Telecom operators will not be able to freely disseminate subscriber information under experimental legal regimes (EPR). Corresponding amendments were made to the government bill. The companies participating in the experiment expected to use the data, for example, to recommend small and medium-sized businesses to open retail outlets. In its current form, the document will limit the development of innovative services, according to market participants, but will protect citizens, experts say.
Within the framework of the EPR, telecom operators will not be able to share data about subscribers, with the exception of information about how many of them are in a certain period of time in a certain territory, follows from the government’s amendments to the law “On EPR in the field of digital innovations” adopted by the State Duma. It came into force in January and establishes special legal regimes, the so-called regulatory sandboxes, in which innovations can be tested, bypassing the requirements of the law: secrecy of communication, correspondence, medical secrecy, etc.
These include, in particular, the projects of Yandex, MTS, the Big Data Association (ADB, which brings together MegaFon, Sberbank, Yandex, Mail.ru Group, Gazprombank, etc.). Initially, the amendments proposed removing the requirement for participants in the experiment that subscriber information is restricted information. But the State Duma Committee on Information Policy came out against it (see Kommersant on April 23).
Experts warned that the refusal to remove the requirement would negatively affect the implementation of at least the ADB’s Own Business project: it requires the use of geolocation of subscribers to find the best locations for small businesses. According to the president of ABD Anna Serebryanikova, the project will still be launched. “But after testing the anonymization techniques, we hope to be able to re-discuss the amendments,” she says. The issue of using the operators’ subscriber data will require clarification at the level of bylaws, which may lead to a delay in the start of the sandbox, fears the Director General of the Institute for Internet Research Karen Ghazaryan.
Will experimental legal regimes become the foundation of digitalization
But the final text of the law will not allow many promising services and technologies to be worked out within the framework of the EPR, warn in VimpelCom, “the proposed regulation does not actually bring anything new to the current principles”. MegaFon hopes that the processing of anonymized geodata within the EPR will be allowed at one of the stages of the sandbox deployment. MTS believes that “the satellite bill describes one of the models of possible information processing, and does not impose restrictions.” Tele2 does not see any risks for working with customers due to the new amendments: “We do not provide them with aggregated data sets, but conclusions based on algorithmic models.”
Technology companies process a much larger amount of information, and they are not prohibited from sharing data either in the framework of the EPR or in general cases, he stressed.
Anonymization of personal data is in a gray zone, so companies are trying to qualify them as aggregated and statistical, explained Oleg Blinov, a teacher at the Moscow Digital School. The exchange of impersonal data involves replacing the most important elements, such as name or passport number, with fictitious identifiers in order to preserve the anonymity of citizens. The problem is that even impersonal data poses a risk, the expert believes, having enough of them in the “sandbox”, it is possible to compose a portrait of a specific person, although the data alone would not give a complete picture.