Privacy in the Russian Federation: Overview

The Q&A guide gives a high-level overview of privacy rules and principles, including what national laws regulate the right to respect for private and family life and freedom of expression, to whom the rules apply and what privacy rights are granted and imposed. It also covers the jurisdictional scope of the privacy law rules and the remedies available to redress infringement. To compare answers across multiple jurisdictions, visit the Privacy Country Q&A tool. This article is part of the global guide to data protection. For a full list of contents, please visit www.practicallaw.com/dataprotection-guide.

Legislation

1. What national laws (if any) regulate the right to respect for private and family life and freedom of expression?

The provisions relating to private and family life and freedom of expression can be found in the:

• European Convention for the Protection of Human Rights and Fundamental Freedoms (1950) (European Convention on Human Rights).
• Russian Constitution 1993.
• Federal Law No. 51-FZ on the Civil Code of the Russian Federation, Part One (November 30, 1994) (Civil Code).
• Federal Law No. 149-FZ on Information, Informational Technologies, and the Protection of Information (July 13, 2015) (in Russian) (Information Law)).
• Federal Law No. 152-FZ on Personal Data (July 27, 2006) (in Russian) (Personal Data Law).

This Q&A focuses on the Russian Federation's national laws and excludes a detailed discussion on the European Convention on Human Rights. For more on the Personal Data Law, see Country Q&A, Data Protection in the Russian Federation: Overview.

Several sector-specific privacy laws contain provisions related to private and family life in areas such as health care and social benefits. These sector-specific laws are generally outside the scope of this Q&A.

2. Who can commence proceedings to protect privacy?

Russian citizens (individuals) can commence civil proceedings in the competent courts to protect and enforce their privacy rights.

The Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor) can also commence certain administrative proceedings based on complaints filed by injured individuals.

3. What privacy rights are granted and imposed?

The Russian Constitution 1993 (Russian Constitution) generally recognizes the following individual privacy and related rights:

• Personal freedom (Article 17, Russian Constitution).
• The inviolability of private life, and personal and family secrets, and to protect an individual's good name (Article 23(1), Russian Constitution).
• Privacy in communications, except if a court permits the disclosure (Article 23(2), Russian Constitution).
• The right not to have information about individuals' private life collected, retained, used, or disclosed without their consent (Article 24, Russian Constitution).
• The right to privacy in an individual's home, except if a court permits the disclosure (Article 25, Russian Constitution).
• Freedom of expression and association (Articles 29 and 30, Russian Constitution).

Russian Federation statutes also provide:

• Specific data protection rights (see generally Federal Law No. 152-FZ on Personal Data (July 27, 2006) (in Russian) (Personal Data Law); Country Q&A, Data Protection in the Russian Federation: Overview: Rights of Individuals).
• The right to be forgotten from search engines that disseminate advertisements targeted to consumers located in the Russian Federation (Article 10.3, Federal Law No. 149-FZ on Information, Informational Technologies, and the Protection of Information (July 13, 2015) (in Russian) (Information Law)).

4. What is the jurisdictional scope of the privacy law rules?

The Russian Constitution 1993 (Russian Constitution) does not expressly state its jurisdictional or territorial effect. Practitioners generally assume that it applies to the use of Russian citizens' personal data including images and communications.

The Federal Law No. 152-FZ on Personal Data (July 27, 2006) (in Russian) (Personal Data Law) does not contain any express provisions regarding its jurisdictional or territorial scope. It is generally presumed that, regardless of where the data operator or data processor is established or located, the Personal Data Law applies to:

• Data processing that occurs in or is targeted at the Russian Federation territory.
• The collection, storage, and use of Russian citizens' personal data.

For more on the Personal Data Law's jurisdictional reach, see Country Q&A, Data Protection in the Russian Federation: Overview: Scope of Legislation.

5. What remedies are available to redress the infringement of those privacy rights?

Any Russian citizen may seek redress in the national courts for violations of their constitutional rights and may seek:

• Injunctive relief.
• Compensatory damages, including moral damages.

Where an organization obtains information related to an individual's private life unlawfully from documents, video records, or other media, the individual may request, through the court, that the organization (Article 243, Federal Law No. 51-FZ on Civil Code of the Russian Federation, Part One (November 30, 1994)):

• Delete the relevant information.
• Destroy all tangible media copies to prevent further distribution of the information, with no compensation to the organization.

Government authorities, including the Federal Service for Supervision of Communications, Information Technology, and Mass Media (Roskomnadzor) may block e-commerce organizations and online platforms that collect, store, or use personal data illegally (Article 15, Federal Law No. 149-FZ on Information, Informational Technologies, and the Protection of Information (July 13, 2015) (in Russian) (Information Law)).

Roskomnadzor also has enforcement authority to address some privacy and data protection violations, including the ability to issue warnings or impose administrative fines in administrative proceedings. Amendments to relevant data protection laws and the Russian Code on Administrative Offenses (Code) took effect on February 24, 2021 that substantially increased the administrative sanctions for violations of data protection laws (Federal Law No. 19-FZ on Amendments to the Code of Administrative Offenses (February 24, 2021) (in Russian)).

For more on remedies for data protection violations, including administrative fines, see Country Q&A, Data Protection in the Russian Federation: Overview: Enforcement and Sanctions.

6. Are there any other ways in which privacy rights can be enforced?

Russian Federation general laws, such as the Russian Criminal Code No. 63-FZ (June 13, 1996) (in Russian) (Criminal Code), also regulate some aspects of individual privacy. For example, Article 137 of the Criminal Code imposes criminal liability for illegally collecting or spreading information about an individual's private life without his consent.

Individuals can submit privacy infringement cases, including criminal ones, to local prosecutor's offices or other law enforcement agencies, including the police. Individuals may also refer violations of the Federal Law No. 149-FZ on Information, Informational Technologies, and the Protection of Information (July 13, 2015) (Information Law) and the Federal Law No. 152-FZ on Personal Data (July 27, 2006) (Personal Data Law) to authorities for criminal prosecution.

Criminal privacy violations may subject the violator to (Articles 137 and 138, Criminal Code):

• Fines
• Forced labor.
• Imprisonment.

View PDF