As an ordinary user fought for compliance with the law “On Personal Data”

Today, in the Pravo.ru blog, a curious topic has appeared on how companies should behave, gathered to open Internet resources, which will have to work with personal data of customers. Therefore, at the request of the workers , I will lay out my story on the part of the average user, who decided to check his rights in the case.

It is not a secret at all that many technological innovations reach Russia with a fair delay. This applies to almost everything - from mobile gadgets and computer games to cars. The reasons for such delays are very different, but they are expressed not only in the lack of these very new products, but also in the slow response of the law to changes in technical progress. Regarding the topic of the post, this is expressed in the laws governing the processing of personal data of the user. Overseas, in the countries of Western Europe, North America and several other developed countries of the world, laws to varying degrees regulate data processing from the mid 80s and early 90s, but in Russia, progress on this issue began only at the turn of the XX-XXI centuries, which resulted in the adoption of the federal law “On Personal Data” . What is its value for the ordinary citizen? The value is that it is able to protect the rights and freedoms of a person when processing his personal data.

Now, from general statements I want to go to a more specific part, namely, to apply the law on the Internet. What benefits does the user have knowledge of the law and what troubles can happen to your personal data? It so happened that a person very often deals with entering his personal data on a huge number of sites. Here and registration of mailboxes, and filling pages in social networks, and filling orders in online stores, and creating accounts on the forums, and design online services (from banking to booking tickets). Your personal data can be scattered over the mass of nodes, which in the end creates a lot of dangers. Is the entered data protected? Yes, on serious resources, such as reputable banks, your data is encrypted, but on some forum where your password comes up in the letter “I forgot my password”, your data is not encrypted at all. And your entered data is potentially under the threat of intruders, because databases can be hacked from a half-kick, and then your e-mail address / residence address specified on the forum, etc. go to pavilions of markets selling counterfeit disks, or to distribute torrent trackers, where they are happy to get people who are engaged in promotion of certain services. And then wait, at best, spammed mailboxes and mailings that you did not subscribe to. And then something else worse, even blackmail .
A similar situation happened to me. Being a stupid schoolboy, I remember how two or three years ago I was fanatically registered on websites such as online games, forums and so on. The result is predictable - now the spam folder has turned into the collapse of incomprehensible letters. If the spam filter does not work, then something penetrates the usual inbox. Just recently received a newsletter advertising new features from the game Runes of Magic. What kind of game I don’t know, because it seems I didn’t play it, and I couldn’t remember the reasons for registration. It was then that it occurred to me to check the work of the legislation, namely, Chapter 3 of the Federal Law No. 152 “On Personal Data”. What I've done?
one). I went to the site and read the current edition of the user agreement , and also checked that you cannot delete an account with regular funds.
2). After reading the agreement, began to dig according to the site. The domain is registered and delegated in Russia by the Center. The certificate of the secure HTTPS version is issued to the company itself and has not been verified by a third party.
3). I checked the reviews on the site on the Web of Trust (WoT) service, where it became clear that users are not very content and satisfied, as he has a very dubious reputation, for both pornography and spam, and aggressive advertising on the site.
Well, for a test of your capabilities, stock up on information, now there is only contact with the support service. I compiled a request, sent it, even without much hope for an answer at that moment.

Hello, I ask you to delete my account and stop processing
personal data, including e-mail, in accordance with federal law
of July 27, 2006 N 152- “On Personal Data”, and also delete the address
emails from mailing lists. Regards, <nickname selected for the site>.

It is necessary to pay tribute to the support service, which did not put a bolt on everything, as often happens.
The answer came very quickly, but was not as rosy as I wanted:

We will exclude your email address from mailing lists, but you cannot delete your account.

I was stunned and re-opened the user agreement to clarify this issue. Armed with the terms of the user agreement, I began to scribble a response letter:

Hello, thanks for understanding.
Thank you for excluding my e-mail from the mailing list, but why is it impossible to delete an account, if the User Agreement provides such an opportunity:
3.6.If the User has not activated the Account for 2 (two) months in a row, i.e. did not enter the Login and Password on the Site in the respective fields, the Company has the right to delete the Account. The User shall not have the right to make to the Company any claims in connection with the deletion of the Account in the manner specified in the Agreement.
6.4. The user has the right to stop using the Game at any time. In cases established by the Agreement, the User is obliged to stop using the Game. The date of termination of use of the Game by the User is considered the earlier of the following dates:
6.4.1. Date of deletion of the Account;
6.4.2. 2 (Two) months from the date when the User last activated the Account, i.e. entered on the Site in the appropriate fields Login and Password, even if the corresponding Account is not deleted.

