Irina Anyukhina

Legislative regulation of platform employment and implications for business
Platform employment is a relatively new sphere, which is just beginning to be regulated. In December 2023, Federal Law No. 565-FZ “On the Employment of the Population” was adopted, which for the first time introduced the concepts of “platform employment” and “self-employment” into the legal field. In addition, the law ensured that self-employed individuals and specialists working through online platforms enjoy much of the same rights as employees and contractors working under a civil law contract. Self-employed individuals and specialists working through online platforms are entitled to unemployment benefits as long as they pay taxes and contributions. Now the State Duma is drafting a separate bill “On Platform Employment”. The bill is expected to approve the rights and obligations of platform specialists and platforms. In particular, the Duma deputies are discussing the creation of a unified register of digital platforms under the control of a supervisory agency – most likely Roskomnadzor (the Russian personal data protection authority). They also want to require platforms to notify specialists about the possibility of voluntary medical and pension insurance. We will track the progress of this bill. When hiring specialists who work through platforms, we already recommend taking into account labour and tax risks, such as the risks of reclassifying relations with such specialists as labour relations, recognizing a client as a tax agent in relation to a self-employed contractor, and the risks of violating legislation on personal data when information about such specialists is transmitted to third parties. In order to mitigate possible risks, we recommend analysing agreements with providers of digital platforms for provisions that may lead to the materialization of these risks. Assessing the degree of harm caused by leaks of personal data
The Ministry of Economic Development has proposed establishing the following criteria for determining the degree of harm caused by leaks of personal data, from the least to the most critical, including to determine the amount of compensation for such a violation: - Causing harm to a citizen's life or health as a result of a leak of personal data that identifies a person by biological characteristics (scans of identity documents, photo and video materials, or residence and work addresses) - Causing damage to a citizen's property (account data, passwords, or logins of property-related accounts) - Causing moral damage (data on health or personal data) and personalized marketing (data on purchase history or spam calls) Harm caused on the grounds of gender, race, nationality, language, origin, property status, attitude to religion, or beliefs should be an additional aggravating factor when determining the degree of harm caused. Extension of the tax secrecy regime to include information on employment
The State Duma has passed in the second and third readings a bill that would extend the tax secrecy regime to information transmitted by the tax authorities to regional interagency commissions in charge of combatting illegal employment and to regional bodies of the Federal Labour and Employment Service (Rostrud). On 1 January 2024, a new federal law on employment came into force, which stipulates that interagency commissions in charge of combatting illegal employment shall be established in all regions of the Russian Federation. These commissions will be entitled to receive various information, including personal data and information constituting a tax secret, from state bodies, including the Federal Tax Service. The Ministry of Labour and the Federal Tax Service will approve a list of information that the tax authorities will transmit to such commissions. The information on this list will have to be transmitted automatically by the tax authorities without a request from these agencies. Rostrud, in turn, will maintain a publicly accessible register of employers that have been found to have engaged in illegal employment.

