RussiaFederal Law No. 152-FZ, Article 16, Decisions Based Solely on Automated Processing
Federal Law No. 152-FZ, Art. 16
In force since .
A data subject rights rule binding public and private bodies.
- Criminal exposure
- No
- Private right of action
- Yes
- Obligation class
- Data subject rights, Disclosure
As of .
What it requires
- Do not make a decision that produces legal consequences for a Russian data subject, or otherwise affects their rights and legitimate interests, solely on the basis of automated processing of their personal data, unless they consented in writing or a federal law that protects their rights provides for it.
- Explain to the data subject how such a decision is made and its possible legal consequences, let them object and explain how they can protect their rights, and consider an objection within thirty days and tell them the result.
Who enforces it
Enforcement body
Roskomnadzor (Federal Service for Supervision of Communications, Information Technology and Mass Media), which investigates and refers KoAP RF Article 13.11 administrative-offense cases for a court to fine; a data subject may also sue directly in civil court under Federal Law No. 152-FZ Article 17(2).
What this law does
Article 16 bars a decision that produces legal consequences for a data subject, or otherwise affects their rights and legitimate interests, from being made solely on the basis of automated processing of their personal data. Such a decision may be made only with the data subject's written consent or where a federal law that also protects their rights provides for it.
The operator must explain to the data subject how the decision is made and its possible legal consequences, give them a chance to object, and explain how they can protect their rights. The operator must consider an objection within thirty days of receiving it and tell the data subject the result.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.