Deputy Minister of Digital Development Oleg Ivanov announced the signing of the document by the head of the department before introducing the bill to the government at a meeting of the working group on improving legislation in the field of personal data and the availability of digital technologies.
The bill regulates the policy of processing anonymized data. For example, now the operator will not be able to use any additional information that helps to determine the ownership of personal data by a specific subject. It will also be prohibited, in addition to anonymized data, to transfer information to third parties that will identify a specific person. De-anonymization of data will be prohibited, except for those cases when it is necessary to protect human life or health.
According to Ivanov, the new requirements for handling anonymized information are caused by the fact that technologies are already available that make it possible to de-anonymize data and identify a specific person by them: “Anonymization and anonymization are different concepts. Deanimation is a reversible thing. “
It will be possible to use anonymized personal data without consent only for research and statistical purposes, the Ministry said.
The members of the working group believe that the draft law in the current version does not solve the problem, but on the contrary – leads to a toughening of the legal regime and does not create additional opportunities for processing anonymized data that are widely used by business. In particular, for advertising targeting.
“When transferring an impersonal data array to a third party, processing this data for purposes other than those for which the data was collected is impossible, since it requires a new consent of the citizen, but it is impossible to apply for it, since the data is impersonal,” explains the press service representative ANO Digital Economy Ekaterina Batmanova. According to her, the draft law contains redundant requirements for the identification of the subject of personal data: its previous version provided for the possibility of obtaining consent to the processing of personal data without specifying the full name (using an email or phone number), and the current version assumes that the user must indicate the full name in order to receive certain other services.
“When accepting these requirements, citizens will not use, for example, Russian dating services, since they will not want to enter their full name there. As a result, amendments to the law will not strengthen protection, but, on the contrary, will lead to the flow of our citizens’ data abroad, ”says Batmanova.
In world practice, various methods of data depersonalization and their combinations are used, which make it possible to reliably secure information, notes the President of the Big Data Association Anna Serebryanikova: depersonalization is assigned a low coefficient – from 0 to 0.4. If after depersonalization it is impossible to establish the owner of the data without significant efforts, then the coefficient will be higher – from 0.5 to 0.8 ”. If it is possible to establish the identity of the subject of personal data only with the help of extremely laborious and expensive procedures, then the data are recognized as impersonal, and the methods by which they were “cleared” of personal data receive a coefficient from 0.8 to 1 – the maximum assessment of the degree of anonymization, adds Serebryanikova.
The bill proposes amendments to federal legislation that largely eliminate the difference in legal relations arising from the collection, processing and use of personal and anonymized data, says Yuri Fedyukin, managing partner of the law firm Enterprise Legal Solutions. “Equating anonymized data with personal data means that in relation to anonymized data, the operator will be obliged to take all measures to protect them, as for ordinary personal data,” agrees Anastasia Fedorova, leading expert of the Information Security area of the CROC IT company.
For a business, equating anonymized data with personal means the emergence of new grounds for bringing it to justice in connection with a violation of the legislation governing legal relations in the field of their collection, storage, processing and distribution, Fedyukin warns: “Formally, this means that any attempt to use anonymized data, that is, an array containing information about a multitude of subjects, if at least one of them did not give permission to use them for some very specific purpose or withdrew his permission, can lead to a violation of the law and penalties. ” All this will make the work of most companies that work in one way or another related to big data as difficult as possible, as well as government agencies, Fedyukin concludes.
The structure with the receipt of consent to anonymization is non-working and will lead to the suspension of many projects related to the processing of big data: it is not clear why create an additional artificial barrier if, upon receipt of the personal data itself, consent to their processing has already been obtained, says Anna Aibasheva, a representative of VimpelCom: The proposed regulation will significantly limit the development of the digital economy in Russia, the introduction of new services and technologies, and will significantly slow down the transition to a new technological order. “
Representatives of MTS and Mail.ru Group declined to comment.
.