Dissemination of PD

Restricted access

Restricted-access information

Arts. 5(2), 9 of Law 149-FZ

legally protected secrets, Art. 9(3)-(8), Law 149-FZ

other restricted information, Arts. 15.2, 15.3, 15.5, 15.6, Law 149-FZ

biometric PD, Art. 11 of 152-FZ and 572-FZ

PD in the public information zone, Arts. 5(2), 7 of Law 149-FZ

• PD regime
• Law 152-FZ rule

• published in journalism, the media, scientific, literary and other creative activity
• Art. 6(1)(8)

• published or disclosed under a federal law
• Art. 6(1)(11)

• included in public sources with the subject's consent
• Art. 8

• allowed by the subject for dissemination
• Art. 10.1(1)

• disclosed to an indefinite circle by the subject
• Art. 10.1(2)

• disclosed as a result of an offence, crime or force majeure
• Art. 10.1(3)

Conclusion: PD as a whole (Art. 9(9) of Law 149-FZ and Law 152-FZ) cross both zones, and each public regime has its own norm in Law 152-FZ. Alongside operate the regimes of commonly known facts (Art. 7), information to which access cannot be restricted (Art. 8) and open data (Art. 7(4) of Law 149-FZ)

Law 519-FZ of 30.12.2020

Public availability is no longer a basis

New powers of the data subject

define in the consent the specific PD to be disseminated for each data category

prohibit the operator from passing disseminated PD to an unlimited circle, except granting access

prohibit processing of disseminated PD by an unlimited circle, except obtaining access, or set its conditions

require any person to stop transferring (disseminating, providing, giving access to) their PD on first demand

Paradox: by the letter of Art. 10.1(2) a basis is needed even for plain access to disseminated PD

Law 152-FZ, Art. 3

Statutory definitions

item 1.1 PD allowed for dissemination: the subject gave an unlimited circle of persons access to them by consent under Law 152-FZ

item 5 dissemination: actions aimed at disclosing PD to an indefinite circle of persons

Guides

Indefinite circle of persons

Supreme Court, Q1 2004 review: a circle that cannot be individualised, joined to the case, named in the decision, or have each member's rights decided

Tax Service letter of 25.04.2007 No. SHT-6-03/348@: persons who cannot be identified in advance as ad recipients and parties to a legal relationship

PA conclusion

Dissemination exists under either condition

no actions to actually restrict access to PD

the circle with access to PD cannot be reliably established at the time or period

Roskomnadzor

Provision, not dissemination

a nameplate with name and post on an office door, as visitors are a definite circle (Yu. Kontemirov, open day 28.01.2022)

an intranet directory with employees' work contacts (RKN letter of 2026)

• 1
• New concepts

the expression of will is called "permission", an "unlimited" circle of persons appeared beside the earlier "indefinite" one, and PD made public by the subject were replaced by PD allowed for dissemination

• 2
• Closed access

per RKN, if the operator can reasonably determine or restrict the circle with access to PD, for example through prior registration on a site, this is not dissemination

• 3
• Form of consent

the written-form requirements of Art. 9(4) do not apply to consent to dissemination, RKN sets its content. Consent is given to the operator directly or through RKN's information system

• 4
• Conflicting norms

Art. 10.1 and Art. 9(4) collide when PD are included in public sources (Art. 8) and in an employee's consent to dissemination. The Digital Ministry and RKN consider that Art. 10.1 does not apply to public sources

• 5
• Directness

consent from a representative can rest on the general rule of Art. 9(1), but collecting consents via others, e.g. a processor, is doubtful

• 6
• Transition

Law 519-FZ took effect on 01.03.2021, except provisions on RKN's information system. Consent is obtained from subjects who started interacting with the operator from that date

RKN: the law is not retroactive, so consent under Order No. 18 is needed for dissemination begun from 01.03.2021

Part 5: doubt is resolved against the operator

checkbox confirming the subject has no bans or conditions

a field to describe bans and conditions, optionally with standard wordings

Tracking subjects' conditions in processes is a big organisational and resource challenge, and the subject gains room to abuse a right

Part 10: publish conditions within 3 working days

• operator and its contacts
• expected audience

• purpose, no other purposes
• permitted actions

• permitted methods
• access period

• ?
• What if more than 3 working days pass between consent and publication?

The law gives no answer. How to convey different subjects' conditions to readers of a list published as one block is also unresolved

• ?
• Under Part 12, does stopping transfer "at any time" mean immediately?