Please consider this letter as an official request to delete an account in accordance with clauses 6.4.1 and 8.8 of the Company's User Agreement, as well as Federal Law No. 152- dated July 27, 2006 “On Personal Data”, article 21, clause 5.

It must be that the support service did not expect to be hooked to them, and not immediately retracted, because the guys from the support wrote some fabulous crap:

You misunderstand point ps. 3.6, “The Company is entitled” is not the same as
"Company is obliged." Account deletion is not possible for technical reasons.

That is, the company has the right to do something, but does not have the technical ability to do it. I had a cognitive dissonance, because it seemed to me that the maxim of the level “we have the right to fly to Pluto, but we do not have the technical capability” looks, at least, strange for the user agreement. I expressed my bewilderment and expressed in a reply letter:

How can you delete an account if this is not possible for technical reasons ? Here I really do not understand anything. Why make the contract items that you can not perform?
Since the domain rmonline.ru is registered and delegated in the territory of the Russian Federation, and you carry out activities in accordance with the laws of Russia, then if your agreement is not authoritative for you, follow the Federal Law specified in the last letter, namely Federal Law of July 27 2006 N 152-FZ "On personal data", article 21, paragraph 5.

There was nothing for the company to cover, so the support response was somewhat unintelligible:

Once again we draw your attention to those paragraphs. where it is indicated that the administration
“May”, this does not mean that the administration is “obliged”. If you do not want more
use an account that just don't do it.

Thanks, of course, for the advice, but the trick is that I definitely have not used the service for more than two months, so I could not be an active user, and the mailings still come. So, no, let's delete all of my account, especially since I have a right to do so. I write quite a serious answer

However, please note that the administration, without being obliged to delete accounts by points of its user agreement, is governed primarily by the legislation of the Russian Federation, which requires you to delete an account at the request of the client. Please pay attention to the points of the law mentioned in the previous letters. If you continue to persist, please do not bother with repetitions about the inability to do anything, but provide information to settle the dispute in court (the full name of your organization, legal address, address of actual location, references to regulatory documents governing your activities organizations in the Russian Federation).

Dear habrareyd, I do not know whether I was ready to actually engage in such "nonsense" (because the cat wept for personal data in the account), but I had a couple of lawyers I knew whom I could explain the situation for the sake of interest interested in as an entertaining experience. Nevertheless, thanks to the actions of the support, a simple test of strength turned into a matter of principle for me. Therefore, it is quite possible that the case would have reached the filing of the claim, since now it is not so difficult to do so. But the matter did not come to this, because the support service reversed and sent a concise message:

Account has been deleted.

The Chukchi is tricky, the Chukchi is smart, so I’d come to check what was what. I tried to enter the site. I overtook an epic file, began to fill out a password reminder form - epic file. That is, the technical reasons instantly disappeared, it was necessary only to demonstrate determination and the desire to go to the end.
')

Conclusion

What is the conclusion? And such that these laws really allow you to protect your rights and your confidential information. Such situations have a number of pros and cons.
The ability to really protect their rights.
When a precedent arises (yes, I understand that we have no case law, but there is a certain practice of making similar decisions) the solution of such situations in favor of the client will be simplified.
To make a feasible contribution to the creation of a state of law as it is good at paper, but bad in deed.
Big time investment. It will take both the laws to know, and the user agreements to read, and argue in pre-trial debriefings, and court trials, and other vagaries of time to squander.
Similar nerve costs. Not everything goes smoothly, like clockwork.
Possible costs of funds. From the banal payment of traffic to the payment of compensation.

In order to minimize the effect and consequences of the indicated minuses (there may be more of them than I indicated), one should act as objectively as possible.
one). We and the potential opponent play according to the same rules - according to the legislation of the Russian Federation. User agreements only regulate the part that the law does not regulate. And if the clauses of the agreement contradict laws and other official legal acts, then you can forget about these contradictory clauses.
2). Give yourself a report - are you suffering enough damage to start defending your rights, or is your desire caused only by a desire to have some fun? If you have some fun, it's better to choose a different way of getting pleasure, because this is a game with fire, and the above-mentioned disadvantages can hit much more than you would like.
3). Do not give in to emotions. In protecting your rights and working with legislation, emotions are far from being the best assistant (for example, this topic shows that emotions were summed up by a law enforcement officer who immediately turned people against himself). A cold head is the best helper. The clearer and more reasoned your position, the better.
And do not be afraid that the support service does not consider you a person, threatens you, says nonsense or does not want to work . They are the same players in the game of legislation, like you, so you have the same rights with duties.

So on a childlike example of communication with the support service of an ordinary MMORPG, decide whether the game is worth the candle, but remember that no one will protect you for your rights thanks for unless you yourself want to protect them. Bulk does not happen much.
Good luck in everything and think that you post on the web! :)