For the third time, the ministry changed the bill regulating the circulation of anonymized data in Russia. In the new version, businesses will be allowed to depersonalize personal data of Russians without their consent. Companies will have to transfer data to the state, but it will only be possible to use it to develop artificial intelligence (AI) services in three years. Experts call this option a compromise: in three years, the commercial value of the data will have already been exhausted, but it will still be in demand for the development of AI models. However, major market participants believe that the new version of the document will lead to “a decrease in privacy and security.”
Kommersant got acquainted with the new amendments to the bill regulating the circulation of impersonal data in Russia, which the Ministry of Digital Affairs sent to the government on May 19. This is the third version of the document. The first was submitted to the government on March 10, and on March 16, the Ministry of Digital Science sent it again (see Kommersant of March 18). From the new version of the amendments, it follows that businesses will be able to depersonalize the data of Russians without obtaining consent. An exception is introduced only for certain categories of citizens, in particular, employees of law enforcement agencies, judges, victims, witnesses and other participants in criminal proceedings.
In the original version, the bill submitted to the State Duma in early 2020 was supposed to simplify the procedure for collecting consent by innovative businesses from citizens to process their personal data. But as a result of the finalization of the draft for the second reading, it only added a condition that the companies ‘data could be depersonalized by the Russians only if the citizens’ separate consent was obtained for this.
The new version of the project retained the requirement for businesses to transfer anonymized data to the state “for state and municipal administration.”
At the same time, it is stipulated that their transfer to the developers of services based on artificial intelligence will be carried out no earlier than in three years. These developers will receive free of charge.
The Ministry of Digital Affairs confirmed to Kommersant that they had proposed introducing a norm that simplifies obtaining the consent of the subject of personal data for their depersonalization, “if this does not violate the rights and legitimate interests of individuals, legal entities, society, and the state.” The ministry says that the proposals are supported by the profile Deputy Prime Minister Dmitry Chernyshenko. Further, the bill will be considered by the State Duma.
The new version takes into account some of the proposals of the Big Data Association (combines Yandex, Mail.ru Group, Sberbank, Gazprombank, Tinkoff-Bank, Qiwi, MTS, MegaFon, Vimpelcom, Rostelecom, oneFactor). “This version largely meets the existing challenges of the level of technology development,” the association believes.
Depersonalization without separate consent, subject to legal compliance, makes it easier for businesses to work with data, said Director General of the Institute for Internet Research Karen Ghazaryan.
The fact that developers will have access to data only after three years, when they have already lost the main commercial value, is a compromise, he said.
“Such data can nevertheless be useful for building theoretical models of AI,” he admits.
300 billion rubles
will make up the big data market in Russia by 2024, according to the forecast of the Big Data Association
The requirement to obtain the consent of the subject to anonymize personal data could create additional transaction costs for business, says Ekaterina Kalugina, an expert at the Russian Privacy Professionals Association. Refusal of this measure, according to Vadim Perevalov, a member of the commission on legal support of the digital economy of the Moscow branch of the Association of Lawyers of Russia, brings Russia closer to European regulation. There, according to him, the use of anonymized data, as a rule, is carried out without obtaining the consent of citizens, but within the framework designed to protect them from invasion of privacy.
However, there is not enough information in the draft law about what is meant by anonymized data, how and in what form it will be transmitted and how their security will be ensured, argue in Yandex. They believe that the adoption of the document in its current form “can lead to a decrease in the privacy and security of user data.”