Consent ends from receipt of the demand (Part 13). It is safe to stop transfer at once and treat the 3 working days of Part 14 as the outer limit

• ?
• Under Part 14, how does "any person" identify the subject?

The law sets no way for a person who did not initiate dissemination to verify the applicant's authority

Difficulties in choosing and securing a basis

01

Consent

of the subject to process their PD

02

Law

functions, powers and duties imposed on the operator by legislation

03

Contract

to which the subject is a party, beneficiary or surety

04

Legitimate interest

rights and legitimate interests of the operator or third parties, see RPPA guidance

Localisation, Art. 18(5)

Databases in Russia

When collecting PD, including online, recording, systematisation, accumulation, storage, updating and retrieval of PD of RF citizens use databases in Russia

Special feature: new PD obtained by analysing data previously collected into Russian databases and transferred abroad may be obtained in foreign databases without prior localisation

vs

For

Consent exclusively

the definition in Art. 3(1.1) names the subject's consent as the qualifying feature, the Digital Ministry letter of 21.12.2021 calls it the only basis

Art. 10.1(15) knows one exception, the functions of authorities, local self-government and subordinate bodies, matching Art. 6(1)(4) and partly (11)

explanatory note to Law 519-FZ: consent is the exclusive basis for processing PD made public, except state, public and other public interests

per M. Wagner at RKN's open day on 28.01.2022, dissemination is possible only through consent, and neither a contract nor a user agreement replaces it

Against

Other bases possible

Art. 10.1(2)-(3) require proving lawfulness of later dissemination, which indirectly points to Art. 6(1)(2)-(9.1) and (11)

consent does not suit where dissemination is inseparable from the subject of a paid contract or disclosure is mandatory by law not for authorities

per 2023 case law, dissemination consent is a special case of consent to processing (Art. 6(1)(1))

in May 2024 RKN letter No. 08-166301 allowed dissemination on other bases of Art. 6(1), oral positions remain stricter

The only legal basis that shows that the personal data subject has allowed dissemination of personal data is consent to processing of personal data allowed by the personal data subject for dissemination

Digital Ministry letter of 21.12.2021, reply to letter of 26.11.2021 No. 442-iskh/6091

Also in the letter

the same consent is the sole basis for any third party processing the PD if the subject allowed the operator to disseminate them

PA question

how does this fit with Art. 10.1(2) and (3), where proof of lawfulness of later dissemination or other processing is not limited to consent?

What next: in 2023-2024 courts, the Digital Ministry and RKN moved away from this position, see the following slides

• 1
• Separate consent

dissemination consent is drawn up separately from other consents (Art. 10.1(1)), its content is set by RKN Order of 24.02.2021 No. 18

• 2
• Exemption for authorities

Art. 10.1 does not apply to executive authorities' and local self-government functions (Part 15). Other operators disseminate PD only with separate consent

• 3
• Public sources

PD are included in directories, address books and other sources with the subject's written consent (Art. 8(1)), form requirements in Art. 9(4)

• 4
• Form of consent

when drafting the dissemination consent form it is sensible to follow Order No. 18

PA conclusion

Two consents for two regimes

the need for separate dissemination consent is indirectly stated even where other bases under Art. 6(1) exist

consent to including PD in a public source for informational purposes meets Art. 9(4), not Order No. 18

Information resource

no direct effect on classifying processing after Art. 6(1)(10) was repealed

One purpose

created only for informational support

Written consent

filled with the subject's written consent, separate from other consents

Supplied by the subject

consists of PD the subject supplied, in theory no other PD

Subject's will

the subject may demand immediate cessation of processing of their PD

Any circle

open to a group, e.g. staff, or to everyone, and then competes with Art. 10.1

Digital Ministry: an organisation's internal directories for informational support may be public PD sources subject to Art. 8 requirements

1

Art. 6 bases

processing is allowed with consent or on other bases in Art. 6(1)(2)-(11) of Law 152-FZ

2

Journalism

Art. 6(1)(8), for the work of a journalist, lawful media activity, scientific, literary and other creative activity without violating the subject's rights

3

Art. 10.1 from 01.03.2021

Law 519-FZ introduced special rules for PD allowed by the subject for dissemination

4

Public interests

under Art. 10.1(11) the subject's bans and conditions do not apply to processing in state, public and other public interests

Conclusion: if the media process PD under Art. 10.1(11), dissemination consent need not be obtained. The line runs by the substance of the activity, and media registration alone creates no exemption

