Your SEO optimized title page contents

Purelegal

 

Legal Services and Consultancy, Saint Petersburg, Russia

Protection of employees personal data

Under Russian labor law, employer is obliged to protect the information of its employees (hereinafter – Employees Personal Data). The translated Chapter 14 of Russian Labor Code is attached below.

Employees Personal Data include any kind of personal information (such as name, age, family status, photo, address etc.). As stated in Article 87 of Russian Labor Code, this is the employers obligation to adopt the procedure for storing and using of Employees Personal Data.

 

Russian Labor Code

Chapter 14. EMPLOYEE PERSONAL DATA PROTECTION

Article 86. General requirements for employees’ personal data processing and warranties of this data protection

To ensure human rights and freedoms of a citizen, an employer and its representatives shall comply with the following general requirements during employee’s personal data processing:

1) processing of personal data of an employee may be performed only to ensure compliance with the  laws and other regulatory legal acts, assist employees in employment, education and promotion, ensure personal safety of employees, control of quality and quantity of performed work and ensure property safety;

2) an employer shall follow the Constitution of the Russian Federation, this Code and other federal laws for determination of scope and content of processed personal data of an employee;

3) all personal data of an employee shall be received only directly from the employee. If personal data of an employee can be only received from a third party, then the employee shall be notified of it in advance and a written permission of the employee is required. An employer shall inform an employee of purpose, possible sources and means of obtainment of personal data and of type of necessary personal data and consequences of employee’s refusal to provide a written permission for obtainment of necessary personal data;

4) an employer is not entitled to obtain and process data about an employee that refers to special categories of data as per the Legislation of the Russian Federation in the sphere of personal data, except for cases provided for by this Code and other federal laws;

5) an employer is not entitled to obtain and process personal data of an employee about an employee’s membership in professional organizations, public organizations and about activities of an employee in trade unions, except cases provided for by this Code and other federal laws;

6) an employer is not entitled to rely only on employee personal data obtained as a result of its automated processing when adopting decisions related to the interests of this employee;

7) protection of personal data of an employee from unlawful use or loss shall be ensured by an employer at its own expenses and in accordance with the procedure stipulated by this Code or other federal laws;

8) employees and their representatives shall be familiarized against signature with employer's documents establishing procedure for personal data processing, as well as be informed of their rights and obligations in this sphere;

9) employees shall not abandon their rights for privacy protection;

10) employers, employees and their representative shall jointly work on development of measures for employees personal data protection.

Article 87.  Storing and using employees personal data 

Procedure for storing and using of employees personal data shall be established by an employer in compliance with the requirements of this Code and other federal laws.

Article 88. Disclosure of employee’s personal data

An employer shall follow the below requirements in all cases of disclosure of employee’s personal data: 

an employer shall not disclose personal date of an employee to a third party without written permission of an employee, except cases when it is necessary to prevent a threat to health and life of an employee and except cases, specified by this Code or other federal law;

an employer shall not disclose personal date of an employee for commercial purposes without written permission of an employee;

an employer shall notify entities which receive personal data of an employee that this personal data may be used only for the purposes it was provided for and request the third parties to provide a confirmation of compliance with this rule.  Entities that receive personal data of an employee shall comply with secrecy order (confidentiality).  This provision does not govern cases when personal data of employees is disclosed according to this Code and other federal laws;

an employer may perform disclosure of employee’s personal data within one organization (one individual entrepreneur) according to local regulatory acts of this organization. Confirmation of an employee’s familiarization against signature with this act is required;

an employer may allow access to personal data of an employee only for authorized entities and these entities have the right to receive only personal data of an employee that is required for performance of specific functions;

an employer shall not request information about state of health of an employee, except information that is relevant to an issue of capability of performing job duties by an employee;

an employer may disclose personal data of an employee to the representatives of employees as per the procedure stipulated by this Code and other federal laws, and shall limit this information to the personal data that is required for fulfillment of functions by these representatives.

Article 89. Employees’ rights related to personal data protection stored by an employer

Employees have the following rights related to the protection of personal data stored by an employer: 

obtain complete information about their personal data and its processing;

unimpeded free-of-charge access to their personal data, including right to obtain copies of any record which include personal data, except cases specified by federal law;

choose representatives for protection of their personal data;

access to medical documentation containing information on their state of health, with assistance of a medical specialist of their choice;

request for exclusion or correction of incorrect or incomplete personal data and information that was processed with violation of requirements of this Code or another federal law.  If an employer refuses to exclude or correct personal data of an employee, then an employee has a right to inform an employer in a written form about disagreement and provide relevant justification for this disagreement.  An employee has a right to supplement personal data of estimative nature with a statement expressing his/her point of view;

Request the employer to inform all entities, which were previously provided with incorrect or incomplete personal data of an employee, about all exclusions, additions and corrections in personal data of an employee;

Appeal to court against any non-legitimate actions or inactions of an employer related to processing and protection of personal data of an employee.

Article 90. Liability for violation of the regulations governing processing and protection of personal data of an employee

Entities that are guilty of violation of provisions of the Legislation of the Russian Federation in the sphere of personal data in the course of employee’s personal data processing, shall bear disciplinary and financial liability pursuant to the procedure provided for by this Code and other federal laws, and shall be also brought to civil, administrative and criminal liability as per the procedure, established by federal laws.