Part II, section 05
Where the boundary of PD lies and how to determine it
05.1
Everyone's path when first reading the PD definition seriously
1
Denial
PD is just passport data!
2
Anger
Who the @#&$ wrote the PD definition?!
3
Bargaining
PD surely identifies a specific person
4
Depression
Anything can be PD...
5
Acceptance
Well, OK, let's figure it out
Three legal definitions behind the classification of information
PERSONAL DATA
Any information relating to a directly or indirectly identified or identifiable individual (data subject)
Art. 3(1), Law 152-FZ On Personal Data
IDENTIFIER
CAO
A unique designation of data about an individual, contained in the operator's PD information system and relating to that individual
Note 4 to Art. 13.11 of the CAO
Link to the operator's PDIS
IDENTIFIER
Law 572-FZ
A unique designation of data about a person, needed to identify that person
Art. 2(6) of Law 572-FZ on identification and authentication using biometric PD
Link to the purpose of identification
vs
As with the blind men and the elephant: each feels a feature, no single criterion
Under the literal reading that enforcement uses by default, a wide range of information can count as PD, including beyond what is reasonably expected in the context
The definition does not say what link between information and the direct or indirect identification or identifiability of a person suffices. Hence there is no clear view of when data is personal and when it is not
Consequence: a status dispute is about the contested element of the definition, not the data item. The answer comes from classifying element by element in context, not from a dictionary of data items
What counts as PD?
Full name
in combination
TIN
PD on its own
Phone
disputed
flickers
Employee number
in combination
Cookies and IP address
in combination
Practice guidelines by data item, not a closed list
Probabilistic and presumptive mechanisms, shift to a relative approach
2016
Probabilistic mechanism
A dynamic IP address of a visitor to a German federal agency website is PD for the site operator if it has lawful means to obtain the missing data from the internet provider. Means that can reasonably likely be used to combine data are taken into account
2022
Presumptive mechanism
Publishing a spouse's or partner's name in an official's declaration of interests indirectly reveals sexual orientation and is therefore processing of a special category. Data that reveals sensitive information after deduction or comparison also counts
2025
Relative approach
Pseudonymised data remains PD for the sender who holds the key, and may not be PD for a recipient unable to remove the protection and link it to a person
For Russia this is a guide, not a rule: Law 152-FZ has no criterion of means reasonably likely to be used by the operator or anyone else; the GDPR approach is a doctrinal guide
05.2
A working group of the Roskomnadzor Advisory Council sorted data items into three levels
Level 1
Identify on their own
Passport series and number
SNILS
TIN
Biometric data
Bank account and card number
State-assigned identifiers take priority
Level 2
PD with a probable-match aspect
Name + date of birth + other data
place of birth, address, position, family, social and property status, education, contacts
Name or surname and initials + data singling out a person from a limited group
entrance-hall notice about debts of resident A.A. Ivanov
Level 3
Not PD individually
Full name
Home address
E-mail address
Phone number
Date of birth
Employee number and other IDs: PD only together with Level 1
Takeaway: the same data items ended up both in PD in combination and in non-PD individually. Status is set by combination and context, so the attribute catalogue is a guide, not a closed list
Two 2021 RKN positions: on the code and on what lies behind it
Not PD
The code
"...from the data provided (QR code) it is impossible to establish the identity of the data subject, therefore the data is not personal"
reading
PD
Data read
Data read from a vaccination certificate QR code is PD but not a special category. It is processed on general grounds, kept confidential and destroyed within 30 days of achieving the purpose
One logic: an object identifier does not become a person identifier until information links it to a specific individual
Roskomnadzor [2023]: immutability and uniqueness together tie data to a person
Test applied
Justice of the peace, Dist. 422, Tagansky, Moscow, 12.07.2022; Second Cassation Court upheld 26.12.2022
If registration needs only an e-mail address that cannot be reused, that address is a unique user identifier and the user's PD. Fine for breaching localisation: ₽1m under Art. 13.11(8) of the CAO, ₽6m for a repeat in 2023 under part 9
Test rejected
SK Arsenal: not PD without more data
Moscow Arbitrazh Court 20.10.2022, 9th Appeal Court 11.01.2023, Moscow District Court 30.03.2023; Supreme Court refused RKN a referral 21.07.2023
An address is not absolutely immutable: once a mailbox is deleted, a new user may get the same address, as with a reassigned phone number. Without additional identifiers a person cannot be identified from an address alone
Even the regulator is not united: in 2022-2023 replies regional offices classified the address differently. Status flickers depending on context, instance and body
Philosophical-logical basis of PD properties, and its limit
