Data ethics and data culture

and

Information privacy

A person's private sphere

values that matter to people regardless of law

solitude - the right to be alone

intimacy - the circle one trusts

secrecy - what is not disclosed

anonymity - not being singled out of the crowd

Data protection

Lawful data circulation

rules under which the operator answers to subjects and the regulator

accountability - ability to prove compliance

lawfulness - a basis and a lawful purpose

good faith - no deceit, no surprises

transparency - clear information

Shared zone of two frames

• minimisation
• processing limitation
• integrity
• confidentiality

Takeaway: data protection sets the rules for lawful circulation, while information privacy explains why they are needed. Minimisation and security serve both aims at once

The wish for solitude and a protected personal space arose as a reaction to technology, above all photography. There are four kinds of privacy, and all remain relevant in the digital world

Art. 22 of the Constitution

Bodily

bodily integrity: examinations, medical interventions, collecting biometrics

Art. 25 of the Constitution

Spatial

home, workplace and other personal space, including from surveillance

Arts. 23, 24 of the Constitution

Informational

collecting, storing, using or disseminating private-life information without consent is not allowed

Art. 23(2) of the Constitution

Communication

secrecy of correspondence, telephone calls, postal, telegraph and other messages

Link to PD: Law 152-FZ sets out the regime for circulating information about a person, i.e. informational privacy, so PD is its main legal tool

Art. 3(1), 152-FZ

Any information

relating to a directly or indirectly identified or identifiable individual

not only data that precisely identifies a specific person, such as a passport or SNILS

but any that can be associated with a person directly or through other data

What can be PD depending on context

• Full name
• date of birth
• age
• passport series and number

• TIN
• SNILS
• home address
• phone number

• e-mail
• job title and workplace
• photo and video image

• friends and relatives
• social media accounts
• account login

• IP address
• GA ID and IDFA
• device model
• geolocation

• loyalty programme ID
• points balance
• purchase history

• favourite products
• favourite shop

purchasing power rating

More: whether data is PD depends on context and the operator's capabilities; the algorithm and attributability index are in Section 05 Definition of PD

• Feature
• Private life
• Personal data

• Regulatory approach
• non-interference and respect
• regulating circulation

• Regulatory method
• prohibition
• permission

• Object of regulation
• special sphere of life
• data circulation

• Protected good
• intangible: dignity
• intangible: information

• Protection method
• material: compensation for moral harm
• intangible: processing principles

Parallel

Two articles - two subjects

Europe separates respect for private life (Art. 7, EU Charter of Fundamental Rights) from PD protection (Art. 8). Experts see Russia making the same split via Arts. 23-24 of the Constitution

Result: a ban protects after the fact, via courts and compensation, while permission sets advance processing rules that the operator must follow and be able to prove

1950

Council of Europe

Convention on Human Rights

Art. 8 on private life, a response to totalitarian abuses. Before it, in 1948, the UN Universal Declaration of Human Rights

1970-1973

Hesse, Sweden

First data laws

mainframe era: data is processed freely given a basis, general principles and the subject's right of access

1980-1981

OECD, Council of Europe

First generation

OECD Guidelines and Convention 108: concepts, principles, subject rights and free transfer between countries

1995

EU

Second generation

Directive 95/46/EC: closed list of bases, consent, independent supervision amid the internet, direct marketing and data mining

2016-2018

EU, Council of Europe

Third generation

GDPR and Convention 108+: risk-based protection, breach notification, portability. Backdrop - social media, big data and Snowden's revelations

For Russia: Russia ratified Convention 108 (160-FZ of 19.12.2005, in force for it from 01.09.2013), and Law 152-FZ is in substance second generation. Protocol 108+ was not in force at 13.10.2026: 34 of 38 ratifications needed, Russia's signature suspended since 16.03.2022

Dark to light: heavy (56), robust (32), moderate (43) and limited (33) regulation, grey - no data. Russia is in the moderate group

Three regulatory models

European

one law for all, an independent supervisor and priority of human rights

American

sectoral federal and state laws, protection against intrusion into private life

Asian

close to European, but state interests outrank the individual's

Russia: Russian law is European by origin but trending toward the Asian model: database localisation and CBT control

28.01.1981

Strasbourg

Convention 108 adopted

first international treaty protecting people in PD processing

2005-2006

Russia

Ratification and 152-FZ

Russia ratified the Convention in 2005; Law 152-FZ followed in 2006

01.09.2013

in force

Convention in force for Russia

even after Russia's CoE exclusion on 16.03.2022

10.10.2018

Convention 108+

Protocol 223

added consent, breach notification, and biometrics and genetics as sensitive data

