Landmark decisions 2022-2024

A40-163911/2021

Aeroflot won in three instances

the company challenged items of an order from the RKN Central Federal District office. The Moscow AC granted the claims, the 9th AAC and Moscow District AC upheld the decision

Court findings

processing of former employees' PD need not stop five years after dismissal

documents, including archived ones, may be kept on paper or electronically

the law has no concept of a "document moved to archive status": the periods of Rosarchiv Order No. 236 of 20.12.2019 apply because the document is on the list

consent to transfer employee PD (Art. 88 Labour Code) must meet Art. 9(4) of Law 152-FZ only for special categories, biometrics or CBT to inadequate countries

an employer transfers employee PD without consent in cases under Art. 6(1)(2)-(11) of Law 152-FZ, and (5) on contracts covers employment relations

Roskomnadzor's position: Art. 6(1)(5) applies only to civil-law contracts, while Ch. 14 of the Labour Code sets the grounds for processing in employment

1

Anti-corruption regulations

VTB adopted a conflict of interest regulation under Art. 11(2) and 13.3(1)-(2) of the anti-corruption law; employees are familiarised with it

2

Internal check

under paras. 7.3 and 7.4 the commission checked staff via SPARK and the FTS website

3

Finding

one employee proved to be a director and 33% co-owner of another company

4

Complaints

RKN's Kemerovo Region - Kuzbass office refused the employee's request to inspect the bank seven times

5

Court

RKN's refusal upheld, no offence under Art. 13.11(2) of the CAO, no higher-court rulings in the database

Court's conclusion: an employer collecting employee data from open sources to check conflicts of interest processes it in the operator's legitimate interest (Art. 6(1)(7) of Law 152-FZ) if employee rights are not infringed

2-907

Presnensky District Court

Employee's claim dismissed

an SK Enmuv Rus employee disputed the employer's right to transfer his PD and instruct third parties to process it without consent. No higher-court rulings found

01

Contract and law

employment processing serves the contract and the law and is not conditional on consent; otherwise no contract could be made or performed

02

Own interest

an employer may transfer PD and instruct third parties to process it in its legitimate interest if employees' rights are intact

03

Electronic archive

documents are also stored electronically; PD of dismissed staff is kept for retention periods, including in information systems

04

Copies are not PD

partial loss of HR records does not violate employee rights: copies only carry PD; losing them is not losing PD

Constitutional Court reviewed Art. 152(1) of the Civil Code: employee punished by order, colleagues told, order later annulled

1

Order and notice boards

employee punished, misconduct posted on notice boards inside the organisation

2

Court annulled the order

misconduct not proven, so the information was untrue from the moment the order was issued

3

Retraction

a good-faith employer reports the order's illegality, in agreement with the employee

4

Court remedy

if the employer avoids a retraction, the employee demands it in court

Employer's right

to decide whether to disseminate the penalty and how fully to describe the breach, if the content fits the purpose and is clearly linked to it

No compensation

if information was disseminated in good faith before the order was found unlawful, no losses or moral harm are recovered from the employer

Nestle Russia

Employee's claim partly upheld

the employee gave PD consent in his own form, not the employer's template, and lost health insurance and meal subsidy. 1st Cassation Court upheld it

• ?
• Can benefits be cut for consent not on the employer's form?

No: demanding a strict template and withdrawing extra benefits for refusal is not allowed

• ?
• In what form is consent given?

In any form that can prove it was obtained (Art. 9(1) of Law 152-FZ)

• ?
• What else tipped the case?

The employer did not prove it explained what was missing in the consent and why, without it, transferring PD to a third party has no basis

• ?
• Can an internal act be declared invalid?