Digital Ministry

Letter of 14.05.2024 No. P25-12029-OG

cases of processing without consent are listed in Art. 6(1)(2)-(11)

Art. 6(1)(8) allows processing for journalism, media, science, literature and creative work without violating rights

without consent the operator processes PD only on bases set by PD legislation

dissemination consent is drawn up separately from other consents

Roskomnadzor

Letter of 15.05.2024 No. 08-166301

processing without consent under Art. 6(1)(2), (11) concerns PD under Art. 3(1)

Art. 10.1 requirements apply only to PD allowed by the subject for dissemination

dissemination of PD may also rest on other grounds in Art. 6(1), besides items 2 and 11

But: RKN's oral positions are stricter. For processing under a contract, Order No. 18 consent is still drawn up (M. Wagner, 28.01.2022), and an operator without an act providing for publication draws up dissemination consent (22.08.2025 and 14.08.2026)

Exceptions to the consent rule (Art. 6(1)(7), (8) and (11) of Law 152-FZ) are read in light of Art. 152.2(1) of the Civil Code: collecting and disseminating information on private life without consent is allowed in state, public or other public interests and where the information has previously become public or been disclosed by the citizen. Same approach in Arts. 49, 57 of the Media Law

Art. 6(1)(8), Law 152-FZ: constitutional

it allows an online outlet to post a medical worker's PD previously posted by law on the official site of the medical organisation, regardless of their consent

Review filter

editors do not allow comments by third parties unrelated to professional activity, nor clearly unlawful statements

Check on complaint

editors verify the information within reasonable time, suspending access to the review or marking it disputed

Court ban

in case of systematic abuse a court may ban dissemination of the worker's PD and reviews about them

Moscow District Commercial Court, 30.03.2023

Disclosure required by law needs no consent

Key findings

dissemination of PD of managers and participants rests on Art. 6(1)(2) and (11) of Law 152-FZ, to reach policyholders, insured persons, beneficiaries and future clients

Art. 10.1 sets the procedure for processing PD allowed for dissemination, a special case of processing with consent, as its title and content show

neither Art. 10.1 nor other provisions of Law 152-FZ oblige the operator to get consent for processing under legal duties and disclosure rules

Consequence: extra consent for mandatory disclosure adds no lawfulness and gives the impression that the subject's refusal will stop disclosure

Nine mandatory elements

• 01
• subject's full name, no identifier instead

• 02
• Contact details

• 03
• Operator details

• 04
• Purposes of processing

• 05
• Categories and list of PD

• 06
• Subject's conditions and bans by category

• 07
• Transfer conditions: internal network only, or none

• 08
• Operator's information resources (addresses)

• 09
• Validity period, preferably specific

HOW GIVEN

RKN Order of 24.02.2021 No. 18

• 1
• subject's surname, name, patronymic

• 2
• subject's contact details

• 3
• operator details: organisation, individual or sole trader

• 4
• operator resource addresses: protocol, server, domain, directory, page file name

• 5
• processing purpose(s)

• 6
• categories and list of PD for which consent is given

• 7
• PD the subject sets conditions and bans for, and the conditions and bans

• 8
• conditions on which the operator may transfer PD

• 9
• consent validity period

• ?
• Add passport number?

No, RKN's position

• ?
• Add date and signature?

Yes, RKN's position

Letter of 17.09.2021 No. 08-61656

Others' resources

the Order's design assumes PD is posted on the operator's resources

for others' resources, their owner also obtains consent

a third party disseminates PD for the operator on resources listed in the consent, observing Arts. 6(3), 10.1

Ways of disseminating PD

websites, portals and mobile apps

open messenger and social network channels

public stands, including electronic ones, kiosks and terminals

streams and videoconference platforms

publications and media, no consent needed in the public interest (Art. 10.1(11))

radio and TV programmes: broadcast, cable, recordings, public performance

mailings to any potentially interested person

public directories and address books

communication to any interested person

notices naming persons in charge of fire safety, emergencies, first aid

wearing a work pass openly in a publicly accessible area

registers of issued and revoked e-signature key certificates

RKN, 28.01.2022

No website, we put a dash

If PD is disseminated other than via a website, put a dash in the information resource field and fill in the other fields

A concept as a joke

Wall of shame of QR codes

Put QR codes on the stand instead of name and photo. Per an RKN official's comment, a QR code cannot identify a person, so the data is not personal

Cannot

develop and approve by internal act your own consent form, the law does not provide for this

include dissemination consent in a single processing consent or in the contract text

