Keywords

1 Introduction

Over the past few decades, the issue of personal data protection has been addressed a great number of times and in a variety of aspects. It makes to suggest that this issue has long been exhaustively studied and discussed. However, this is not so, there are many reasons to address again and again at the problematics of personal data protection from new angles and with new approaches. Let’s name some of them that seem to be on the top now.

Firstly, personal data are closely related to the individual and his rights and freedoms. Human right theory and individual’s legal status is some kind of a “living matter” that is evolving towards empowerment a human being with news rights and freedoms as necessary remedies versus social and technological evolution challenges. So, the more new technologies penetrates into our life, the greater will be the value of the human rights and freedoms associated with the information and data processing.

Secondly, the emergence of new information technologies for data processing may not only give new and unprecedented before opportunities for modern economy, but also create a threat of uncontrolled use of data and, therefore, undermine the humans rights and freedoms. Among these technologies are increasingly called “big data”, “cloud computing”, “artificial intelligence”, “internet of things”, etc. However, they are often used together in different sorts of combinations to collect and process data and a refusal to use them would mean a serious technological lag behind competitors [28].

Russia is not an exception in this respect. New program and policy documents seriously pay attention to the problem of personal data protection as a priority principle [6]. The current Doctrine of Information Security [9] puts the problem of personal protection in the information sphere on one of the first places, including the problem of ensuring privacy in the use of information technology. The Strategy for the Development of the Information Society for 2017–2030 [27], responding to the challenges of the modern technological revolution, in particular, “big data”, says about the need to preserve and ensure the balance of interests of the individual and his right to personal and family secrets and the introduction of new technologies (“big data”) for information processing. This is expected to be achieved through their storage on Russian territory and transmission only through Russian operators, as well as by preventing the illegal collecting of data on Russian citizens. The state program “Digital economy of the Russian Federation” [7, 12] also contains in its Roadmap a number of measures aimed at ensuring the protection of the individuals’ rights and legitimate interests in the circumstances of digital economy, especially when processing big users’ data in social networks and other means of social communication.

The international community also does not remain indifferent to this issue. The new General Data Protection Regulation [13] in the EU notes the need to strengthen, harmonize and develop measures for the protection of personal data in the context of new technological challenges that have arisen after the adoption of the well-known Directive 95/46/EC [8].

Despite such an abundance of normative and policy documents that seek to consolidate and establish individual’s rights on personal information as something inherent to a human being in the information society, in fact, there can be seen other contradictory tendencies that eventually may undermine the existing concept of data protection as well as the right of an individual to control his data processing. Moreover, these trends are common not only for Russia but also for other countries [14, 23, 25, 29].

2 Methodology

The authors used quantitative and qualitative analysis of existing Russian and foreign publications in open sources in international and Russian science-citation databases. Considering the topic of the research, the main emphasis was made on publications indexed in the Russian scientific citation database (E-libraryFootnote 1), Scopus and ScienceDirect.

In addition to analyzing the state of modern scientific research, the authors used for qualitative analysis statistical data on digital economy in Russia and in the world, for comparative analysis existing program and policy documents on digital economy, information security, information society as well as existing legal texts and bills envisaged for adoption in the nearest future.

3 Literature Review

The problem of personal data protection has long been of serious interest to Russian and foreign scholars [2, 4, 17,18,19, 25, 30, 32, 33]. The direct correlation between the data protection and human rights and freedoms makes this topic far from being exhausted.

At the same time, for the scope and aim of this study, the most relevant and significant studies are studies of the legal nature and considerations of personal data as an object of ownership [3, 15, 19, 22, 24]. The problematics of ‘propertisation’ of personal data has been long studied by scholars and for now has no a universal solution, especially in the frame of diversity in understanding of ‘ownership’ by different legal systems and national peculiarities.

Another important component of the study is the consideration of the problems of commercialization of personal data as a product or a service, as well as various proposals to simplify the procedure for obtaining consent and to protect the rights of operators on the databases created by them [14, 25].

To some extent, new and interesting for the purposes of the study is the concept of digital or data sovereignty [10] describing the desire of the state to control data processing and information flows and to have access to personal data accumulated by metadata operators, international, transnational and national Internet companies including social networks [16, 18, 23, 26].

