4 incredible facts about personal data

So what is PD? Our previous post about personal data gathered quite a lot of comments. Most of the controversies revolved around the question of what is considered personal data.
We promised to figure it out and fulfill our promise.

Fact No. 1. The law does not contain a specific list.

In 152-FZ, PD refers to any information relating to a directly or indirectly determined or determined individual (subject of personal data).
From this definition, it must be admitted, little is clear.

Fact number 2. PDNs are of three types.

The law identifies three categories of PDN: general, special, and biometric.

1. The general category includes F. I. O., address, telephone.
2. The law classifies data on race, nationality, political views, religious or philosophical convictions, health status, and intimate life as a special category .
3. Biometric data includes structural features of body parts, fingerprints, palms, retina, DNA analysis, etc.

Fact № 3. Judicial practice on PD

Based on the existing judicial practice, let's look at what should be attributed to PD:

• Last name, first name, patronymic, year, month, day and place of birth, address, family, social, property status, education, profession, income (Decree on case number A15-2016 / 2009 of 05.10.2010. Presidium of the Supreme Arbitration Court of the Russian Federation, Decree on case number A36-5713 / 2014 dated 04.29.2015. 19th AAS).
• Passport details (see, for example, the Appeal definition of the Moscow City Court of 22.05.2014 No. 33-14709).
  There are decisions of the courts, which state that the series and number of the passport identify the document form, but not the individual, and therefore do not relate to personal data (see the definition of the Moscow City Court of February 29, 2012 No. 33-6709; The Thirteenth Arbitration Court of Appeal of June 21, 2010 in case No. A56-4788 / 2010).
  It is difficult to agree with such conclusions, since the series and passport number identify an individual with ease.
  
• E-mail address (see, for example, Case decision No. 12-253 / 2015 of 05/26/2015. Kalininsky District Court (City of St. Petersburg).
  It should be noted that the practice and opinion of Roskomnadzor regarding the assignment of e-mail to the category PD are ambiguous. In a number of explanations, Roskomnadzor indicates that the e-mail address containing the full name will be classified as PD, and if the address is a set of characters (words), it cannot be considered personal data.
• Technical data on the house (see, for example, the Definition of the Primorsky Regional Court of April 28, 2014 No. 33-3718).
• Addresses of residence of individual entrepreneurs , specified in the plan of inspections of legal entities and individual entrepreneurs, placed in public access on the official website of the administration (see, for example, the Appeal definition of the Volgograd Regional Court of 24.04.2014 No. 33-4427 / 2014).
• Information on crossing the state border (see, for example, the Appeal definition of the Moscow City Court of 10.04.2014 No. 33-11688).
• Address of registration of an official , information about his income and property, distributed in a form not prescribed for the official procedure (see, for example, the Definition of the St. Petersburg City Court of March 31, 2014 No. 33-4198 / 14).
• Employee data specified in the employment contract (see, for example, the Appeal definition of the Supreme Court of the Republic of Sakha (Yakutia) of 23.10.2013 No. 33-4172 / 13).

With regard to the classification of data as personal, it is important to understand two more things:
')

1. No verification or confirmation that the data relate to a specific individual is not required (the law does not provide for such a procedure). Therefore, the operator in fact does not know whether this is fictional data or not, but this does not eliminate the responsibility for processing PD.
2. Only those who can identify an individual are personal data (see, for example, the definition of the St. Petersburg City Court of March 26, 2013 No. 33-3815 / 13, Appeal definition of the Moscow City Court of January 28, 2014 N 33- 5461/14).

Fact number 4. More complex matters.

In addition to “simple” data, such as a first and last name, there are often questions regarding more “complex” categories such as IP addresses, nicknames or profiles in a social network and their definitions as personal data.
In the classification of these categories of personal data, even the courts have different points of view.

• Regarding the IP address , a fairly good legal analysis is found in one of the court decisions “... Identification of a user of the Internet information and telecommunications network through the establishment of his personal data at a static IP address assigned by the telecom operator and permanently assigned to the end user equipment when entering into a service contract Internet access (when using a static IP address, all user connections are always identified by this IP address in the communication network) by The legal consequences cannot differ from the cases when the IP address is assigned automatically by the service provider to the user equipment for the period of connection of this device (the session period) to the Internet (dynamic IP address) ”(Case Decision No. 2-5354 / 2015 from 09/24/2015. Oktyabrsky District Court. Samara (Samara region)).
  
  At the same time, some courts do not assign an IP address to PDN (see, for example, the Ordinance on the case No. 56-75017 / 2014 of 06/01/2015. The 13th AAC), while others, on the contrary, recognize (Decision on the case No. 76- 29008/2015 of 02/11/2016. AC of the Chelyabinsk region.).
  
  It seems that a static IP address is fairly attributed to personal data, since it is easy to identify a user by it. But the operator can not know what will be a static IP-address, in this case, you need to recognize all the IP addresses of PD (for every fireman).
• Login and password (from e-mail or social network) is just less controversy. Roskomnadzor has repeatedly stated that they cannot be attributed to personal data.

Of course, this is only the beginning of a dialogue about personal data and questions more than answers.

As for such cosmic matters as the collection of information about users using cookies and other scripts, then we ask you to wait a bit. Comrades, let me deal with the fact that it is simpler! Later we will build on these answers new questions.