FEDERAL LAW OF THE RUSSIAN FEDERATION

of July 14, 2022 No. 266-FZ

About introduction of amendments to the Federal law "About Personal Data", separate legal acts of the Russian Federation and recognition of invalid part fourteen of article 30 of the Federal law "About Banks and Banking Activity"

Accepted by the State Duma on July 6, 2022

Approved by the Federation Council on July 8, 2022

Article 1

Bring in the Federal Law of July 27, 2006 No. 152-FZ "About personal data" (The Russian Federation Code, 2006, No. 31, Art. 3451; 2010, No. 27, Art. 3407; 2011, No. 31, Art. 4701; 2013, No. 14, Art. 1651; No. 51, Art. 6683; 2014, No. 23, Art. 2927; No. 30, Art. 4243; 2016, No. 27, Art. 4164; 2017, No. 9, Art. 1276; No. 27, Art. 3945; No. 31, Art. 4772; 2018, No. 1, Art. 82; 2019, No. 52, Art. 7798; 2020, No. 17, Art. 2701; No. 50, Art. 8074; 2021, No. 1, Art. 54, 58; No. 24, Art. 4188; No. 27, Art. 5159) following changes:

1) Article 1 to add with part 1.1 following of content:

"1.1. Provisions of this Federal Law are applied to processing of personal data of citizens of the Russian Federation performed by foreign legal entities or foreign physical persons based on the agreement which party are citizens of the Russian Federation, other agreements between foreign legal entities, foreign physical persons and citizens of the Russian Federation or based on the consent of the citizen of the Russian Federation to processing of its personal data.";

2) Article 4 to add with part 3.1 following of content:

"3.1. The regulatory legal acts adopted according to part 2 of this Article are subject to obligatory approval of authorized body on protection of the rights of subjects of personal data in cases if the specified regulatory legal acts govern the relations connected with implementation of cross-border transfer of personal data, processing of special categories of personal data, biometric personal data, personal data of minors, provision, distribution of the personal data obtained as a result of depersonalization. The term of the specified approval cannot exceed thirty days from receipt date of the corresponding regulatory legal act in authorized body on protection of the rights of subjects of personal data.";

3) in Article 6:

a) in Item 5 of part 1 of the word "be the beneficiary or the guarantor" shall be replaced with words "be the beneficiary or the guarantor. The agreement signed with the subject of personal data does not may contain the provisions limiting the rights and freedoms of the subject of personal data establishing cases of processing of personal data of minors if other is not stipulated by the legislation the Russian Federation, and also the provisions allowing failure to act of the subject of personal data as condition of the conclusion of the agreement";

b) state part 3 in the following edition:

"3. The operator has the right to charge processing of personal data to other person with the consent of the subject of personal data if other is not provided by the Federal Law, based on the agreement signed with this person, including the public or municipal contract, or by acceptance by state body or municipal body of the relevant act (further - the order of the operator). Person performing processing of personal data at the request of the operator shall follow the principles and processing rules of personal data provided by this Federal Law to observe confidentiality of personal data, to take the necessary measures aimed at providing accomplishment of the obligations provided by this Federal Law. In the order of the operator the list of personal data, the list of actions (transactions) with personal data which will be commited by person, performing processing of personal data, the purposes of their processing shall be determined, the obligation of such person to observe the confidentiality of personal data, requirements provided by part 5 of Article 18 and article 18.1 of this Federal Law, obligation at the request of the operator of personal data during effective period of the order of the operator including before processing of personal data shall be established, to provide the documents and other information confirming taking measures and observance for the purpose of execution of the order of the operator of the requirements established according to this Article obligation to ensure safety of personal data in case of their processing, and also requirements to protection of the processed personal data according to article 19 of this Federal Law shall be specified, including the requirement about the notification of the operator about the cases provided by part 3.1 of article 21 of this Federal Law.";

c) add with part 6 of the following content:

"6. If the operator charges processing of personal data to the foreign physical person or the foreign legal entity, responsibility to the subject of personal data for actions of specified persons is born by the operator and person performing processing of personal data at the request of the operator.";

4) regarding 1 Article 9 of the word "specific, informed and conscious" shall be replaced with words "specific, subject, informed, conscious and unambiguous";

Part 15 of Article 10.1 to state 5) in the following edition:

Disclaimer! This text was translated by AI translator and is not a valid juridical document. No warranty. No claim. More info