4 Personal Data in Digital Economy Environment

Firstly, for a modern economy based on knowledge and data, where the data itself, including personal data, are a crucial element-source without which the digital economy simply cannot function. The issue of strong contradiction between the concept of “big data” and “personal data” has been repeatedly addressed and is increasingly finding its supporters [20, 25]. It seems to be clear that the principles of data protection could hardly be compatible with the three ‘V’ concept of big data processing and here lies the most important contradiction and awareness of large Internet business entities. The fact that data controller is dependable on the consent of an individual who has an absolute right to withdraw from data processing constitutes a serious risk accompanied with more complex issue of necessity to comply not only with one national jurisdiction rules but to face other jurisdictions’ requirements that potentially may contradict each other and lead to possible sanctions.

All this makes data processing a wary ground and explains from one point the strong intention of data controllers in minimization of possible risks by simplifying the consent obtaining from an individual or by establishing their own concept of propertisation or commercializing of data, including personal data, to defend their interest through long and well-known concept of “ownership” [14, 19].

This intention is supported by day to day practice and sometimes by neglection of a large part of users to their privacy protection [23]. It is commonly well-known that even in case of adoption and publishing of privacy policies by data controllers on their web sites as well as the announcement to admit them in order to obtain web services or get other benefit from an Internet company users mostly accept them and without a real possibility to properly read and understand their content because of its complexity and a lack of any professional skills. The problematics of complexity of user’s agreements was addressed several times and always with no coherent solution. The existing trend on making law provisions more robust and detailed in data protection make them generally even more complicated and harder for understanding and thus practically useless for the purpose of giving a coherent and clear user’s consent on his data processing.

At the same time, the so-called profiling of online users (web profiling) is becoming a usual practice in return for better (users’ oriented) services, which presumes tracking their online activities on the Internet, preferences and interests. Profiling is used in a variety of areas, primarily in Commerce, in the use of contextual advertising allowing to provide targeted advertising and, ultimately, to optimize selling, production and increase profits [31].

This makes Internet companies seek for more benefit from data processing by share them with third parties or even to sell them. The existence of a whole market of “personal data”, sometimes latent, is no longer to be something outstanding or unpredictable that is justified by several major revelations over the past few years. Hence the understandable intention to legalize the already existing practices of processing and transmission of metadata and reduce the risks associated with legislative barriers, which they consider, apparently, as annoying obstacles [14].

This explains the proposal for the monetization of obtaining the individual’s consent or the creation of a unified database or a sort of ‘individuals’ consent database. The latter is supposed to be a single register of individuals’ consent on their data processing. The consent includes the description of datasets that an individual gives permission for collecting and processing by any data controller. This system could make possible for data controllers to start data processing without directly contacting data subject for consent.

The problem of monetization or use of the category of ownership for personal data or propertization has repeatedly become an issue for a number of studies but unfortunately with no clear answer to this complex question [15, 24]. The concept of ownership could be possibly applied (that is also under question) but only to some extend and for sure not to all the categories of personal data. Some data as DNA are unique to an individual and couldn’t be transferred to any one as property or somehow [15]. At the same time, the idea to use ownership for personal data, used in USA, can be considered as the most adequate response to the diversity of states’ legal systems with no clear provisions on federal level [24]. In these circumstances, the ownership of personal data could be a universal remedy for human rights protection.

On the contrary in the European tradition, personal data are regarded as a mean to protect human rights and freedoms – a sort of inherent right of an individual to control his data processing as part of his individuality. In this sense, the role of an individual as the ‘data subject’ is in determining the key parameters of any data processing including the right to withdraw from it [29].

At the same time, it is impossible not to recognize a significant interest of data controllers (Internet companies) companies including the commercial value of data sets in obtaining and protecting their rights to personal data. In fact, it is even difficult to assume the cost and real value of investments of data controllers [14] i.e., the owners of social networking services or e-commerce projects in the processing of personal data. It seems to be logical recognize not only the existence of such an interest, but also the fairness of such claims for investment protection and stability of digital economy functioning, as well as their dependence from personal data protection regulation changes.

