Russia: Revised criteria “could lead to increase” in adequacy determinations // Dataguidance.com

Ilya Goryachev and Sergey Medvedev, Senior Lawyers at Gorodissky & Partners, commented, “The Roskomnadzor [will now] take account of three criteria, namely that the prospective country has a special supervision authority competent to oversee personal data protection, has sufficient legislation on personal data and an enforcement system [for violations of data protection legislation], and complies with the resolutions adopted by the Council of Europe as well as resolutions of the 38th International Conference of Data Protection and Privacy Commissioners (‘ICDPPC’). These criteria, although as such not mentioned in the law, do not differ significantly from the requirements [enshrined in the Article 29 Working Party’s working document on international data transfers, adopted on 24 July 1998].”

“At the ICDPPC’s 38th Conference, there were a number of resolutions adopted,” Goryachev and Medvedev noted. “It may be concluded that by requiring the observation of the ICDPPC’s decisions, the Roskomnadzor wants the prospective adequate countries to follow the ICDPPC’s current activities.”