Summary of key amendments
On 29 October, a draft law was adopted in its first reading on the separate form of consent to personal data processing. According to the text of the draft law, effective 1 March 2025, the consent to personal data processing will have to be drawn up separately from any other information or documents signed or accepted by the data subject.More details
The draft law “On amending article 9 of the Federal Law ’On Personal Data’ and article 10 of the Law of the Russian Federation ’On the Protection of Consumer Rights’” (“Draft Law”) was introduced to the State Duma in late July 2024 and is included in the tentative programme of work for the State Duma’s autumn session. We note that there is substantial support for the Draft Law and we expect that it may be passed in the very near future.According to the text of the Draft Law, “the consent to personal data processing shall be formalised separately from other information and/or documents to be confirmed and/or signed by the data subject”. Furthermore, the data processing consent may still be given by the data subject in any form which makes it possible to confirm the fact of its receipt, and no amendments are planned to be made to the draft law in this respect.
In addition, companies will no longer be able to restrict consumers’ access to information about products or services if consumers are unwilling to provide information about themselves.
The new procedure for obtaining data processing consent is expected to come into force on 1 March 2025.
If passed, the Draft Law may require a number of companies to make adjustments to the way they process users’ personal data and, probably, to make changes to the procedure for entering into user agreements (based on our understanding of the text of the Draft Law, when entering into user agreements for online services, a separate/additional step will be required to obtain consent from users).