Labour law has no such concept: rights violated by an internal act are protected only in an individual labour dispute

Case law: same approach in the 3rd Cassation Court ruling of 18.12.2023 No. 88-25965/2023

Court's view in the Nornickel dispute

Consent is a transaction

written, oral or by conduct (Supreme Court Plenum, 23.06.2015, No. 25, para. 46; Civil Code Arts. 153, 158); oral covers purposes obvious from context (para. 47)

A shoot is not consent

a photo from a corporate shoot meant to reward staff cannot go on the jobs site, and a day's pay is not payment for posing

Labour Code, biometrics

Art. 88 of the Labour Code (para. 3) bans disclosing employee PD for commercial purposes without written consent; the court held an identifying photo to be biometric PD

What written consent covers

• 1
• dissemination of the employee's biometric PD

• 2
• commercial use

• 3
• use by the employer and group companies

• 4
• use during and after employment

Result: cassation upheld ₽80,000 compensation against PJSC MMC "Norilsk Nickel" and remitted the photo-use ban for a new hearing

Dissemination

Art. 10.1 consent is just one kind of consent

PD can be disseminated on other Art. 6(1) grounds of Law 152-FZ

the insurer discloses PD of managers and participants under Art. 6(1)(2), (11) in performance of Art. 6(6)(2) of the Insurance Business Law

neither Art. 10.1 nor other rules require consent to process PD to meet statutory disclosure duties and requirements

E-mail

The address alone is not PD

as with a phone number, an address alone, without other identifiers, cannot identify a specific person

RKN's claim that an address is permanent and unique was rejected

an address is not permanent: after a mailbox is deleted a new user may register it, like a reassigned phone number

Result: Supreme Court declined the complaint. Section 05 "Definition of PD": courts alternately apply and reject the e-mail uniqueness test

FAS held that an e-mail address is not PD and doubted that advertising consent can be obtained via an address without verifying its owner

E-mail is PD

confirmed by Art. 3(1) of Law 152-FZ, Govt Resolution 13.09.2019 No. 1197 and Ministry of Digital Development letter P25-5623 of 17.03.2022

Actions under an account

anything done under an account is deemed done by the user until he reports unauthorised access

No verification

as a rule a site owner neither must nor can confirm that an address belongs to a given person

Form of consent

written consent to e-mail advertising mailings is not mandatory

Result: courts sided with 2GIS; Supreme Court rejected FAS appeal

₽7m

Ookla fines

Both penalties survived cassation

₽1m, Part 8: magistrate 12.07.2022, Tagansky District Court, 2nd Cassation Court 26.12.2022

₽6m, Part 9, repeat offence: magistrate 16.10.2023, Tagansky District Court, 2nd Cassation Court 14.03.2025

Targeting not required

no Russian interface, Russian-language policy, rouble payments or delivery, but registration is open to Russians, so localisation applies

248-FZ gives no cover

requirements of Law 248-FZ and Govt Resolution 10.03.2022 No. 336 do not apply to persons outside Russia

What is localised

network activity data, device identifiers and cookies obtained when monitoring behaviour

E-mail as an ID

if registration needs only an address that cannot be reused, it is a unique identifier and PD

Burden of proof

in the ₽6m case the authority need not prove where databases are located: the operator proves localisation

Conclusion: a foreign site needs measures to bar Russians: asking citizenship before access, blocking Russian IP addresses

Public regime

Contract cannot supplement law

the PD processing regime is set publicly. Where the law links consent to proportionate processing with a contract, a bank cannot regulate this by contract terms: the court saw privatisation of the sphere of positive legal regulation, which is inadmissible

Consent mechanism per the court

• 1
• the data subject initiates consent, not the operator: what was not given cannot be obtained

• 2
• the test is that consent was given, not passive non-objection to what was imposed

• 3
• freedom to refuse is not a way of giving consent

• 4
• freedom to withdraw consent is not freedom to give it

• 5
• withdrawal shows the subject's attitude to processing but is not a positive form of consent

Result: imposed consent terms held void, claims against MTS Bank and Promsvyazbank partly upheld, MTS Bank ordered to pay ₽10,000 moral harm. No higher-court rulings found

• 1
• Employer is not consent's hostage

employee PD is transferred or entrusted on contract, law, legitimate interest: Aeroflot, VTB, SK Enmuv Rus

• 2
• Consent is will, not a form

not demanded by template or imposed by contract: Nestle, Ufa banks

• 3
• Commercial use: in writing

promotional use of an employee's photo only with written consent: Nornickel

• 4
• E-mail depends on context

not PD alone (Arsenal), but PD in 2GIS and when registering with Ookla

• 5
• The operator proves localisation

a foreign service open to Russians keeps databases in Russia: Ookla, ₽1m and ₽6m fines upheld in cassation

Motto: in privacy compliance you never have problems, you have adventures