which is handed over to the employer or the employer’s representative of the inspected organization against signature. This order (instruction) must indicate:

1. name of the relevant state labor inspectorate;
2. last name, first name, patronymic of the state labor inspector authorized to carry out the inspection, as well as attracted experts and representatives of expert organizations;
3. name of the legal entity or last name, first name, patronymic of the individual entrepreneur whose verification is being carried out;
4. goals, objectives, subject of the inspection and the period for its implementation;
5. legal provisions for conducting an inspection, incl. mandatory requirements and requirements established by municipal legal acts that are subject to verification;
6. timing and list of control measures necessary to achieve the goals and objectives of the audit;
7. a list of administrative regulations for carrying out control measures, administrative regulations for interaction;
8. a list of documents the submission of which by a legal entity or individual entrepreneur is necessary to achieve the goals and objectives of the audit;
9. start and end dates of the audit.

The state labor inspector, simultaneously with handing over to the employer (his representative) a certified copy of the order (order) to conduct an inspection, also presents his official ID.

The duration of the inspection (including documentary) cannot exceed 20 working days. In relation to one small business entity, the total period of scheduled on-site inspections cannot exceed 50 hours for a small enterprise and hours for a micro-enterprise per year.

At the same time, there may be cases where complex and (or) lengthy studies, tests, special examinations and investigations are required. In such cases, the inspection period may be extended - on the basis of a motivated proposal from the state labor inspector conducting an on-site scheduled inspection, by the head of the relevant state labor inspection, but by no more than 20 working days, and in relation to small enterprises, micro-enterprises - by no more than 15 hours.

If an employer operates in the territories of several constituent entities of the Russian Federation, the period for conducting an inspection (including documentary) is established separately for each of its branches (representative offices).

By virtue of Art. of the Law on the Protection of the Rights of Legal Entities and Entrepreneurs, the state labor inspector in the process of supervisory and control activities should not:

• check compliance with mandatory requirements and requirements established by municipal legal acts, if such requirements do not fall within the powers of the relevant federal labor inspection body;
• carry out a scheduled or unscheduled on-site inspection in the absence of the head (his deputy) of the inspected organization during the inspection, with the exception of the case of an inspection for which harm was caused to the life or health of employees;
• demand the presentation of documents, information, product samples, inspection samples of environmental objects and industrial environment objects, if they are not the objects of inspection or do not relate to the subject of inspection, and also confiscate the originals of such documents;
• take samples of products, samples of inspection of environmental objects and objects of the industrial environment for carrying out their research, testing, measurements without drawing up protocols on the selection of these samples, samples in the established form and in quantities exceeding the norms established by national standards, rules for the selection of samples, samples and methods of their research, testing, measurements, technical regulations or other regulatory technical documents and rules and methods of research, testing, measurements valid until the day they enter into force;
• disseminate information obtained as a result of the inspection and constituting a state, commercial, official, or other secret protected by law, except for cases provided for by the legislation of the Russian Federation;
• exceed the established deadlines for conducting the inspection;
• carry out the issuance by the employer of instructions or proposals to carry out control measures at their expense.

Having completed the inspection, the state labor inspector draws up a report in the prescribed form in two copies.

The state labor inspector may not inform the employer or his representative of his presence if he considers that notification of the inspection will allow the employer to take measures to conceal information about violations of the labor rights of workers, which will harm the effectiveness of control (Article ILO Convention No. 81 “On labor inspection in industry and trade" (1947)).

Federal laws or in the manner established by them (taking into account the provisions of the Law on the Protection of the Rights of Legal Entities and Entrepreneurs) provide for the specifics of carrying out control (supervision) measures in certain areas of state activity.

In the process of supervisory and control activities, state labor inspectors are guided by the 1995 Protocol to the Labor Inspection Convention (1947) until special laws establish special rules for organizing and conducting control (supervision) measures in certain areas of state activity.

Article 4 of the Protocol enables a State Party to the Convention to introduce a special procedure for the inspection of workplaces in the armed forces, the police and other public security agencies, as well as in correctional institutions, in order to regulate the powers of labor inspectors, as provided for in Art. Convention, regarding:

1. access only to inspectors who have received appropriate clearance in advance;
2. carrying out the inspection at the appointed time;
3. powers to demand production of confidential documents;
4. removal of confidential documents from premises;
5. taking and analyzing samples of materials and substances.

In order to limit the powers of labor inspectors to carry out inspections (during maneuvers or exercises; units in the front line or during periods of active operations; during declared periods of tension; in relation to the transport of explosives and weapons for military purposes), a Member State may also introduce a special procedure for inspection of workplaces in the armed forces and police, and other public security agencies.

In addition, special procedures may be introduced for the inspection of workplaces in correctional institutions in order to limit inspections during declared periods of tension.

The State must consult with the most representative employers' and workers' organizations or, in the absence of such organizations, representatives of the employers and workers concerned, before it makes use of a special procedure for inspecting workplaces.

Rules for working with personal data that are mandatory for the employer

Clause 7 of Part 1 of Article 86 and Article 87 of the Labor Code of the Russian Federation contain reference norms that indicate that the work procedure, as well as measures taken to protect personal data, are provided for by relevant legislation, that is, Federal Law No. 152. The only direct requirement for the employer when In this regard, according to paragraph 8 of the Labor Code of the Russian Federation, it is mandatory for employees (their representatives) to familiarize themselves, under the signature, with the organization’s documents that regulate the work with personal information. Thus, when organizing work with personal data, the employer should rely on the requirements of Articles 18.1 and 19 of Federal Law No. 152.

Article 18.1 contains a list of measures that an organization can take to protect personal information. These include, in particular:

• appointment of a responsible employee for working with personal data;
• publication of local acts regulating the processing of personal information;
• conducting internal control over compliance with security measures when working with data;
• assessment of possible consequences in case of loss or unauthorized access to personal data, etc.

Article 19 also obliges the organization to apply a set of technical, legal, administrative and other measures aimed at preventing unauthorized persons from accessing citizens’ data, including:

• determine the procedure for storing and accessing information media;
• keep records of them (number, record facts of transfer from one employee to another, draw up reports of loss, destruction, etc.);
• use antiviruses and other software to protect the organization’s local networks;
• provide training to employees on working with personal data;
• determine the procedure for filling out paper forms containing personal information, etc.

Certain issues regarding the procedure for working with personal data

The employer has the right to process the personal data of a dismissed employee in cases and within the time limits provided for by federal legislation. Such cases, in particular, include the processing of personal data for accounting and tax purposes. Also, in cases where the employee has consent, the employer has the right to keep a copy of the work book of the dismissed employee.