Not required

dissemination consent for PD from public sources under Art. 8 of Law 152-FZ

Required

draw up separately from consents to instruction, biometrics and special categories, CBT and transfer of PD in employment

indicate special categories and biometrics only if there is written consent to their processing or another basis under Arts. 10 and 11

publish the conditions and bans on the operator's resources or another open way, e.g. on a stand

treat consent as fully terminated from receipt of the subject's demand

earlier consent before 01.03.2021 with a right to disseminate ends as to dissemination on the subject's demand

Update: at the open day on 14.08.2026 RKN orally allowed the operator's own form within Order No. 18, including with pre-written restrictions

The right to set in the consent [...] the list of conditions and bans lies within the competence of the personal data subject and does not provide for the operator's participation in exercising it

Digital Ministry letter of 21.12.2021 on Order No. 18, items 7-8

Problems

• 1
• arbitrary bans by the subject can break almost any pre-planned processing

• 2
• the standard form at pd.rkn.gov.ru/soglasiya/maket offers only closed lists of conditions and bans

• 3
• a ban on operator participation can also be read as a ban on advising the subject on filling in fields

Update: in 2026 RKN orally allowed restrictions pre-written by the operator. It is safe to offer them as tick options and keep a field for the subject's own bans (Art. 10.1(9))

Roskomnadzor position

Conditions are published at the same place as the PD

"Publication of information on the processing conditions and on the existence of bans and conditions on processing by an unlimited circle of persons of personal data allowed by the personal data subject for dissemination is assumed to be at the place or on the Internet resource where this personal data will be posted by the operator"

Trigger

employer disseminated employee PD on a third-party site, purposes and procedure undisclosed in the request

Framework

Art. 10.1 applies from 01.03.2021, and the operator itself chooses the measures to meet its duties under Art. 18.1

Term

information on conditions and bans is published within 3 working days of receiving consent, Art. 10.1(10)

Consequence

conditions and bans are published at each place PD is posted, not at one point of the resource

vs

Power of attorney

An agent under power of attorney may not

Letter of 02.12.2021 No. 08-81768

Under Art. 3(1.1) of Law 152-FZ the subject themselves gives an unlimited circle access to PD by consenting. So consent by an agent under power of attorney is not provided for

in practice such consent is not accepted and the subject is asked to express their will personally, including via RKN's information system

Students

A student consents themselves

Letter of 29.12.2021 No. 08-89152

Dissemination consent is given by the subject, so a student may give it within their capacity under civil law

without students' consent the educational organisation must confirm other bases from Art. 6(1)

Important: for a child under 14 consent, including to dissemination, is given by the legal representative, and a teenager aged 14-18 gives it themselves (RKN letter of 30.03.2023 No. 08-26424)

• ?
• A citizen's photo or video is published on a site with name, position and workplace. Is Art. 152.1 Civil Code consent needed besides Art. 10.1?

One consent under Art. 10.1 is sufficient as a legal basis for disseminating PD

• ?
• Can Art. 152.1 Civil Code consent text be put into an Art. 10.1 consent?

No need to combine Art. 10.1 and Art. 152.1 Civil Code texts in one consent

• ?
• When is dissemination consent needed at all?

Only if the organisation plans to disseminate PD. If not, there is no need to obtain it

• ?
• And for authorities?

Art. 10.1 does not apply to functions of state and municipal bodies and their subordinate organisations (Part 15)

Also: the Digital Ministry answered the same in 2024, noting that with Order No. 18 consent no additional consent for the same purpose under Civil Code norms is needed. The image is protected by Art. 152.1 of the Civil Code independently, so exemptions are checked under both regimes

Question: is it lawful to disseminate an employee's PD on consent under Art. 10.1(6) and Order No. 18 if the employee gave it not in writing under Art. 88 of the Labour Code but directly to the employer via an information system?

