The rules for processing personal data in the Federal State Institution "Digital Culture" (hereinafter referred to as the Institution) establish procedures aimed at identifying and preventing violations of the legislation of the Russian Federation in the field of personal data, and also determine for each purpose of personal data processing the content of the processed personal data, the categories of subjects whose personal data are processed, the timing of their processing and storage, the order of destruction upon achievement of processing purposes or upon the occurrence of other legal grounds.
These Rules define the policy of the Institution as an operator engaged in the processing of personal data in relation to the processing and protection of personal data.
The processing of personal data in the Institution is carried out in compliance with the principles and conditions provided for by the legislation of the Russian Federation in the field of personal data, as well as these Rules.
The subjects of personal data whose personal data is processed in the Institution in accordance with these Rules include:
1) employees of the Institution;
2) citizens applying for positions in the Institution;
3) persons who are related (property) to the subjects of personal data — employees of the Institution who hold positions, the exercise of powers for which entails the obligation to provide information about their income, expenses, property and property obligations, as well as income, expenses, property and property obligations of their spouses (spouse) and minor children;
4) persons submitted for awarding state and departmental awards, for encouragement by the President of the Russian Federation, the Government of the Russian Federation, the award materials for which are submitted to the Institution;
5) citizens who applied to the Institution in accordance with Federal Law No. 59-FZ of May 2, 2006 "On the Procedure for Considering Appeals of Citizens of the Russian Federation" (hereinafter — the Federal Law "On the Procedure for Considering Appeals of Citizens of the Russian Federation");
6) applicants who applied to the Institution in accordance with Federal Law No. 210-FZ of July 27, 2010 "On the organization of the provision of state and municipal services", as well as persons whose information is contained in the state data bank on children left without parental care;
7) users of information who have applied to the Institution in accordance with Federal Law No. 8-FZ of February 9, 2009 "On Providing access to information on the activities of State Bodies and local Self-Government bodies";
8) persons who gain access to state information systems operated by the Institution.
Personal data of the subjects of personal data specified in sub-paragraphs 1 — 4 of paragraph 4 of these Rules are processed in the Institution in order to ensure the tasks of personnel work, including personnel accounting, office work, assistance in the implementation of labor activity, formation of a personnel reserve, training and job growth, accounting for the results of the performance of official duties, ensuring the personal safety of personal data subjects, ensuring the working conditions established by the legislation of the Russian Federation, guarantees and compensations, as well as for the purpose of combating corruption.
For the purposes specified in paragraph 5 of these Rules, personal data processing is carried out with the consent of the personal data subject to the processing of his personal data in accordance with the provisions of Federal Law No. 152-FZ of July 27, 2006 "On Personal Data" (hereinafter — the Federal Law "On Personal Data").
Consent to the processing of personal data of a personal data subject whose data is processed for the purposes specified in paragraph 5 of these Rules is not required when processing personal data in accordance with paragraph 2 of Part 1 of Article 6 of the Federal Law "On Personal Data".
Consent to the processing of special categories of personal data, as well as biometric personal data of personal data subjects whose data is processed for the purposes specified in paragraph 5 of these Rules, is not required when processing personal data in accordance with paragraph 2.3 of Part 2 of Article 10 and Part 2 of Article 11 of the Federal Law "On Personal Data" and the provisions of the Labor Code of the Russian Federation, except in cases of obtaining personal data of an employee from a third party.
The consent of the personal data subject to the processing of his personal data must be obtained in the following cases:
when transferring (distributing, providing) personal data to third parties in cases not provided for by the provisions of the Labor Code of the Russian Federation and on combating corruption;
in case of cross-border transfer of personal data;
when making decisions that generate legal consequences in relation to these persons or otherwise affect their rights and legitimate interests, based solely on automated processing of their personal data.
In the cases provided for in paragraph 9 of these Rules, the consent of the subject of personal data is issued in writing, unless otherwise established by the Federal Law "On Personal Data".
The processing of personal data of personal data subjects whose data is processed for the purposes specified in paragraph 5 of these Rules is carried out by employees of the Institution entrusted with the functions of ensuring the implementation of personnel activities (hereinafter — authorized to process personal data on personnel issues).
Processing of personal data of personal data subjects whose data is processed for the purposes specified in paragraph 5 of these Rules includes the following actions: collection (receipt), recording, systematization, accumulation, storage, clarification (updating, modification), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.
Collection (receipt), recording, systematization, accumulation and clarification (updating, modification) of personal data of personal data subjects whose data are processed for the purposes specified in paragraph 5 of these Rules is carried out by:
obtaining the originals of the required documents;
copying of original documents;
entering information into accounting forms (on paper and electronic media);
formation of personal data in the course of personnel work;
entering personal data into the information systems of the Institution used for personnel work.
Collection (receipt), recording, systematization, accumulation and clarification (updating, modification) of personal data is carried out by obtaining personal data directly from personal data subjects whose data are processed for the purposes specified in paragraph 5 of these Rules.