The Ministry of Digital Development, Communications and Mass Media of the Russian Federation has expanded the list of risk indicators for violations of the processing of personal data (“PD”)
On 1 August 2024, the Ministry adopted Order No. 682, which includes a new risk indicator for violations that occur when conducting state control (supervision) over the processing of PD. The new risk indicator is for when two or more violations of the requirements of Federal Law No. 149-FZ dated 27 July 2006 with respect to Articles 10.2-2 (the provision of information using recommendation technologies) are detected within a single year. As of 1 October 2023, when using recommendation technologies, website owners must: 1) Prevent the use of technologies that violate the rights and legitimate interests of citizens and organizations, as well as the legislation of the Russian Federation; 2) Inform users about the use of recommendation technologies; 3) Specify the email address to which user requests should be sent; 4) Make the terms of the use of technologies available in Russian. When processing the PD of employees, recommendation technologies may be used by employers, e.g., on internal portals and websites, in corporate messengers, and on training platforms. The government has made it easier for small IT startups to obtain IT accreditation
Regulation No. 1149 of the Government of the Russian Federation dated 26 August 2024 was adopted, which stipulates that: 1) The verification of the share of income from the IT activities of startups included in the register of small technology companies that were established less than three years ago shall be cancelled. Now, in order to receive accreditation, this share of income must exceed 30% of revenue. 2) Companies from new regions (Donetsk, Kherson, Luhansk and Zaporizhzhia Regions) shall be able to receive accreditation regardless of the average monthly amount of payments to employees. This exception shall be valid until 1 July 2025. 3) Applications for the annual accreditation confirmation procedure shall only be accepted in electronic form through the Gosuslugi portal. 4) As part of the confirmation procedure, the salary level check shall be carried out for two quarters instead of five. 5) If the company received accreditation in the year of its incorporation, it shall not be required to undergo the planned confirmation procedure during that year. As a general rule, organizations are entitled to receive state accreditation if: 1) Their main type of economic activity is one of the types contained in Attachment 1 to the Regulation on State Accreditation; 2) The average salary of employees is no less than the average for the country or the region in which the organization is registered; 3) Income from IT business activities is more than 30% of total income; 4) The official website of the organization contains information in Russian about the IT activities performed by the company. Reminder
Posting a photo of an employee on the Internet is regarded as the dissemination of biometric PD to an indefinite number of persons and is only allowed with their written consent. This conclusion was reached by the 2nd Cassation Court of General Jurisdiction in its ruling dated 4 July 2023 in Case No. 88-13675/2023. Facts of the case
While working for a company, an employee participated in a corporate photo shoot arranged by the employer as an incentive measure. After she was terminated, she discovered that her former employer had illegally, without her consent, published and used her photo image on a job search website to attract job seekers. The employee complained to her former employer, who informed her that based on the environment in which the photo shoot was held and the employee’s subsequent behaviour, it followed that she had provided her consent and had also been informed about the purpose of the photo shoot. The employer’s arguments were supported by the court of first instance, which also explained that the photo shoot had been conducted during working hours, for which the employer accrued and paid salary. The appellate instance deemed this ruling to be erroneous, since voluntary participation in a photo shoot does not mean that an employee agrees to the publication and use of the images that the company received for image purposes when posting vacancies on the Internet. Furthermore, the court ruled that the employer had failed to prove there were legitimate grounds for using the images. In addition, the use of the image could be justified during the employment period, but should have been restricted following the dismissal of the employee. The appellate court’s conclusions were supported by the cassation court, which also clarified that posting a photo in the public domain constitutes the dissemination of an employee’s biometric PD. An official from the company was subjected to administrative liability for violations of PD processing
Roskomnadzor (the Russian personal data protection authority) received materials from the Krasnodar city administration about the discovery of a violation of PD processing during the monitoring of documentation containing the PD of employees and clients of Russian Telephone Company. Based on the results of the review, a protocol on an administrative offence envisaged by Part 6 of Article 13.11 of the Administrative Code of the Russian Federation was filed against an official of Russian Telephone Company. The decision of a justice of the peace in Judicial District No. 243 found the official guilty and imposed a fine of RUB 8,000 (approximately USD 88 or EUR 80) against him. This decision answers a question that our clients frequently ask about whether the person responsible for organizing the processing of PD (DPO) can be subjected to administrative liability.

State Duma passes law on anonymization of personal data in second and third readings
The [law](https://sozd-duma-gov-ru.translate.goog/bill/992331-7?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wappbh_histras 'law') provides for the creation of a state information system with anonymized PD (“PD”). The PD operator (employer) will be obliged to anonymize processed data (e.g., of employees) and provide it to the state information system at the request of the Ministry of Digital Development, Communications and Mass Media, which will have to ensure the confidentiality of this data. The law is due to come into force from 1 September 2025. The new law is generating numerous questions for companies, especially in terms of how companies must anonymize PD and what software to use for this purpose. Companies will probably have to buy certified software, which is not yet available on the market. The old Roskomnadzor (Russian Data Protection Authority) order describes anonymization methods for municipal and state bodies and does not provide anonymization methods for private companies, nor does it provide information on technical means for anonymization. The state authorities have started accepting applications for IT deferment from military service from 24 July to 6 August 2024
Employees of accredited IT companies aged between 18 and 30 may apply for deferment from military service in the autumn conscription through Gosuslugi from 24 July to 6 August 2024. If an employee does not have a personal account on Gosuslugi, the company itself will be able to add him to the list. Companies, meanwhile, are required to check and confirm employees' data and send the lists to the Ministry of Digital Development, Communications and Mass Media by 11 August 2024. One company may send several lists as they are compiled. The Ministry of Digital Development, Communications and Mass Media will send the information to the Ministry of Defence by 31 August 2024. From 1 October to 31 December, the conscription commission will make decisions on deferment. Please note that employees of conscription age employed in the IT sector may qualify for deferment of conscription for military service if they: - Work in an accredited IT company under an employment contract with normal working hours - Have completed university education in a major from this special [list](https://publication-pravo-gov-ru.translate.goog/Document/View/0001202204010045?index=4&_x_tr_sch=http&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp 'list') - Have at least 11 months of work experience in the IT sector during the year preceding the date of recruitment Prohibition to include consent to processing of PD in other documents
A [draft law](https://sozd-duma-gov-ru.translate.goog/bill/679980-8?ysclid=lyzstl76k2625458467&_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=ru&_x_tr_pto=wapp 'draft law') has been submitted to the State Duma to formalize consent to the processing of PD separately from other documents signed by the subject of PD and/or provided to him/her for review. According to the authors, consent to the processing of PD is often currently included in contracts or other consents to the processing of PD, which are provided for other purposes. These documents contain, among other things, a significant amount of information not related to the processing of PD and conditions for consent to the processing of PD, including for the purpose of transferring it to an indefinite number of persons. In practice, we often see situations where consent to the processing of an employee's PD is “stitched” into an employment contract. Although there is currently no explicit prohibition in the law to incorporate consent with the text of the employment contract, such an approach can already be challenged, as the employee is considered a weak party and such incorporated consent may be considered non-free and involuntary. We strongly recommend that all employers abandon the practice of including any consents to the processing of PD in employment contracts, other agreements, instructions and local policies, particularly as consent is not the only possible means for processing employees' PD. In many cases, the processing of employees' PD may also be justified by an agreement with the employee or a legal obligation, including obligations that the employer has to employees under the Labour Code of the Russian Federation. Where the processing of PD necessarily requires consent, such consent must be specific, conscious and unambiguous, i.e., obtained separately from other documents, as well as substantive and informed.

Reminder
It is illegal for a company to refuse to provide benefits (e.g., voluntary medical insurance) due to an employee's failure to provide consent to the processing of personal data. This was the conclusion reached by the 3rd Cassation Court of General Jurisdiction in Resolution No. 88-1047/2024 dated 15 January 2024. Key facts of the case
Per the employment contract, employees agreed to comply with all the requirements of the employer’s Internal Labour Regulations and other in-house policies. In accordance with the Policy on Additional Benefits for Employees, employees were eligible to receive benefits if they provide written consent to the processing of their personal data. In the absence of such consent, the benefits for employees could be suspended. An employee who was reinstated at work and did not provide consent to the processing of personal data filed a claim in court to require the company to provide voluntary medical insurance. All three court instances (district court, appellate court and court of general jurisdiction) supported the employee, pointing out that legislation on personal data stipulates that the subject of personal data has the right to grant consent to the processing of such data. However, such consent must be provided exclusively voluntarily. Whether or not a personal data subject exercises his/her rights cannot be made dependent on exercising the right to receive additional benefits provided to an employee as part of employment relations. As a result, the courts satisfied the employee's claims to require the employer to provide voluntary medical insurance on the terms of the existing in-house policy no later than 3 business days from the date on which the court decision takes effect. Claims > To require an employer to provide voluntary medical insurance, recover the amount of food subsidies, provide compensation for delayed payments, provide annual paid leave, and provide compensation for moral damages Resolution > To uphold the decisions of the lower court instances and dismiss the cassation appeal

On 18 July [Irina Anyukhina](https://www.alrud.com/people/IrinaAnyukhina/ 'Irina Anyukhina'), Partner, Head of ALRUD Labour and Employment Practice, will speak at ECOPSY offline conference “Smart strategies at the tight labour market”. During her presentation, Irina will talk about the outstaffing pitfalls: regulation, execution of documents, risks. This year, manpower shortage has become the major problem for enterprises and a serious threat to the economy. Despite the fact that the level of unemployment fell to its record low a year ago, it continues to decline. ECOPSY and ALRUD experts, HR representatives from large manufacturing companies will discuss the touchiest issues. Please join us! You may register on the [organizers’ website](https://bluecollar.ecopsy.ru/?utm_source=email-alrud&utm_medium=email-july&utm_campaign=strategii-raboty-s-personalom 'organizers’ website').

Roskomnadzor (Russian Data Protection Authority) plans to make it easier for personal data subjects to revoke consent to the processing of personal data
Roskomnadzor proposes making it possible to revoke consent to the processing of personal data “in one click”. Technically, the mechanism can be implemented as part of the consent management system that the Ministry of Digital Development, Communications and Mass Media created on the basis of the Gosuslugi service, but it will require revisions to standards. The relevant draft law may be considered as early as September. Business fears that implementing the plan will lead to increased costs for the restructuring of information systems. Criminal liability for violating the secrecy of correspondence and destroying corporate information
The Oktyabrsky District Court of Ufa handed down a verdict in a criminal case against a former employee of the company. He was found guilty of committing crimes under Part 1 of Article 138 of the Russian Criminal Code (violation of the secrecy of correspondence) and Part 2 of Article 272 of the Russian Criminal Code (unlawful access to legally protected computer information committed out of self-interest). The court found that in November 2023, a man who previously worked as a system administrator remotely copied the email correspondence, contacts, and personal data of the general director and corporate information containing trade secrets and destroyed them. The defendant pleaded guilty to the crimes. The court sentenced him to a fine of 120,000 RUB (approximately 1,364 USD or 1,268 EUR). The verdict does not contain information about the company filing a civil claim in criminal proceedings to compensate for damages caused as a result of the destruction of corporate information. Question > Can the data controller be subjected to administrative liability during the moratorium on inspections? Position of the 8th Court of the General Jurisdiction (Case No. 2a-2919/2022) > If a violation is revealed during the consideration of materials received, including from a citizen, Roskomnadzor may conduct an inspection and initiate an administrative offence case or refuse to initiate it.

Ban on foreign information security services from “unfriendly” jurisdictions
Decree No. 250 of the Russian President dated 1 May 2022 “On Additional Measures to Ensure the Information Security of the Russian Federation” previously imposed restrictions on the use of foreign information security means. In particular, government authorities, state corporations, systemically important organizations, and subjects of critical information infrastructure (“CII subjects”) are prohibited from using information security means as of 1 January 2025: - Originating from “unfriendly” states; - Or from manufacturers that are organizations under the jurisdiction of “unfriendly” states, directly or indirectly controlled by them or affiliated with them. Decree No. 500 of the Russian President dated 13 June 2024 extended the scope of the ban: as of 1 January 2025, government authorities, state corporations, systemically important organizations and CII subjects are also prohibited from using cybersecurity services (work or services) from companies from “unfriendly” states. If your company belongs to government authorities, state corporations, systemically important organizations or CII subjects, we recommend that together with IT you conduct an audit of software and IT services used for HR, accounting and personnel management purposes in order to ensure timely compliance with the requirements of the above-mentioned presidential decrees. A 14th package of sanctions, including IT restrictions, has been imposed against Russia
The USA has significantly expanded sanctions against Russia, with new restrictions affecting financial infrastructure, cloud services and information technology. The USA will ban a number of software and IT services as of 12 September 2024. The US Department of the Treasury, together with the State Department, issued a special decree with the following restrictions: - It is prohibited to provide any person in Russia with design services and IT consulting services; - It is prohibited to supply cloud technology and IT support services for business management, as well as design and manufacturing software. Russian companies using such software for HR purposes may consider the following courses of action: - Change the vendor, which will allow them to continue using the software in Russia; - Localize relevant HR processes. Exemption from liability for personal data leaks due to the insignificance of the offence
During the ‘I Give My Heart to Children’ Russian Professional Skills Competition for Continuing Education Employees, there was a technical failure that led to the brief publication (three minutes) of information about a personal data subject on the competition website. The subject’s passport details, registration address, telephone number and email address were published, all of which constitutes personal data. In court, the data controller pointed out that the incident was caused by a technical malfunction in the service, third parties did not gain access to the personal data since the violation was eliminated as soon as possible, and no damage was caused to the subject of the personal data. The Russian Federal Service for Supervision of Communications, Information Technology and Mass Media, (Roskomnadzor) reported that it did not receive any complaints about the data controller as a result of the incident. In accordance with the law, the data controller sent a notification about the leak of personal data. A justice of the peace of the Danilovsky District of Moscow (Case No. 05-1415/456/2023) ruled that the data controller had failed to ensure the confidentiality of personal data and had not prevented unauthorized access to it by third parties, and qualified the offence under Part 1 of Article 13.11 of the Code of Administrative Offences of the Russian Federation. However, since the court had no evidence that information about the personal data subject had been copied, obtained or used by third parties to violate its legally protected rights, including through the competition website, the court relieved the data controller of administrative liability due to the insignificance of the offence and limited itself to a verbal reprimand.

