The IT business asked to cancel the requirement of the Moscow authorities to collect data from employees of companies at a remote location, as well as the obligation of employers to report on a weekly compliance with self-isolation by personnel. Earlier, against the background of an increase in the incidence of coronavirus, Moscow Mayor Sergei Sobyanin signed a decree providing for such measures. Associations uniting developers of Russian software have asked for support from the head of the Ministry of Digital Science Maksut Shadayev. Izvestia got acquainted with a copy of the letter. Business representatives believe that the disclosure of personal data without the knowledge of citizens violates their rights, and the decree does not provide for a mechanism for granting consent or disagreement to the transfer of information. The city authorities adhere to the position that a phone number or transport card without specifying a full name does not belong to personal data. In any case, the new requirements are better than the introduction of digital passes and total lockdown, experts say.
Table Of Contents
No unaccounted for
Since October 12, Moscow employers have been obliged to report to the city authorities on a weekly basis on the transfer to remote work mode of at least 30% of employees, as well as all employees with chronic diseases and over 65 years of age. For this, companies must provide the mayor’s office with the employee’s mobile phone number, car (if any), social and transport cards. Only the requirement about the mobile is mandatory.
Disagreement with the instructions of Sergei Sobyanin was expressed by the Association of Computer and Information Technology Enterprises (APKIT), the Association of Software Developers (ARPP) “Otechestvenny Soft” and RUSSOFT. They sent a letter with their position to the head of the Ministry of Taxes and Maksut Shadayev.
The requirements for the transfer of information contained in the decree of the Mayor of Moscow No. 97-UM dated October 6, 2020, in many respects contradict the current federal legislation, since this information is personal data of citizens, one of the authors of the letter, the executive director of the ARPP Otechestvenny software »Renat Lashin.
– Companies are not allowed to collect, process and transfer data to third parties without the consent of the owners. If organizations do this, they will violate the current federal law, which will lead to penalties and the suspension of their work. If the business decides not to comply with the mayor’s decree, it will still be fined. Both are unacceptable, – noted Renat Lashin.
Moreover, organizations often simply do not have all of the listed data about their employees, since some of the information is not related to personnel records management, the authors of the letter indicate. At the same time, the employee himself is not always able to provide reliable data. In this case, the employer will be held liable for non-fulfillment or incorrect execution of the order.
The overwhelming majority of small and medium-sized businesses (including individual entrepreneurs) do not knowingly store or process personal or other additional data simply because this implies compliance with rather serious administrative and technical requirements of regulators (in particular, FSTEC). This requires significant expenditures on both personnel and technical support, the letter says.
Associations ask Maksut Shadayev to influence the decision of local authorities and cancel the collection of data from company employees, to exempt employers who have not changed the number of telecommuting employees from weekly reporting, and to coordinate the requirements of the capital’s mayor with Roskomnadzor.
RUSSOFT President Valentin Makarov told Izvestia that no preliminary consultations with the business were held in the preparation of the measures. Whereas, in his opinion, it would be possible to think over joint measures to ensure safety against coronavirus. A useful body could be the expert council on digital technologies under the Moscow government with the participation of IT business associations, he noted. He could provide feedback and consult on operational and strategic issues in the technology area.
The press service of the Ministry of Finance confirmed the receipt of a letter from the associations. They noted that the data can be processed without the consent of the subject of personal data, referring to the presidential decree (No. 316 of May 11, 2020 “On determining the procedure for extending measures to ensure the sanitary and epidemiological well-being of the population in the constituent entities of the Russian Federation in connection with the spread of a new coronavirus infection “And Article 11 of Federal Law 68 of December 21, 1994).
Izvestia also sent inquiries to APKIT and the Department of Information Technology (DIT) of Moscow. There at the time of publication did not answer. Earlier, the department told Izvestia that phone numbers, transport cards and state registration plates of cars without specifying the full name of a particular citizen are not personal data. They also recalled that administrative liability is provided for failure to provide information about employees.
Stop the virus
In order to prevent a further increase in the scale of the pandemic, requirements are being introduced in the capital for employers to provide data on employees transferred to remote mode, explained Pavel Myasoedov, partner and director of the Intellectual Reserve. This is associated with some difficulties for companies, but it is still better than a full-fledged lockdown, he believes. After all, no one wants to allow new losses for business and the economy, but it is also impossible to risk the health of Muscovites in such a situation, the expert believes.
The key problem of the decree is that it ignores the provisions of federal legislation (both labor and personal data), imposing on the company the obligation to provide information about the employee, said Alexander Zhuravlev, chairman of the commission on legal support of the digital economy of the Moscow branch of the Russian Lawyers Association. The employer should not have this data due to their redundancy, because information for the most part can be obtained only with the consent of the citizen.
In addition, the company does not have legal mechanisms to compel an employee to consent, since according to the law on personal data, it should be given freely, says Alexander Zhuravlev. Not all employers are ready to violate federal law, especially when an organization cares about its reputation, and business requires trust from employees and consumers. The commission is preparing an appeal to state bodies with detailed descriptions of the problem and judicial practice on similar issues, as well as a request to amend the provisions of the decree, Alexander Zhuravlev said.
Most of the data contained in the mayor’s decree already has the employer, as well as the right to provide them to third parties, says Pavel Katkov, owner of the IT-legal company Katkov and Partners. After all, firms provide this data to banks, funds, tax authorities, and, accordingly, have the employee’s consent to the processing of this personal data.
In principle, an employee is not obliged to leave his personal number – he can be given a corporate phone number, says Alexei Matyukhov, managing partner of BMS Group. The provision of data on transport cards is also redundant, noted Pavel Katkov. In any case, the measures taken by the city authorities are better than the complete closure of offices and the introduction of digital passes, he said.
The requirements from the decree of the mayor of Moscow are not very effective, but at the same time create tangible difficulties for employers, says Alexei Matyukhov, managing partner of BMS Group. Therefore, he believes, the capital’s authorities should focus not on collecting data from companies, but on monitoring compliance with security measures that prevent the spread of coronavirus. This includes quarantining citizens who may be infected, wearing masks and gloves, and disinfecting when providing various services to the population.