Russian Ministry of Transport Unveils Draft Rules for Centralized Passenger Data with Unique Per-Trip IDs
The Russian Ministry of Transport has released a draft order introducing updated procedures for maintaining centralized databases of personal data belonging to passengers and crew members across all transport modes.
Under the proposed rules, a unique identifier will be generated for every passenger and crew member on each specific trip. This code cannot be reassigned to another individual or reused on a subsequent journey and will accompany all recorded operations involving the ticket and the carriage itself.
The draft significantly broadens the list of operations that must be logged. In addition to existing requirements, authorities will now receive data on boarding cancellations, online check-in events, additions of passengers to group tickets, and removals from such tickets.
The regulation also mandates the inclusion of schedule information for both regular and charter services. This covers planned and actual flight or trip details, cancellations, and any schedule changes.
Personal data retention periods stay unchanged at seven years. Transmission deadlines remain the same: information about ticket purchases for air or rail travel must reach the system within 15 minutes, while data for road, sea, or river transport must arrive within 30 minutes. Crew data must be submitted no later than 24 hours before departure.
The draft includes detailed tables specifying the composition of data fields for each transport type and classifies operations as mandatory, conditionally mandatory, or exempt from transmission. If approved, the new order will supersede the current 2024 rules. Public discussion of the document continues until 29 August.
Related articles
Japan's IPA Opens Special Consultation Desk for Suspected Cyberattack Data Leaks
The Information-technology Promotion Agency (IPA) has launched a dedicated Unauthorized Access Special Consultation Desk to assist companies and organizations affected by cyber attacks resulting in information leaks. The service accepts inquiries from entities that only suspect they may have been victimized, providing initial response guidance even before confirmed incidents. Consultations cover advice on whether unauthorized access or data exfiltration is likely, recommended immediate containment steps, lists of incident response vendors, and reporting obligations to relevant authorities. The hotline operates on weekdays from 9:30 to 17:30 excluding the lunch hour, while email replies may take until the next business day. Separate channels exist for non-access incidents, general security advice, and individual personal data breach concerns. The move responds to a rising number of breaches targeting online services handling personal information.
Russian State Duma Approves Outsourcing of Banking Secrecy and Client Data Without Consent
The State Duma has passed legislation in its second and third readings permitting Russian banks to transfer client data processing, including banking secrecy and personal information, to external IT contractors and cloud providers. No separate client consent will be required for such transfers. Only accredited Russian IT companies and banks holding a universal license that meet strict domestic control criteria may act as processors, with all servers required to remain inside Russia. Banks must notify the Central Bank of Russia in advance, and contractors must undergo audits by organizations licensed by FSTEC or FSB Russia. Special approval procedures involving the Central Bank, FSB, and Rosfinmonitoring apply to banks under foreign control. The law preserves banking secrecy while expanding the circle of authorized handlers under defined security obligations.
Russia's MinTsifry Drafts Security Requirements for Trusted Domestic Software
The Russian Ministry of Digital Development has published a draft set of requirements for trusted Russian software that go beyond simple domestic origin. The proposals focus on resilience against external interference, absence of known unpatched vulnerabilities, and full development and build processes conducted inside Russia under controlled conditions. Additional rules cover up-to-date component inventories, in-country technical support, and timely disclosure of software updates. Special compatibility mandates are included for Russian browsers and electronic signature tools across multiple product classes such as operating systems, databases, office suites, and communication applications. Compliance verification would be voluntary through expert review, with results recorded in the official Russian software registry and internal-use software lists.
Rostelecom Calls for 'Doomsday' Data Centers to Counter Drone Attacks and Infrastructure Risks
Rostelecom executive Valery Ermakov has urged Russian companies to build geographically distributed backup data centers, dubbed 'doomsday' facilities, to ensure service recovery after site losses. The recommendation follows drone strikes that disabled three Yandex data centers in Sasovo, Kaluga, and Vladimir, disrupting both internal services and Yandex Cloud clients. Ermakov explained that previous centralized infrastructure, built for economic efficiency, is no longer viable under changed threat models that now include physical attacks previously considered unthinkable. He advocated a micro-cellular architecture with services spread across many sites connected by high-speed links, while warning that Russian backbone networks are overloaded and much fiber optic infrastructure dates back 20-30 years. Rostelecom positioned its TEA NEXT line running from Kaliningrad to Mongolia as a source of additional capacity to address potential backbone shortages. Yandex responded to the incidents by accelerating client data migration to partner cloud providers.