IDEM
immutability
IPSE
a person's identity in time and among others
Idem
Identity, structural order
The same one, not another: a person or object keeps its identity in time and space. D. Parfit calls this numerical identity
P1 at time t1 is P2 at time t2 if and only if criterion K(P1(t1), P2(t2)) is met
Ipse
Selfhood, qualitative order
Two objects are identical if every property and relation of one also holds for the other, and vice versa. Identity arises against otherness: a set of stable qualities sets a person apart
Limit of the analogy: uniqueness is set by the rules of a specific identification system, not by the attribute itself. A unique data item is not yet PD until its link to an identifiable person is established
Roskomnadzor [2024]: no exclusive right to define PD
"Under current legislation Roskomnadzor... is not vested with the exclusive right to give an opinion on the presence or absence in particular information of data that make it possible to identify a personal data subject by indirect features, that is, to identify a specific individual"
Ruling of the justice of the peace of Dist. No. 44, Orekhovo-Borisovo Yuzhnoye, Moscow, of 13.02.2024 in case No. 05-0010/44/2024, upheld by decision of the Nagatinsky District Court of Moscow of 03.04.2024 No. 12-1747/2024
Facts
The regulator held that a surname with initials and details of appeals to authorities identify the applicant. The court disagreed and closed the case for no offence
Consequence
From unconditional PD to PD only combined with other data
In five months the Supreme Court upheld opposite assessments of the same data
SUPREME COURT
07.2023
NOT PD
Case: Roskomnadzor vs SK Arsenal
An e-mail address or phone number without other data about a person is not PD in itself
SUPREME COURT
12.2023
PD
Case: FAS vs 2gis.ru
An e-mail address is PD in itself
Takeaway: we heed practice but do not absolutise it. Classification depends on the processing context and the operator's combined data
Like the observer effect in Young's experiment, though any analogy is false a priori
Double-slit test
Data processing
operator effect
data
Information stays mere data until someone identifies a person from it
PD
An operator interested in identifying a person turns the same data into PD
Takeaway: information becomes PD not absolutely but relative to an observer interested in identifying a person
05.3
15 groups, 186 entries: what turns out to be PD in practice, systematised
Catalogue sections and entry counts
14
11
9
26
6
9
10
10
12
13
2
5
15
33
11
PERSONAL DATA IS
As of 31.08.2026
Eight ways a person's data ends up with the operator
Obtained from outside
Provided
received from subjects or representatives
E.g. filling in web forms on a site, submitting a CV
Disseminated
taken from public or open sources
E.g. researching social network accounts
Observed
captured by tracking subjects' behaviour
E.g. online tracking, geolocation, video surveillance
Acquired
obtained from others, not from subjects
E.g. a reference from an applicant's former employer
Created in the operator's activity
Initiated
arise from actions taken regarding subjects
E.g. salary payment, theft of a personal car
Assigned
given to subjects temporarily or permanently
E.g. social insurance number, job title
Derived
synthesised by simple analysis of other data
E.g. client profitability from visits and purchases
Inferred
predicted by advanced analysis of datasets
E.g. credit rating, health forecast
Different processes, different algorithms: 1-to-n search, 1-to-1 check
Authorisation is a third process: granting rights to specific actions and checking them when someone tries to act
Definitions in 572-FZ, 115-FZ and GOSTs: from checking data to matching identifiers
Identification
Law 572-FZ, Art. 2(7)
a set of measures to establish data about a person and verify it, carried out under federal laws and the regulations adopted under them, and to compare that data with an identifier
115-FZ, Art. 3
a set of measures to establish the data required by law on clients, their representatives, beneficiaries and beneficial owners and to confirm its accuracy using original documents and/or duly certified copies and/or state and other information systems
GOST R 58833-2020, item 3.24
actions to assign identifiers to access subjects and objects and/or to compare a presented identifier with the list of assigned identifiers
Authentication
Law 572-FZ, Art. 2(2)
a set of measures to check that identifiers belong to a person by comparing them with the data on the person held by the authenticating party, and to establish the lawfulness of the person's possession of the identifiers using authenticating features within the authentication procedure, as a result of which the person is deemed established
GOST R 58833-2020, item 3.4
actions to verify the authenticity of an access subject and/or object, and to verify that the presented access identifier and authentication information belong to the access subject and/or object
Biometrics under GOST ISO/IEC 2382-37-2016. Identification (item 37.08.02) - searching a database of biometric enrolments and returning the identifiers of the reference template linked to one individual. Verification (item 37.08.03) - confirming a biometric claim by comparison
05.4
Privacy pro's view: each element of the definition and its limit
