Update: On June 8, President Putin signed the bill into law. The law will enter into force incrementally, starting January 1, 2022.
A new law for creating a “uniform federal database” in Russia infringes on the right to privacy and weakens protection of personal data for everyone living in the country. Parliament’s lower chamber adopted the draft law on May 21 and it will enter into force once endorsed by the upper chamber and the president.
The federal database, which is set to be fully functional by 2025, would contain personal data of the entire population of Russia, including birth certificates, passport details, marital status, any change of gender, education, residence permits abroad, employment, and taxpayers’ information. References to parents’ and children’s profiles would also be included.
The database would be run by the Federal Tax Service, and other government agencies would feed into it. The data could be shared with election commissions, courts, prosecutors, and other law enforcement. According to the legislators, the draft law aims at ensuring reliability and consistency of data countrywide.
Russian law ‘on personal data’ prohibits merging databases collected for different purposes. It also forbids excessive collection and storage of data – meaning anything collected must be directly related to what the data will be used for. These principles echo the Council of Europe’s Convention 108+ for the protection of individuals with regard to the processing of personal data, which Russia is a party.
The head of Federal Tax Service noted that the unified database would allow the creation of “an ideal golden profile” for everyone, which could be used, among other things, for making decisions regarding allocation of social benefits by calculating family income based on information from relevant profiles. According to the Convention 108+, however, every individual has a right not to be subject to a decision significantly affecting them based solely on automated processing of data.
The uniform database concept allows the government to store excessive amounts of data indefinitely as well as share it with governmental agencies without a person’s explicit consent. It also jeopardizes security of personal data, gathering it all in one place rather than storing it in a decentralized way.
Proposing a system that runs contrary to the data protection principles enshrined both in national legislation and international agreements Russia is a party to, the law on “uniform federal database” can do more harm than good.
