Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Russia: Law on processing anonymized data signed by President

On August 9, 2024, the National Center for Artificial Intelligence Development under the Government of the Russian Federation announced that bill No. 992331-7 on the transfer of anonymized personal data to the Ministry of Digital Development was signed by the President, becoming Federal Law on August 8, 2024 No. 233-FZ on amendments to the Federal Law On Personal Data (Law No. 233-FZ).

What are the main aspects of Law No. 233-FZ?

Law No. 233-FZ allows for the transfer of personal data to the Ministry of Digital Development in anonymized form for subsequent processing without the consent of the subject, provided that further processing would not allow the identification of a data subject based on the processed data.

The anonymized datasets cannot contain special categories of personal data, except when the personal data has been made public by the data subject.

Access to datasets will be provided to users in accordance with the procedure established by the Russian government. The users will be government agencies and organizations subordinate to them, as well as Russian citizens and legal entities that meet the requirements.

Law No. 233-FZ also introduces amendments to Federal Law No. 123-FZ of April 24, 2020, on conducting an experiment to establish special regulations for developing and implementing artificial intelligence in Moscow (Law No. 123-FZ). The amendments allow Moscow operators to transmit anonymized data to the regional information system, including images of a person's face and recordings of a person's voice without the consent of the subject of personal data.

The law does not permit the processing of regional datasets if their use may result in harm to the life and health of people, an insult to morality, violation of the rights and legitimate interests of citizens and organizations, harm to the environment, national defense and state security, cultural heritage sites, or other values ​​protected by law.

Entry into force

Law No. 233-FZ came into force on August 8, 2024, however, most of its provisions will only come into force on September 1, 2025.

You can read the law here and the press release here, both only available in Russian.