Any information
Form
information, messages, data in any form: text, graphics, sound
Medium
any medium, paper or machine, regardless of form of presentation
A PD medium is not itself PD
relating to
Content
data that by nature must relate to the subject
Purpose
to learn about the subject or influence them
Result
processing affects the subject's interests whatever the content or purpose
There can be no "overly broad" approach to PD; operators' problems are solved within Law 152-FZ
to a directly or indirectly identified/identifiable
Identified
data singles the person out of their group
Identifiable
data gives a reasonable chance of such separation
Reasonable possibility is judged by the time, effort and means that are likely and able to be used
individual
Data subject
personal data subject rights belong to an individual
Data linked to a legal entity can also be PD, e.g. about its employees
Three pillars that settle most disputes over classifying data
I
Any data about a person is PD until expressly proven otherwise
Presumption: in doubt, data is processed under the PD regime
II
We note enforcement practice but do not absolutise it
Court decisions and agency guidance are patchy and contradictory
III
We apply by analogy the biometric PD definition (Art. 11, Law 152-FZ)
We test data against three features from the biometric PD definition
Art. 11 of Law 152-FZ: biometric PD is data that characterises a person's physiological and biological features, from which identity can be established and which the operator uses to establish identity
Three steps from raw data to a finding of purposeful processing
DATA
1
We identify the full set of data in the real, planned or possible scenario, including identifiers: direct and indirect, permanent and temporary, cross-system and local, unique and repeating.
2
We diagnose whether the operator or another interested party can lawfully identify a person, given the identifying potential of the data: its composition, structure, links and sources.
3
We confirm that identifying a person (or at least the possibility) is a necessary condition for achieving the processing purpose. That is the mark of purposeful PD processing.
PERSONAL DATA
EXPERT APPROACH
No purposeful processing
telecom operator carrying data over comms channels (traffic transit)
data centre storage (colocation, IaaS) without access to content
building a search index on the Internet
hosting an AI model without access to the data it works with
protection by security tools through which traffic passes
The regulator's position is stricter. RKN treats data centres without data access and transit platforms as parties to processing (operator or processor). The draft data centre market roadmap (August 2026) proposes exempting pure infrastructure from leak liability; not adopted.
How to assess how close a data set brings you to a specific person
Attributivity
data's capacity to serve as a trait (characteristic, attribute) of a person
Attributivity index
an estimate of the probability that a set of data will make it possible to recognise (identify) a specific person and/or reduce uncertainty about them
Calculation formula
the sum of the properties of each data type in the processing scenario (how unique, immutable, etc.) multiplied by the context multiplier: is there a technical ability and a legal purpose to link the data to a real person
In other words: the properties of the data (their mass) are multiplied by the need to identify a person (context)
The index draws the bottom line in disputed cases
Green zone 33% and below
We process data but do not know people. Law 152-FZ hardly affects us
Yellow zone 34-66%
We do not know names but can single out a person or their device. The law starts to apply
Red zone 67% and above
We know exactly whose PD we process. All legal requirements apply
Calculated minimisation, protection fit for context
Data Minimization
Incentive for digital awareness
The index acts as a calorie counter
Every extra database field, even a harmless one, raises the overall risk score. Marketing and HR see clearly that stockpiling data is not free but legally expensive. The approach motivates deleting excess data or lowering its attributivity to stay in the safe green zone.
Example: an age range instead of the exact age
Privacy by Design
Fairness to context
Unique data ≠ personal data
The index shields business from excessive requirements. Even super-unique identifiers (complex hashes, session GUIDs) used only for tech support rather than to identify a person give a low overall risk. The budget is not spent protecting technical logs as strictly as the HR database.
Example: a session GUID in support logs stays in the green zone
Formula and calculation example
Formula
sum of the attribute's scores on seven characteristics 1.1-1.7, 1 or 2 points each, total 7 to 14
sum of unit attributivities × context multiplier 2.1: identifying a person is necessary 4, permissible 2, excluded 1
probability 1% + 99% × ln(I / min) / ln(max / min), where min = 7 × n and max = 56 × n for n attributes
up to 33%
unlikely
34-66%
likely
from 67%
obvious
Calculation example
A user, a representative of a client company, visits a B2C services site and fills in the "Order a consultation" form
(10 + 12 + 8 + 9 + 8 + 8) × 4 = 220 probability 80%, red zone
2-point scores highlighted
