RussiaFederal Law No. 152-FZ, Articles 14 and 17, Data Subject Rights
Federal Law No. 152-FZ, Art. 14 and 17
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Honor a Russian data subject's request for confirmation of processing, correction, deletion, or consent withdrawal, under Federal Law No. 152-FZ.
- Expect a Russian data subject to be able to sue you directly in court for losses and for compensation of moral harm arising from unlawful processing, under Federal Law No. 152-FZ Article 17, in addition to complaining to Roskomnadzor.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Code of Administrative Offenses (KoAP RF) Article 13.11, part 5, fines a legal-entity operator RUB 50,000 to 90,000 for failing, within the statutory timeframe, to fulfill a data subject's request to correct, block, or destroy their data; individual entrepreneurs face RUB 20,000 to 40,000, officials RUB 8,000 to 20,000, and citizens RUB 2,000 to 4,000 for the same failure. A related but slightly lower band under part 4 (legal entities RUB 40,000 to 80,000) covers failing to provide a data subject with information about the processing of their data, the Article 14 confirmation-of-processing right. A repeat offense under part 5 is punished under part 5.1 (citizens RUB 20,000 to 30,000, officials RUB 30,000 to 50,000, individual entrepreneurs RUB 50,000 to 100,000, legal entities RUB 300,000 to 500,000), and the cap above is that highest tier for a legal entity; a first offense under part 5 carries RUB 50,000 to 90,000. Roskomnadzor investigates and refers these cases; the fine itself is imposed by a court (an arbitrazh court for a legal-entity respondent) following an administrative-offense protocol, not by Roskomnadzor directly.
- Rule
- Fixed only
- As of
- Minimum
- 50,000
- Currency
- RUB
- Fixed cap
- 500,000
Who enforces it
Enforcement body
Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media), which investigates and refers KoAP RF Article 13.11 administrative-offense cases for a court to fine; a data subject may also sue directly in civil court under Federal Law No. 152-FZ Article 17(2).
Settledness
- As of
- Open questions
- How does an operator decide that personal data "не являются необходимыми для заявленной цели обработки" ("are not necessary for the stated purpose of processing"), so that a data subject may demand their blocking or destruction under Article 14(1)?
What it makes you log
Logging duty
Article 14(6) lets an operator refuse a repeat access request that does not meet the interval conditions of parts 4 and 5, requires the refusal to give reasons, and puts the burden of proving the grounds for the refusal on the operator (Обязанность представления доказательств обоснованности отказа в выполнении повторного запроса лежит на операторе). The operator can meet that burden only from its own record of the request and the refusal. The Articles name no log, no retention period and no inspector; Article 17 gives the data subject a complaint to the authority or the courts without any record or audit duty.
- Kind
- Implicit
- As of
- Provision
- Article 14(6)
- Trigger
- personal_data_processing
What this law does
Federal Law No. 152-FZ gives a data subject in Russia the right to confirmation of processing and the categories, legal basis, and retention period involved; correction of inaccurate data; deletion where data was collected unlawfully, its purpose is fulfilled, or consent is withdrawn; and withdrawal of consent at any time. Article 17 gives the subject the right to complain to Roskomnadzor or to sue in court for damages and compensation of moral harm. Rights run against the operator.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .