Building a website, connecting analytics and launching the project is not the end of the work on a website, because there is also its legal side. Roskomnadzor, Rospotrebnadzor and other supervisory authorities are increasingly checking online platforms, and fines for violations reach hundreds of thousands of roubles. Personal data protection legislation requires businesses not only to collect consents to the processing of personal data but also to follow the rules for running websites through which visitors' personal data is processed.

Processing the personal data of website visitors automatically makes you (the website owner) a personal data operator.

Below we look at which documents need to be published on your website to avoid liability.

Documents required for a website

Personal data processing policy.

This is a mandatory document that must be freely accessible to every visitor to your website (Article 18.1(2) of Federal Law No. 152-FZ of 27.07.2006 ("Law No. 152-FZ")).

This document allows the data subject to learn how personal data is processed, what measures the operator takes to protect it and what set of personal data the operator will process.

For a business, this document is proof that it is taking all the necessary organisational measures to protect personal data.

Consent to the processing of personal data.

Under every data collection form, the website user must take a conscious and unambiguous action — tick a checkbox.

IMPORTANT! Passivity ≠ consent: a checkbox ticked in advance on behalf of the data subject does not meet the requirement of a conscious and unambiguous expression of the data subject's will.

IMPORTANT! The checkbox must include a link to the full text of the consent to the processing of personal data.

Cookie notice.

Cookies are data files stored on the user's computer after visiting a website (for example, the IP address and information about actions on the website).

Cookies are considered personal data if they make it possible to identify a particular person. Technical cookies (needed for the website to work) do not require consent.

IMPORTANT! Passivity ≠ consent: consent to cookie processing must not contain a pre-ticked box.

IMPORTANT! The checkbox must include a link to the full text of the cookie notice.

Consent to receive advertising mailings (if applicable).

Consent to receive advertising mailings gives you the right to send the recipient (the data subject) information about new events, discounts and promotions.

IMPORTANT! Consent to the processing of personal data and consent to receive advertising mailings are two different consents, so separate checkboxes are needed for them.

IMPORTANT! The checkbox must include a link to the full text of the consent to advertising mailings.

Public offer (mandatory if you sell goods and/or services remotely via the Internet) (paragraph 17 of Government Resolution No. 2463 of 31.12.2020).

Liability for a missing document

Personal data processing policy — an administrative fine of:

• RUB 1,500 to 3,000 for individuals;
• RUB 6,000 to 12,000 for officials;
• RUB 10,000 to 20,000 for sole proprietors;
• RUB 30,000 to 60,000 for legal entities.

(Article 13.11(3) of the Code of Administrative Offences).

Consent to the processing of personal data — for processing without the subject's proper consent (or with consent lacking mandatory details):

• RUB 10,000 to 15,000 for individuals;
• RUB 50,000 to 100,000 for officials and sole proprietors;
• RUB 150,000 to 300,000 for legal entities.

(Article 13.11(1) of the Code of Administrative Offences).

For processing without the subject's proper mandatory written consent (or without mandatory details):

• RUB 10,000 to 15,000 for individuals;
• RUB 100,000 to 300,000 for officials and sole proprietors;
• RUB 300,000 to 700,000 for legal entities.

(Article 13.11(2) of the Code of Administrative Offences).

Processing of cookies — an administrative fine of:

• RUB 10,000 to 15,000 for individuals;
• RUB 50,000 to 100,000 for officials and sole proprietors;
• RUB 150,000 to 300,000 for legal entities.

(Article 13.11(1) of the Code of Administrative Offences).

Public offer — a warning or a fine of:

• RUB 500 to 1,000 for officials and sole proprietors;
• RUB 5,000 to 10,000 for legal entities.

(depriving the consumer of the right to information, Article 14.8(1) of the Code of Administrative Offences).

Also a warning or a fine of:

• RUB 300 to 1,500 for individuals;
• RUB 1,000 to 3,000 for officials and sole proprietors;
• RUB 10,000 to 30,000 for legal entities.

(violation of the rules of distance selling, Article 14.15 of the Code of Administrative Offences).

Recommendations from the C Cases team

1. Check that the website has a personal data processing policy and that it covers the essential terms (for example, the principles, purposes and content of personal data processing, the methods of processing and the conditions for ending processing);

2. Check that the website has a consent to the processing of personal data and that it covers the essential terms (for example, the purposes of processing and the list of personal data to whose processing consent is given).

You can find more details in the article "Consent to the processing of personal data: how to draft it and avoid a fine".

3. Check that the website has a cookie notice;

4. Check that the website has a consent to receive advertising mailings and that it covers the essential terms (for example, which communication channels will be used and what information will be collected for the mailings).

You can find more details in the article "How not to end up in spam: rules for lawful SMS and email marketing".

5. Check that the website has a public offer (if needed) and that it covers the essential terms (for example, information about the seller, the procedure for concluding the contract and placing an order, and how the order price is determined and paid).

Conclusion

Complying with personal data legislation is not a formality but real protection for a business against financial and reputational losses. The absence of even one of these documents may lead to fines, and the absence of several to liability for several administrative offences at once.

Roskomnadzor and Rospotrebnadzor inspections are becoming increasingly regular, and a complaint from any website visitor can trigger one.

A legal audit of the website and regular updating of its documents is the most effective way to avoid claims from supervisory authorities and users.

If you need to check your website for compliance with personal data legislation, develop the necessary documents or remedy violations already identified, the C Cases team is ready to provide the full range of legal support: from a website audit to preparing all the necessary documentation on a turnkey basis.

Sources

1. Code of Administrative Offences of the Russian Federation No. 195-FZ of 30.12.2001;
2. Federal Law No. 152-FZ of 27.07.2006 "On Personal Data";
3. Government Resolution No. 2463 of 31.12.2020.