The press service of Roskomnadzor told a ComNews correspondent: "Only companies that have confirmed their ability to organize secure processing of PD can be entrusted with the storage and processing of significant volumes of personal data (from 100 thousand records of personal data)." They must be subject to increased requirements:
have at least five employees with higher education in the field of information security, responsible for protecting the operator’s personal data bases;
have financial security panama whatsapp resourcefor liability for losses due to a possible data leak in the amount of at least 100 million rubles;
use databases for processing personal data only on the territory of the Russian Federation;
confirm that the processing of personal data of citizens is carried out in accordance with the requirements for ensuring information security.
On August 1, the Chairman of the State Duma Committee on Information Policy, Information Technology and Communications, Alexander Khinshtein, announced at a press conference following the spring session that during the autumn session of 2024, State Duma deputies and Roskomnadzor will discuss a possible bill that introduces a new institute of authorized personal data operators.
"According to our plan, legal entities and structures should appear that, from the point of view of professional training and confirmation of the quality of their work by authorized bodies, will store the personal data of others," noted Alexander Khinshtein.
Read also
Authorized personal data operators may appear in Russia
The State Duma of the Russian Federation and Roskomnadzor will discuss a bill on the creation of a new institute of authorized operators of personal data (PD) in the autumn session. Authorized companies will be able to store PD of other organizations and individual entrepreneurs who cannot ensure the safety of PD. IT market players believe that such measures can help small and medium businesses.
The press service of Roskomnadzor explained that organizations often have an unjustified, excessive accumulation of data about citizens - "just in case", without a clear purpose for their further use: "This contradicts one of the key principles of personal data processing: the personal data being processed should not be excessive in relation to the stated purposes of their processing."
"We believe that it is necessary to act through industry legislation, by developing mandatory standards for working with data. It would be appropriate for the relevant departments to formulate and control what specific set of data is really the minimum necessary to achieve certain goals, what are the specific features of work in each specific case," added the press service of Roskomnadzor.
From the response of the representative of the press service of Roskomnadzor it follows that it is not yet clear which body will determine the authorized operators of personal data: "The mechanisms for implementing the project (mandatory nature, specific requirements, etc.) will be worked out during the preparation of the legislative initiative."
The head of the legal committee of ARPP "Domestic Software", the head of the legal department of LLC "Electronic Office Systems (Design and Implementation)" Daria Shakhverdova called the requirements quite adequate and feasible for medium and large organizations, and the criterion for the presence of a financial guarantee - correct.
On the contrary, the Director of Information Technology of EdgeCenter (cloud solutions provider EdgeCenter) Sergey Lipov finds the requirements for authorized PD operators strict, especially in terms of the financial cushion of 100 million rubles. In his opinion, this could become a significant barrier to entry into the market for small and medium-sized companies.
According to him, having five employees with specialized higher education on staff can also cause difficulties for small companies: finding and retaining such specialists is difficult and expensive.
Read also