2022-2026

status

Protocol not yet in force

Russia's signature deemed suspended from 16.03.2022

55

Convention parties

46 Council of Europe states and 9 outside it, including Russia

34 of 38

Protocol 223 ratifications

needed for Convention 108+ to enter into force

88

adequate states

after 265-FZ, Convention membership does not confer adequacy; the list is set by RKN Order 253 from 30.10.2026

• 1
• Transparency and accountability

tell clients what you do with their data and why. No lawful purpose, nothing else matters (Art. 5(2))

• 2
• Clear purposes

state purposes plainly, without legalese like "including but not limited to", Art. 14(2)

• 3
• Fairness and lawfulness

be specific: nobody believes the purpose "to improve user experience", Art. 5(2)

• 4
• Limited processing

trust is given for a specific purpose; for new purposes earn it or obtain consent, Art. 5(2)

• 5
• Open transfers

say when you share data with others or obtain it not from the client, Art. 18(3)

• 6
• Minimisation

do not bite off more than you may swallow: do not ask for unneeded data, Art. 5(5)

• 7
• Confidentiality

guard client data as your own, their secrets most of all, Arts. 7, 10, 11

• 8
• Quality and storage limitation

keep data accurate and current, do not become a data warehouse or graveyard, Art. 5(6)-(7)

• 9
• Right to know and go

tell clients what you hold on them; if they leave, let go and stop bothering them, Arts. 14, 15

• 10
• Honesty

if data goes wrong, warn people before problems reach them. The law requires notifying Roskomnadzor (Art. 21(3.1)), ethics - telling people

• Principle
• Convention 108
• GDPR
• 152-FZ

• Lawfulness and fairness
• yes
• yes
• Art. 5(1)

• Transparency
• yes
• yes
• via duties

• Purpose limitation
• yes
• yes
• Art. 5(2)

• Minimisation
• adequate, not excessive
• data minimisation
• non-excess, Art. 5(5)

• Accuracy
• accuracy and currency
• accuracy and currency
• accuracy, sufficiency, currency, Art. 5(6)

• Storage limitation
• yes
• yes
• Art. 5(7)

• Security
• separate article
• integrity and confidentiality
• duties, Arts. 7 and 19

• Accountability
• no
• yes
• via duties

• No merging databases with incompatible purposes
• no
• no
• Art. 5(3)

• Right
• In plain words
• Basis in 152-FZ

• Humanism
• they are people like you, not mere data subjects: put yourself in their shoes
• ethics

• Fairness
• data belongs to people, you were given it to hold for a while, and your rights end where theirs begin
• ethics

• Information
• explain in good time and clearly what happens to the data: uncertainty breeds distrust and fear
• Art. 18, Art. 18.1(2)

• Access
• trust but verify: free access to your own data, but not to other people's
• Art. 14(2), Art. 20(1)

• Correction
• Vlad will not be Vadim: let people fix errors in data
• Art. 14(1), Art. 21(2)

• Deletion and blocking
• the right to be forgotten, or at least data blocking during talks
• Art. 14(1), 9(2), Art. 21

• Objection
• against spam, especially phone spam, and a bank's "AI" decisions with no human
• Art. 15, Art. 16(3)-(4)

• Portability
• do not imprison data: let people take a copy and move to another service
• no, this is GDPR

Data ethics code

Each organisation's own

No universal rules exist, so an organisation writes its own code. It supplements processing and protection policies and reflects its culture, values and goals

one answer where Art. 5 of 152-FZ is evaluative

marks out reasonable subject expectations in advance

shows this limit externally as a commitment

01

Respect

for the people behind the data

02

Fairness

no bias, discrimination or isolation

03

Accountability

open practice, governance mechanisms and remedies

04

Transparency

explainable processing and decisions

Caution: the code has no legal force, but practice that departs from the operator's own code works against it. Adopt only principles you are ready to follow and monitor

Rights the organisation answers for

• inviolability of private life
• dignity

• diversity
• fairness
• equality

• autonomy
• freedom from coercion

• freedom from tracking
• freedom from deception, manipulation

What to aim for

understand and respect all sides' interests

use data so that people benefit too

grasp the impact on people and cut harm risk

respect autonomy: real choice and control, not imitation

vs

Persuasion: the person chooses

refusing is as easy as agreeing

optional processing is not pre-enabled

Manipulation: interface skews the choice

refusal is hidden deeper than consent

the tick for optional processing is set by default

Disputed: no general test to tell them apart exists in law or practice. It is expressly set that silence is not consent to dissemination (Art. 10.1(8)), and pre-ticked add-on service boxes in consumer credit are banned (Art. 7(2), 353-FZ)