Within a complicated labor dispute involving a middle-level employee, the ALRUD team offered the client comprehensive out-of-court legal defense. The project involved the development and adjustment of the legal position for a client who was representing themselves in court. We made it a priority to address any inconsistencies and violations attributed to the employee, while also preparing a strong defense against claims for a substantial bonus payment. During a series of strategy meetings with the client, we provided insightful commentaries and valuable recommendations on how to proceed in court. Through this collaboration, the company was able to enhance its defense strategy, identify strong justifications for disciplinary sanctions, and ultimately protect its position with success. The project presented a challenge in dealing with numerous infringements and violations, some of which exceeded the usual procedural terms. The non-financial audit performance was carefully analyzed to determine the validity of any violations, with a strong focus on the legal aspects. The project was crucial for the client as it helped them avoid paying a substantial bonus and default interest, which could have greatly increased their financial expenses. In addition, the company's strong confirmation of the legality of the disciplinary sanctions has further solidified its position in terms of corporate governance. ALRUD team working on the project included Partner [Irina Anyukhina](https://www.alrud.com/people/IrinaAnyukhina/ 'Irina Anyukhina') and Senior Associate [Margarita Egiazarova](https://www.alrud.com/people/MargaritaEgiazarova/ 'Margarita Egiazarova').

The State Duma will consider a draft law on the possibility for the plaintiff to receive personal data (“PD”) of the defendant
Amendments are planned to be made to the Civil Procedure Code of the Russian Federation. It is proposed to grant the plaintiff the right to file a motion to the court for assistance in establishing information about the defendant, which is necessary to file a claim in court, but the plaintiff does not have. In addition, if the law is adopted, the court will be able to independently determine the ist of data about the defendant necessary to accept the claim. More than half of the surveyed small and medium-sized businesses are not ready for tougher sanctions for PD leaks
Less than half of Russian companies (44%) from the SMB segment have managed to review their PD protection measures against the background of possible tightening of sanctions for their leaks. 50% of companies have not even studied the amendments in detail, and some do not plan to strengthen protection at all yet. Some of the respondents (45%) expect to strengthen protective processes “within a year”, another 8% - “in the next six months”. There are also those (4%) who do not plan to review the protection at all yet. At least 32% of SMB respondents are concerned about reputational risks from sanctions. 68% of respondents are concerned about financial losses, including from the imposition of fines. It is noteworthy that only 43% of respondents have conducted an audit of PD processing processes over the past 3 years, 11% conducted an audit more than 3 years ago. Almost a quarter (21%) have never conducted an audit at all. 25% of the respondents could not give an answer to this question. We remind you that the draft laws on administrative and criminal liability for PD leaks are planned to be finally considered this spring session of the State Duma. Regardless of the adoption of these bills in this session, we recommend that data controllers be prepared to tighten liability for PD leaks. To this end, companies should conduct an audit of PD processing processes and an IT security audit. A draft law on the right of the Federal Tax Service to transfer information that constitutes a tax secret to interdepartmental commissions has been adopted in the first reading
According to the new law on employment, interdepartmental commissions on combating illegal employment will be created in the regions of the Russian Federation. They have the right to receive from various authorities, including the tax service, PD and information constituting a tax secret. They want to extend the effect of the tax secrecy regime to cases where the tax authorities transfer relevant information and information to interdepartmental commissions of the subjects of the Russian Federation and territorial bodies of the Federal Service for Labour and Employment (Rostrud). Following the results of the prosecutor's office's inspection, the DPO of the company was brought to administrative liability
The Prosecutor's office of the Kirovsky district of Saratov conducted an inspection of compliance with legislation in the field of PD protection in a medical company. During the supervisory activities, together with a specialist of the Roskomnadzor Department for the Saratov region, a fact of illegal dissemination of a database containing PD of clients, in particular phone numbers and full names, was revealed. According to this fact, the district prosecutor's office initiated an administrative offense case under Part 1 of Article 13.11 of the Administrative Code of the Russian Federation against a responsible official of a medical company. According to the results of the consideration of the case, the DPO was sentenced to an administrative fine in the amount of RUB 10,000 (approx. USD 112, EUR 103). Question > Can an employer track the location of employees through their personal smartphones?Can an employer track the location of employees through their personal smartphones? Answer from Rostrud > The employer has the right to monitor the employee through an application in a mobile phone, if this is related to the performance of job duties. We additionally note the need to obtain the consent of employees to track and process PD.

The International Bar Association Global Employment Institute (IBA GEI) published its 12th annual global report on general international trends in human resources law with examples from 54 countries. [Irina Anyukhina](https://www.alrud.com/people/IrinaAnyukhina 'Irina Anyukhina'), Partner of ALRUD Labour Practice, covered a block of issues related to current regulatory trends and developments in Russian labour and migration law, including artificial intelligence, flexible working, alternative workforce, unions, labour disputes. The global report can be found [here](https://www.ibanet.org/document?id=IBA-GEI-Twelfth-Annual-Global-Report-May-2024 'here').