The Government of the Russian Federation has reviewed the draft federal law.
The draft law proposes to introduce amendments to Article 857 of the Civil Code of the Russian Federation, hereinafter referred to as the Code, Article 26 of the federal law On Banks and Banking, hereinafter referred to as the Law on Banks, and Articles 3 and 6 of the federal law On Personal Data, hereinafter referred to as the Law on Personal Data, which expand the number of subjects who can reveal information comprising banking secrecy.
According to the draft law, information comprising banking secrecy can be referred under the client's instructions to absolutely any third parties since neither the contract nor the Russian legislation cover the individualisation of personal data.
Thus the legal structure proposed by the draft law, while expanding the range of parties with access to respective information, does not allow banks to preserve the complete confidentiality of the data comprising banking secrecy, and also diminishes the institution of banking secrecy stipulated by Paragraph 1 of Article 857 of the Code and Part 1 of Article 26 of the Law on Banks. In accordance with Paragraph 2 of Article 3 of the Law on Personal Data the operator of personal data is a body (individual) that organises the processing and/or processes personal data. Paragraph 1 of Article 3 of the draft law proposes to add a provision to Paragraph 1 of Article 3 of the Law on Personal Data stating that processing personal data jointly with other persons is conducted on the basis of a contract.
Meanwhile, Paragraph 3 of Article 6 of the Law on Personal Data states the possibility for the personal data operator to process personal data with other persons on the basis on a concluded contract, including a state or a municipal contract, or by issuing a respective ordinance by a state or municipal body.
The provision of the law specifying Paragraph 3 of Article 6 of the Law on Personal Data regarding the exclusion of the operator's liability to obtain the permission of the subject of the personal data when commissioning a third party with data processing limits the rights and lawful interests of citizens with regard to the use their personal data.
Apart from that, Paragraph 3 of Article 6 of the Law on Personal Data as stated in the draft law, the operator is to be given deadlines for personal data processing. However, Paragraph 2 of Article 3 of the Law on Personal Data in the draft law, which describes the competences of the operator, does not stipulate deadlines for personal data processing by the operator.