How Russia's Article 10.1 on Personal Data Dissemination Emerged: Legislative History and Reform Flaws
The Russian personal data protection regime underwent significant change with the introduction of Article 10.1 in Federal Law No. 152-FZ. The reform, formally enacted through Federal Law No. 519-FZ, took effect on 1 March 2021 and required separate consent for processing personal data that a subject permits to be disseminated.
Author Anton Gorelk in, First Deputy Chairman of the State Duma Committee on Information Policy, Information Technology and Communications, sponsored the original bill 1057337-7 on 17 November 2020. The explanatory note claimed that once data appeared on websites, operators could freely accumulate, supplement and analyse it for purposes such as targeted advertising, without further control by the data subject.
This framing overlooked existing judicial practice. In case No. A40-5250/2017, courts upheld Roskomnadzor positions that data from open profiles on VKontakte, Odnoklassniki, Twitter and Avito did not automatically become publicly available personal data under Article 8. The Supreme Court refused to review the case. A further Tagansky District Court ruling on 3 March 2020 ordered an internet page that provided unrestricted access to personal data without consent to be included in the register of violators under Article 15.5 of the Law on Information.
The initial draft proposed a detailed consent mechanism: subjects would list specific categories of data, name the exact internet resources where data could appear, and set conditions or prohibitions. Two distinct prohibitions were envisaged—one preventing the operator from transferring data to an unlimited circle of persons (except providing access), and another preventing that circle from further processing (except receiving access). The draft also allowed subjects to demand cessation of processing at any time without proving a violation.
During the first reading on 9 December 2020, the responsible committee itself stated that the bill’s declared objectives were not achieved by its provisions. The Legal Department warned that the bill’s use of the term “access” conflicted with the definition already contained in 152-FZ, where processing includes transfer and transfer includes access. The committee nevertheless recommended passage, promising corrections before the second reading.
The final text preserved the broad definitions of processing, transfer and dissemination while adding new exceptions and a lengthy new category of data alongside the existing Article 8. The resulting framework mixes several legal models without adequate reconciliation, rendering consistent practical application extremely difficult for operators.
Related articles
Google to Back Unified robots.txt Standard for Blocking AI Training Data Use
Google has announced plans to support a common mechanism in robots.txt that allows website owners to opt out of having their content used for training generative AI models. The feature will be based on work by the AIPREF working group at IETF and is scheduled for rollout in 2027. Instead of issuing separate instructions to each AI provider, publishers will be able to set a single policy marker that participating companies are expected to respect. Google intends to treat an unspecified general marker the same way it currently handles its own Google-Extended directive. Existing per-company rules will continue to function, letting site owners combine a broad default with specific exceptions. The approach simplifies management as the number of AI crawlers grows, though compliance will remain voluntary and dependent on which organizations adopt the standard.
Who Pays When AI Agents Err: Insurance for AI Risks in Russia and the West
A typical 2026 scenario involves an AI agent connected to a CRM system that mistakenly deletes half of a company's customer database by misclassifying contacts as duplicates. The incident occurs without any cyber attack or malicious intent from developers, raising questions about liability among model developers, integrators, and the deploying company. Russian law places responsibility on humans or organizations under the National AI Strategy to 2030 and the AI Ethics Code, with harm assessed via general Civil Code provisions such as Article 1079 on sources of increased danger. Experimental legal regimes since January 2025 require mandatory insurance for AI-related harm in areas like autonomous vehicles and telemedicine, while Federal Law No. 243-FZ of July 2026 grants developers of sovereign AI models rights to insure liability and mandates technical documentation. A March 2026 draft law proposed detailed responsibility chains and exemptions but was significantly diluted in the final version. Internationally, no mandatory AI liability insurance exists in the US or EU, though specialized products from insurers like Armilla and Munich Re cover hallucinations, agent actions, and performance shortfalls, with real incidents already generating claims.
Russia's MinTsifry to Begin Issuing Official Code Signing Certificates in 2027
The Russian Ministry of Digital Development plans to start issuing state-backed code signing certificates for software developers in 2027, with corporate security certificates following in 2028. The initiative aims to help operating systems identify publishers and verify that code has not been altered after release. A draft government decree would grant MinTsifry the powers of a National Certification Authority, allowing it to set certificate requirements, issue and revoke certificates, define validity periods, and maintain a public registry. While the signature confirms origin and integrity, it does not guarantee the absence of vulnerabilities in the software. The law permits charging fees for certificates, but no decision on pricing has been made yet. Full recognition by operating systems, browsers, and app stores will be required, and foreign platforms are not obligated to trust the Russian certificates automatically.
Rostelecom Explores Underground Data Centers in Partnership With Norilsk Nickel for Stronger Physical Protection
Rostelecom is developing underground data centers as a third layer of protection against serious external threats. The first layer involves backup sites with data copies, while the second distributes computing power and services across geographically separated locations. The company is discussing the project with Norilsk Nickel, which could supply both underground facilities and its own power generation capacity. Experts from iKS-Consulting estimate that a buried data center would cost 30-40 percent more than a comparable surface facility due to requirements for waterproofing, ventilation, gas monitoring, specialized fire suppression, evacuation systems, and underground equipment transport. Sources indicate the plans were reported by Vedomosti citing a top Rostelecom executive and people familiar with the talks. No specific timelines, sites, or technical parameters have been disclosed yet.