5 Personal Data and Digital Sovereignty

It should be of no more a secret that the state also seeks to learn more about an individual, his personal or private life, intending in some cases to get full exclusive access to his data. We could observe now a clear and unambiguous tendency to expand the powers of the state as the operator of personal data and the reducing number of cases where an individual may interfere as data subject and influence or control his data processing. Surely that may have an explanation and legal ground as we cannot deny the increased presence of terrorist and extremist organizations, as well as simply illegal content on social networks and the Internet in general. On the other hand, those restrictions aimed to control online activities of users and collecting data on them do not leave any coherent guaranties of how this information is used exactly and whether there is an abuse control system operated by competent authority.

The only thing to admit here that the state is already aware of the benefits of “big data”, “artificial intelligence”, “Internet of things” technologies and has long been one of the major data controllers. It remains only to take a few steps to erase the barriers between different state information processing systems to process metadata and to adopt another exclusion in the Data protection legislation for that reason. The state is clearly understanding the value of metadata on online users’ activities accumulated by third parties – private entities and large Internet companies. Those data were long kept a secret from state authorities. But the situation has greatly changed since. It is not necessary to blame only Russia or regard it as a unique case - other countries also seek to openly or covertly use big data technologies and get wide access to third parties’ datasets with more or less success, pursuing a variety of goals [16, 32]. It becomes no sensation publicly revealed facts of leaking metadata from social networks to state intelligent services or other investigative authorities.

In many ways, this contributes also to the rooting and active promotion of the concept of ‘information/digital sovereignty’ or data sovereignty [1]. Perhaps only this can logically explain the recent steps of the Russian state.

This concept was very convenient for the protection of the interests of the state in the information sphere and is now actively used by some countries. In fact, the state is looking for control over the flow of data that has any connection with it, as well as the technological infrastructure on its territory. By adopting in 2015 legislative provisions on the mandatory storage of at least a copy of data on Russian citizens on Russian territory, the state made another step to establish control over the data accumulated by Internet companies providing e-services to Russian citizens. The second important step was to establish a requirement to disclose the source code for encryption used for a secure connection when using network services [21].

Later, all this was supplemented by the requirement to store all information about the connection and the content received by the user from the internet and telecommunication service provider for 6 months. Those decisions are well-known as ‘Yarovaya’ Bill. All this clearly underlines the state's desire to control its information space and often use data on citizens (the need to protect personal data or individual’s information security) as a reason to control data flows and get access to them [21].

6 Current Legislative Initiatives and Data Regulation Perspectives

Recently, the Russian legislator has increasingly addressed to the topic of personal data protection. Undoubtedly, the pandemic period has further strengthened the above-mentioned trends and is likely to be a subject for discussion and the time for more thorough analysis will come, including in terms of the protection of human rights and personal data. Large-scale leaks of personal data of patients who have had COVID-19 cause serious concern to the Russian society and can hardly be ignored [34]. One of the consequences became serious tightening of liability for violations of the legislation on the protection of personal data. In many cases, the amount of fines was almost doubled, simultaneously with the replacement of the ‘warning’ with real punishment.

However, the most recent attempt to resolve the issue of the legal regime of publicly available data is of particular interest. For a long time, Russian lawmakers have explicitly used such a concept as “publicly available (open access) personal data”, which became such in the case of a law on disclosure of information (for example, the income of high-ranking civil servants), or if the data subject himself made them so. Under this concept, personal data actively posted by users of social networks became open, and their processing by third parties did not seem to require special consent for processing. Later, this concept was abandoned, it was presumed that only the data published on publicly available resources of personal data under data subject’s direct and explicit consent for their openness could be processed freely.

Nevertheless, Russian legislation and practice in this case demonstrated the ambiguity of this position. The starting point here was the well-known case of Vkontakte v. Double [5]. As a matter of fact, the main issue in this case was the question of the legality of the use of open data of users of the social network by third-party services that process such information. After many twists and turns, the court concluded that personal data becomes publicly available only if it is provided by the subject himself and is available to an indefinite circle of persons. The court did not recognize the social network as an open access source of personal data, primarily due to the lack of consent of the subject to post them on social networks. This position was actively expressed by the Russian Data Protection Authority (Roskomnadzor) supporting the need for the consent of the personal data subject to the collection and processing of personal data posted by users in open access on social networks. However, the latest decision in this case quite clearly indicated that there were no violations of the law on personal data, if the online service carried out indexing and caching of the data of social network pages similar to a search engine and if the users using the tools of the social network itself gave their consent to the indexing of their pages by search engines.

