State Duma passes law on anonymization of personal data in second and third readings

The law provides for the creation of a ****state information system**** with ****anonymized**** PD (“PD”). The PD ****operator**** (****employer****) will be obliged to anonymize processed data (e.g., of ****employees****) and provide it to the state information system at the request of ****the Ministry of Digital Development, Communications and Mass Media****, which will have to ensure the ****confidentiality**** of this data.

The law is due to come into force ****from 1 September 2025****.

The new law is generating numerous questions for companies, especially in terms of ****how companies must anonymize PD and what software to use for this purpose****. Companies will probably have to buy ****certified software****, which is not yet available on the market. The old Roskomnadzor (Russian Data Protection Authority) order describes anonymization methods for municipal and state bodies and does not provide anonymization methods for private companies, nor does it provide information on technical means for anonymization.

The state authorities have started accepting applications for IT deferment from military service from 24 July to 6 August 2024

Employees of ****accredited IT companies**** aged ****between 18 and 30**** may apply for deferment from military service in the autumn conscription through Gosuslugi ****from 24 July to 6 August 2024****. If an employee does not have a personal account on Gosuslugi, the company itself will be able to add him to the list.

Companies, meanwhile, are required to check and confirm employees' data and send the lists to the Ministry of Digital Development, Communications and Mass Media ****by 11 August 2024****. One company may send several lists as they are compiled. The Ministry of Digital Development, Communications and Mass Media will send the information to the ****Ministry of Defence**** by 31 August 2024. From 1 October to 31 December, the conscription commission will make ****decisions on deferment****.

Please note that employees of conscription age employed in the IT sector may qualify for deferment of conscription for military service if they:

• Work in an ****accredited**** IT company under an ****employment contract**** with normal working hours

• Have completed ****university education**** in a major from this ****special**** list

• Have at least ****11 months of work experience in the IT sector**** during the year preceding the date of recruitment

Prohibition to include consent to processing of PD in other documents

A draft law has been submitted to the State Duma to formalize consent to the processing of PD ****separately**** from other documents signed by the subject of PD and/or provided to him/her for review. According to the authors, consent to the processing of PD is often currently included in ****contracts**** or ****other consents to the processing of PD, which are provided for other purposes****. These documents contain, among other things, a significant amount of information not related to the processing of PD and conditions for consent to the processing of PD, including for the purpose of ****transferring it to an indefinite number of persons****.

In practice, we often see situations where consent to the processing of an employee's PD is ****“stitched”**** into an employment contract. Although there is currently no explicit prohibition in the law to incorporate consent with the text of the employment contract, such an approach ****can already be challenged****, as the employee is considered a weak party and such incorporated consent may be considered non-free and involuntary.

We strongly recommend that all employers ****abandon the practice of including any consents to the processing of PD in employment contracts, other agreements, instructions and local policies****, particularly as consent is not the only possible means for processing employees' PD. In many cases, the processing of employees' PD may also be justified by an agreement with the employee or a legal obligation, including obligations that the employer has to employees under the Labour Code of the Russian Federation. Where the processing of PD necessarily requires consent, such ****consent must be specific, conscious and unambiguous, i.e., obtained separately from other documents, as well as substantive and informed****.