1

Art. 10.1(1)

consent is drawn up separately from other consents, the operator lets the subject define the list of PD for each category

2

Art. 9(9)

requirements for the content of dissemination consent are set by the authorised body

3

Order No. 18

requirements approved by RKN Order of 24.02.2021 No. 18

4

Answer

consent must comply with Order No. 18 and be given in the manner of Art. 10.1

Cost of error: RKN (22.10.2025) classifies absence of dissemination consent under Art. 13.11(1) of the CAO, and defects in its form under Art. 13.11(2)

23.03.2026

task

Task for the measure

the regional office head approved task No. 28-nd for non-interactive control of the operator

23-25.03.2026

website analysis

Compliance monitoring

paras 58-60 of the PD Control Regulation (Government Resolution of 29.06.2021 No. 1046)

Found

website page

Trainer photos

no data subject consents and no conditions or prohibitions on processing by the public at large are indicated

30.03.2026

requirement

Grounds not confirmed

no proof of a legal basis for disseminating trainers' PD on the site

Conclusion: the regulator finds Art. 10.1 violations remotely: PD posted without consent or a block of conditions and bans show on the site itself

Regime for each type of PD

• not disseminated
• disseminated mandatorily

at data subject's choice

Notes on the "mandatory" regime

Mandatory dissemination by law

state the details and title of the regulatory act that provides for mandatory dissemination (publication) of PD

Contract

if the legal basis for dissemination is a contract to which the data subject is a party, the consent states the contract details: date and number

Note: in its notes to the service the regulator itself names a contract as a legal basis for dissemination

₽60k

Google, 2022

a blogger's number was posted on YouTube without consent; he went to RKN, which drew up a report

₽50-90k

Part 5 sanction

fine for a legal entity; for repeat offences under part 5.1, ₽300-500k

₽50k

Google, 2026

new fine under Art. 13.11(5), ruling of 18.03.2026 No. 05-0216/422/2026 upheld on 21.05.2026

What is punished

failure to comply with a demand of the data subject or RKN to rectify, block or destroy PD

2025: YouTube and Telegram

₽80k fines each under Art. 13.11(5) for ignoring PD removal demands, cases 05-0204/422/2025 and 05-0027/422/2025

Conclusion: a foreign platform that does not remove PD published without consent on demand is liable under Art. 13.11(5) of the CAO

01

Publication

a citizen's PD were disseminated on a page of the YouTube video platform

02

Unlawful activity

the court held the page's activity unlawful and infringing the rights to privacy and to personal and family secrecy

03

Breach of Law 152-FZ

the information on the page was found to be processed in breach of PD law, including Art. 10.1

04

Register

page added to the Register of Violators of Data Subject Rights

Practice: RKN continues this path: in 2026 the Tagansky District Court granted its claims on unlawful dissemination of PD under Art. 10.1(1), including a deepfake (cases 02-0901/2026 and 2-1452/2026, first instance)

₽30k

Magistrate, 05.05.2023

Employer failed to ensure confidentiality

Employees' full names, internal phone numbers and e-mail addresses from the Centre's employee database reached the public on the Internet. The employees gave no written consent

What the court found

FSUE "GRChTs" as employer breached Arts 6(1), 7, 9(4), 10.1(1) of Law 152-FZ and Labour Code Art. 88

PD were unlawfully transferred (provision, dissemination, access) to the general public on the Internet

the act is an offence under Art. 13.11(2) of the CAO; fine of ₽30k

Costlier today: since 30.05.2025 the fine under Art. 13.11(2) for a legal entity is ₽300-700k, and a leak of 1k+ subjects or 10k+ identifiers brings ₽3m+ under part 12

• 1
• Can you avoid classification as dissemination?

define a specific, limited group of persons with access to the PD

• 2
• Can the PD be put in a public source?

under Art. 8 of Law 152-FZ, with written consent meeting Art. 9(4)

• 3
• Can another basis be relied on?

justify dissemination not by consent but by Art. 6(1)(2)-(9.1) and (11) of Law 152-FZ

Question 1

A specific group is two conditions at once

Establishing access: it is possible to reliably identify the persons who have or had access rights to PD at a given moment or period

Access control: access to PD is in fact restricted for persons without such a right

Result: if all three answers are negative, consent to dissemination under Art. 10.1 must be obtained

Ways to give consent, Art. 10.1(6)

directly to the operator via its information system or in writing

via the RKN information system under order of 21.06.2021 No. 106

Sample sections

• operator and purpose
• PD: yes or no
• operator's resources

• transfer ban
• processing bans and conditions

• network transmission
• term
• voluntariness

• subject's rights
• request procedure
• confirmations

Disclaimer, Art. 10.1(10)

Placed next to the published PD

"The personal data on this page are disseminated with the data subject's permission for the purpose of [...]. The data subject has set the following conditions and prohibitions on the processing of such data by any person: [...]"

RPPA sample

rppa.ru/_media/analitika/srpd.docx

Form with YES/NO marks per type of PD, options for prohibitions and conditions, and footnotes on the meaning of dissemination and on a photo not used as biometrics