In parallel with this decision, the Russian IT community was puzzled by a new legislative initiative, which comes into force on April 1, 2021 [11], regarding the appearance of a new category - “personal data allowed by the subject of personal data for distribution”. As a matter of fact, these are the personal data in respect of which the user has unequivocally, and in a special form, agreed to unlimited(open) access to them by third parties. In other words, third parties can freely process such data, and the operator can transfer, distribute or allow access to it. At the same time, the subject has the right to stipulate certain conditions or set exceptions for the transfer of data to certain persons. The consent must name specific categories of data for which such a regime is established, and can be withdrawn at any time by the subject without giving reasons. It is extremely specific that such consent can be provided by the subject directly to the operator or through a special information system, operated by Roskomnadzor.

It is obvious that these changes have raised a lot of questions, including quite practical ones, from the point of view of the functioning of the Roskomnadzor consent register, as well as the need to bring the existing practice of social networks and many other online services in accordance with these provisions and the legal formalization of user consent, which have yet to be resolved in the nearest future.

7 Conclusion

Currently, we can say that we live in a time of changing the paradigm of views on the problem of personal data protection. In fact, the well-known concept of personal data protection as an inalienable right of any person with a large number of internal elements-the rights of the data subject to control and determine the key parameters of data processing-no longer seems so indisputable. The realities of the data economy force data controllers to challenge the existing principles of data protection regulation, which obviously hinder the further development of the digital economy. It's no secret that many multinational Internet companies are now seeking ‘better’ jurisdiction to avoid national legal barriers to the use of big data and other modern technologies to process personal metadata or host technological infrastructure. They are trying to lobby for a new legal framework for the protection of personal data, actively supporting the “propretization” and “commercialization” of personal data, turning it into a kind of commodity for free circulation with less risk of being held accountable. Of course, we need to talk about the beginning of this initiative, but the trend is clearly visible.

However, Russia is hardly one of the countries with an established tradition of respect for personal data. In fact, the legislation on personal data itself has been in full force for about 15 years, and some drastic changes in the legal consciousness of citizens in this regard can hardly be expected.

On the other hand, we can assume the emergence of another very interesting trend, which reflects the interest of the state not only to accumulate large personal data in state or “affiliated” information systems, but also to have access to or at least control large data accumulated by private economic entities. It is still difficult to say with certainty what awaits the concept of personal data soon, but much is already becoming obvious. The international community and international organizations would probably play a more important role in addressing these issues. There is no doubt that significant changes in the legislation on personal data in one group of States can have significant consequences for others in the context of the globalization of the digital economy. The most striking example of this is the numerous changes in the privacy policies of the largest social network operators as a result of the adoption of the General Data Protection Regulation in the EU.

In any case, the necessary balance between restricting access to personal data, on the one hand, and freedom of business, on the other, has yet to be found.

The biggest regret here can only be that all these trends are surprisingly common in the matter of depriving a person of his rights to control the processing of his personal data. This is an awful prospect, and none of us should forget about the purpose of personal data as part of the human rights protection system and, in most cases, the only means of providing it. Recent legislative decisions in Russia, which, undoubtedly, were initially aimed at significantly expanding the tools of the data subject in determining the regime of his open access data, are unlikely to change the situation. Despite a number of positive aspects and the emergence of transparency in relations between the controller, third parties and the data subject, it is still worth noting that it will be more likely to benefit the state and the IT-business. In fact, there is at list three reasons to be thoroughly addressed in this case:

  1. 1.

    As a rule, such consent to public availability (open access) will be conditioned on the provision of digital services “necessary/indispensable” for the user – the refusal of which may block their use.

  2. 2.

    Considering today huge arsenal of big data solutions, strong artificial intelligence, capable of self-learning, even an experienced user will find it increasingly difficult to assess and assume the possible consequences of his consent and recognize threats. Ultimately, this solution will certainly allow to legalize the work of many network services, which will use personal data even more freely.

  3. 3.

    New technologies should be considered as a mean not only for personal data collecting or processing but also as a powerful tool for data breaches detecting. Russian Data Protection Authority – Roskomnadzor is seeking to create an internet platform capable to detect unlawful personal data collecting in the Internet.