Four elements of fairness

Datasets

no bias, inaccuracy or outdated samples

Mindset

no discrimination or isolation, esp. of vulnerable groups

Governance

diverse views and experience in the teams deciding on processing

Access and opportunity

an outcome inclusive of those it affects

Legal link

Art. 5(1), (6), 152-FZ

A biased or outdated dataset breaches the requirement of accurate, sufficient, current data and is assessed through fairness of processing

check datasets for significant decisions periodically: bias builds up unnoticed

record the date and result of the check - it is evidence of good faith

tie frequency to the data update rate and the weight of decisions

vs

Marks of ethical work

What the organisation needs

open and transparent data practices

robust global and local governance mechanisms

effective remedies and redress for breaches of ethical principles, not just the law

feedback: people can ask and object on ethical and legal grounds

Ethical objection channel

Dispute inside, not at the regulator

law lets one contest lawful processing only on set grounds; the code also covers formally lawful but unfair processing

such an objection reaches the operator before a Roskomnadzor complaint or public scandal

define who reviews an objection, within what time, and whether they may stop lawful processing

Tip: ethical objection statistics are an early indicator of practice diverging from audience expectations, firing before complaints and claims

Transparency means processing and automated decisions make sense to people: a person grasps the purposes, benefits, own risks and social and ethical consequences

Where the stakes are highest

Diagnosis

medical diagnostics

Credit

credit approval decision

Job

job prospects

In 152-FZ

Art. 16: human-free decisions

A decision with legal consequences based solely on automated processing is allowed only with the subject's written consent or in cases provided by law

the operator explains the procedure and effects and allows objection, Part 3

objections are reviewed within 30 days, Part 4

Important: decisions in AI and machine learning are not always easy to explain, so their soundness must be open to independent and unobstructed verification

06.2018

European Commission

AI HLEG group

independent high-level expert group on AI set up under the EU AI strategy

04.2019

AI HLEG

Ethics guidelines

not Asimov's three laws of robotics but an analysis of AI ethics in healthcare, education and consumption

01.08.2024

EU

AI Act

Regulation 2024/1689 is phased in until August 2028 and applies alongside GDPR

09.07.2025

Bank of Russia

AI Ethics Code

information letter IN-016-13/91 on the AI ethics code in the financial market

01.09.2026

Russia

Law 243-FZ

on supporting AI technology development is in force, part (incl. AI-content warning) from 01.03.2027

Takeaway: the guidelines were not binding but set the frame that regulation builds on. The framework AI law 243-FZ applies from 01.09.2026, but in model projects the main burden still falls on the PD rules

Data culture is a principle whereby all employees, especially decision-makers, in changes and decisions rely first on data and the results of analysing it

vs

HiPPO

Highest-paid person's opinion

Highest Paid Person's Opinion

manager's intuition and experience rule

statistics are noted, but opinion has the last word

still a popular model in the 21st century

Data-Driven

Data culture

Data-Driven culture

operational and strategic decisions rest on data and analysis results

built on objective, significant collected data

not revolutionary: income and costs were always counted, what changes is data's weight

Link to privacy: ethical principles stay a declaration unless the organisation has a data culture: it is the environment in which privacy requirements are met

This agreement implies four commitments - without them dashboards and reports stay pictures

1

Invest

money and time in extracting, storing, analysing, interpreting and visualising data

2

Listen

before deciding, stop and tell yourself: let us look at the numbers

3

Understand

a wrong conclusion from right figures is terrifyingly easy, so decision-makers need basic analytical thinking

4

Trust

be guided by data in decisions, but remember analysts may have missed seasonality, elections or other factors

Important: a manager who acts on experience against a report is not necessarily wrong: dialogue and mutual trust of managers and analysts decide

Analysts

Seek answers

financiers, economists, marketers: research, find causes and the influence of factors, e.g. on rising costs

Techies

Build algorithms

DB developers, mathematicians, Data Science: storage, algorithms, failure-free report automation

Visualisers

Make it clear

turn tables into charts, slides and dashboards, brief the designer and developer

Customers

Want conclusions

managers need not charts but decision options and forecasts in plain language, e.g. which prices maximise sales

For privacy: every group must meet processing requirements, yet they usually reach only the customer. Pass them to everyone directly (Art. 18.1(1)(6), 152-FZ): extra attributes, export lifetime and recipients are decided where data is processed

By the Privacy by Design philosophy, the less data an operator collects and processes, the lower the risk of violating subjects' rights and harming the operator itself. Privacy design strategies fall into two groups

Process-oriented

Organisational strategies

define processes ensuring responsible PD management: who is responsible for data and in what order

• Data-oriented
• What it does to a PD set

• Minimise
• limits collection, excludes excess PD from sets and deletes or destroys it

• Hide
• mixes, obscures, masks or restricts access so PD is not unlawfully disclosed

• Separate
• stores sets apart to make matching and merging harder

• Aggregate
• aggregates and groups PD, reducing detail to a level that is still useful

Section result: data culture without privacy gives efficiency at the cost of trust, privacy without culture gives compliance nobody follows