If there is a need to obtain personal data of personal data subjects whose data is processed for the purposes specified in paragraph 5 of these Rules from third parties, the authorized person for the processing of personal data on personnel issues should notify the personal data subject about this, obtain his written consent and inform about the purposes, intended sources and methods of obtaining personal data.
It is prohibited to receive, process and attach to personal files the personal data of the subjects of personal data specified in subparagraphs 1-4 of paragraph 4 of these Rules concerning their race, nationality, political views, religious or philosophical beliefs, private life, membership in public associations.
When collecting personal data for the purposes specified in paragraph 5 of these Rules, the authorized person for the processing of personal data on personnel issues is obliged to explain to the subjects of personal data the legal consequences of refusing to provide personal data.
The transfer (distribution, provision) and use of personal data of personal data subjects whose data is processed for the purposes specified in paragraph 5 of these Rules shall be carried out in the cases and in the manner provided for by the legislation of the Russian Federation.
The processing of personal data of citizens is carried out in an Institution for the purpose of providing public services, in case the Institution is authorized to provide public services.
The processing of personal data of personal data subjects whose data is processed for the purposes defined in paragraph 19 of these Rules is carried out by employees of the Institution entrusted with the authority to provide public services.
In the Institution, the processing of personal data of citizens is carried out in order to ensure timely and full consideration of their oral and written appeals in accordance with the procedure established by the Federal Law "On the Procedure for considering appeals of Citizens of the Russian Federation".
The personal data of citizens who have applied to the Institution, as well as those who have sent individual or collective written appeals or appeals in the form of an electronic document, are processed for the purpose of considering these appeals with the subsequent provision of a written response on the merits of the issues raised in the appeal or notification.
In accordance with Articles 7 and 13 of the Federal Law "On the Procedure for Considering appeals of Citizens of the Russian Federation" in connection with the consideration of citizens' appeals received by the Institution, the following personal data are subject to processing:
1) surname, first name, patronymic (if any);
2) address for correspondence;
3) email address (if available);
4) other personal data specified in the application, as well as those that became known during a personal reception or during the consideration of the received application.
The processing of personal data required in connection with the consideration of citizens' appeals is carried out without the consent of the subjects of personal data in accordance with paragraph 2 of Part 1 of Article 6 of the Federal Law "On Personal Data" and the Federal Law "On the procedure for considering appeals of citizens of the Russian Federation".
The transfer (distribution, provision) and use of personal data of citizens are carried out in cases and in accordance with the procedure provided for by the legislation of the Russian Federation.
Access to the information systems of the Institution of the employees of the Institution who process personal data in the information systems of the Institution is realized through an account consisting of a user name and password.
Access to the information systems of the Institution is provided in accordance with the functions provided for by the job descriptions of the employees of the Institution.
Information is placed in the information systems of the Institution in automatic mode, and when receiving information on paper or in another form that does not allow its automatic registration, in manual mode..
Ensuring the security of personal data processed in the information systems of the Institution is carried out by the Institution in accordance with Article 19 of the Federal Law "On Personal Data", the Requirements for the protection of personal data when they are processed in personal data information systems approved by Decree of the Government of the Russian Federation No. 1119 of November 1, 2012
Personal data is stored on paper and (or) electronic media in the relevant structural divisions of the Institution, whose powers include the processing of personal data, in accordance with the provisions on these structural divisions.
Personal data is stored electronically in automated electronic systems.
Storage of personal files of employees of the Institution dismissed from the Institution is carried out in accordance with the order of the Ministry of Culture of the Russian Federation dated March 31, 2015 No. 526 "On approval of the rules for the organization of storage, acquisition, accounting and use of documents of the Archival Fund of the Russian Federation and other archival documents in state authorities, local governments and organizations."
The terms of storage of personal data in an Institution are determined in accordance with the List of standard administrative archival documents formed in the course of the activities of state bodies, local self-government bodies and organizations, indicating the terms of their storage, approved by Order of the Federal Archival Agency dated December 20, 2019 No. 236.
Personal data during their processing, carried out without the use of automated information systems, should be separated from other information by fixing them on different material carriers, in special sections or on the fields of forms (forms).
It is necessary to ensure separate storage of personal data on different material carriers of personal data, the processing of which is carried out for the purposes defined by these Rules.
The terms of processing of personal data in the Institution are determined in accordance with the Federal Law "On Personal Data".
The processing of personal data of the subjects of personal data specified in subparagraph 1 of paragraph 4 of these Rules is carried out during the entire period of their work.
In cases of detection of unlawful processing of personal data, achievement of the purpose of personal data processing, withdrawal by the subject of personal data of consent to the processing of his personal data, the specified personal data shall be destroyed within the time limits established by Article 21 of the Federal Law "On Personal Data".
Documents containing personal data whose retention periods have expired are subject to destruction in accordance with the legislation of the Russian Federation.
Personal data shall be destroyed in a manner that excludes further processing of these personal data, while preserving the possibility of processing other data recorded on a tangible medium, if this is allowed by the format of the tangible medium.
The full text of the document is available at the link (RU)..