On March 1, a law came into force that changes the rules for processing personal data in Russia. It also applies to video games. How exactly — we figured out with the lawyers from VERSUS.legal and Semenov&Pevzner.What changes the law?
The new law introduces amendments to the Federal Law “On Personal Data”.
According to the explanatory note, it is aimed at protecting citizens from the collection and uncontrolled dissemination of personal data by third parties.
“First of all, such requirements are addressed to parsers that extract data from popular sites (VKontakte, Facebook, HeadHunter, Avito, etc.) and save copies, including outdated data or information that has been deleted from the original pages,” explains Alina Davletshina, senior lawyer at VERSUS.legal.
The key innovation of the law is the concept of “personal data authorized by the subject of personal data for distribution,” says Ekaterina Smirnova, managing Partner of the St. Petersburg office of Semenov & Pevzner.
Here we should stop.
There is a term “publicly available personal data”. This is information in profiles on social networks, on ad sites, and so on. This also includes email, first name, last name, phone number, personal photos and city of residence.
Previously, their distribution was almost not regulated.
According to the new law, operators (in our case, they mean game publishers) should give users the opportunity to choose which data can not only be processed, but also distributed.
“We are talking about cases when a person voluntarily, by issuing a special consent, allows the dissemination of his personal data, which are available to an unlimited number of people at his will,” Smirnova explains.
Thus, data posted in an open profile on a social network, on a forum or in a video game cannot be freely distributed on other resources without separate permission.
It is important to clarify: the user’s inaction cannot be regarded as his tacit consent, and therefore the responsibility for the dissemination of personal information falls entirely on the operator.
Back in December, the Big Data Association (it includes Yandex, Mail.ru Group, Sberbank, Gazprombank and mobile operators) asked the State Duma not to accept the amendments. Companies feared that the new bill would complicate the processing of personal data.
Davletshina recalls that the discussion of this problem has been actively conducted by lawyers, courts and Roskomnadzor since at least 2017. As an example, she cites the case of VKontakte against the company Double Data. The social network accused Double LLC and the National Bureau of Credit Histories of extracting users’ personal data and using them for commercial purposes. According to Izvestia, these companies assessed the creditworthiness of citizens and sold data from social networks to banks. However, Double claims that it has never done this, but “develops search technologies that allow companies to search for information on the Internet.”
Despite Roskomnadzor’s demand to stop distributing such data, the court ultimately did not satisfy VKontakte’s claim. “The last decision in the case was made in favor of Double Data and open personal data in February 2021, right before the new rules came into force,” Davletshina notes.
Possible consequences for the gaming industryAccording to Smirnova, it is the need for a separate consent to the dissemination of personal data that can directly affect gaming companies.
Amendments to the law will require operators to make the necessary changes to user agreements and other documents.
First of all, this applies to online games. Davletshina believes that certain risks will also appear for applications that authorize users through social networks. Usually a special consent window is used for this, but now the information in it may be insufficient.
senior lawyer VERSUS.legal
It is assumed that users will be able to give their consent to the list of data provided both directly to the operator and through the Roskomnadzor system. To do this, the agency has developed a special form, which is currently being registered with the Ministry of Justice.
That is, it is now necessary to distribute data taken from free access or published by the person himself with extreme caution. The fact is that the obligation to prove the legality of the processing of such data lies with each person who has carried out their distribution or other processing.
Managing Partner of Semenov&Pevzner St. Petersburg office
The Russian gaming industry may also be affected by the opportunity that users have at any time to demand the termination of the transfer of personal data.
To do this, you must provide your contact information and a list of data that should be stopped processing. The operator will have three working days to satisfy such a requirement, however, the consent to processing and distribution itself ceases as soon as the company receives an appeal.
From March 26, amendments will also come into force, tightening the administrative responsibility of operators, which also include participants in the gaming market. Now the fine for violating the law for legal entities will be from 30 to 150 thousand rubles, and for repeated violation you will have to pay from 300 to 500 thousand rubles.
Davletshina notes that the new amendments to the law will also concern the publication of the results of tournaments and contests in which users’ personal information is used. “The new law contains the rule: “if it does not follow from the consent provided by the subject that he agreed to the dissemination of personal data, such personal data is processed without the right of dissemination,” the lawyer explains.
Since it will be almost impossible to monitor compliance with the new rules by foreign organizations, it will be Russian companies that will be at the most disadvantage. At the same time, the full scale of the amendments’ impact on the domestic gaming industry has yet to be assessed in the future.