Russia Jurisdiction: Prospective Filing System Inclusion

The factor of Prospective Filing System Inclusion is addressed in Russia's Federal Law on Personal Data (№ 152-FZ). This factor extends the applicability of the law to data processing activities conducted without automated means if the personal data is intended to be part of a filing system.

Text of Relevant Provisions

№ 152 - FZ Art.1(1):

"1. This Federal Law regulates activities related to the processing of personal data by federal government bodies, state bodies of constituent entities of the Russian Federation and other state bodies (hereinafter referred to as “state bodies”), by local government bodies and other municipal bodies (hereinafter referred to as “municipal bodies”), by legal entities and private entities, both automatically, including in data telecommunications networks, and without the use of such means, provided that the data processing is by its nature similar to the actions (operations) of automatic data processing, that is, allowing users to search personal data recorded in physical media or contained in card catalogs or other systematized legislation of personal data in accordance with the specified algorithm and (or) to have access to such personal data."

Original (Russian):

"1. Настоящим Федеральным законом регулируются отношения, связанные с обработкой персональных данных, осуществляемой федеральными органами государственной власти, органами государственной власти субъектов Российской Федерации, иными государственными органами (далее - государственные органы), органами местного самоуправления, иными муниципальными органами (далее - муниципальные органы), юридическими лицами и физическими лицами с использованием средств автоматизации, в том числе в информационно-телекоммуникационных сетях, или без использования таких средств, если обработка персональных данных без использования таких средств соответствует характеру действий (операций), совершаемых с персональными данными с использованием средств автоматизации, то есть позволяет осуществлять в соответствии с заданным алгоритмом поиск персональных данных, зафиксированных на материальном носителе и содержащихся в картотеках или иных систематизированных собраниях персональных данных, и (или) доступ к таким персональным данным."

Analysis of Provisions

• Article 1(1) of the Federal Law № 152-FZ specifies that the law applies to the processing of personal data conducted without automated means if the processing is similar in nature to automated processing, meaning it enables users to search and access personal data in a systematic way. This includes data recorded on physical media or contained in card catalogs or other organized collections of personal data.
• The inclusion of this factor ensures that the law covers manual data processing activities that are structured in a way that mimics the functions of automated processing, particularly those where data is systematically organized for easy retrieval. This prevents data controllers from circumventing legal obligations by merely avoiding automated systems, as the law applies as long as the data is intended to be part of a structured filing system.
• The rationale for including this factor is to provide comprehensive data protection by ensuring that all processing activities, whether automated or manual, are regulated under the law if the data is or will be systematically organized. This approach is designed to close potential gaps in data protection that could arise if manual processing were excluded.

Implications

• For businesses operating in Russia, this means that even manual data processing activities are subject to the Federal Law on Personal Data if the data is intended to be organized into a filing system. Companies must ensure that their manual data handling practices comply with the law, particularly if they involve systematic organization or retrieval of personal data.
• An example would be a company maintaining physical records in a filing system that allows for the systematic search and retrieval of personal data. Even if no automated means are used, the company must adhere to the provisions of the Federal Law on Personal Data because the data processing is similar in nature to automated processing.
• This provision reinforces the need for companies to implement robust data protection measures from the outset, regardless of whether they use automated systems, as the law's scope extends to manual processes that organize data into filing systems.