This article was first published on the IAPP Privacy Advisor.
Beginning March 1, 2021, Russia will impose restrictions on the
processing of personal data publicly available on the internet and
offline. The legislative changes are aimed at fighting the
uncontrolled dissemination of personal information.
Change of lawful basis
Under current Article 6(1)(10) of the federal law On
Personal Data No.152-?? dated July 27, 2006, any data
operator (the Russian equivalent of the term controller) may
process personal data if the data subject made it publicly
accessible or instructed another person to do so. In contrast with
Article 6(1) of the EU General Data Protection Regulation, there is