How to obtain an employee’s consent to the processing of personal data. Consent to the processing of personal data: we fill out correctly Application for the processing of personal data of a legal entity

Companies, while carrying out their business activities, on the one hand, are periodically forced to disclose personal information of the organization’s personnel. On the other hand, the Federal Law on Personal Data obliges employers to protect this information. In this situation, the only legal way out is for their administration to obtain the employee’s consent to data processing each time. Personal information of employees includes full name, details of their passports, place of residence, age, education, marital status, etc.

The law requires each employer to develop a local regulatory act at its enterprise, which would stipulate what applies to personal data, in what cases its disclosure is allowed and what measures it takes to ensure confidentiality.

Every person applying for a job must be familiar with this document.

In addition, the company must register as an operator for processing this information with Roskomnadzor. Personal data protection includes not only limited access to employees’ personal files with recording of each request, but also the differentiation of rights to use databases on a computer. The company must have someone responsible for implementing these activities.

When, even before the conclusion, it is advisable for the employee to fill out a consent form for the processing of personal data. This allows the company administration to collect, process and store them. This form is developed by the enterprise independently and is included as an annex to the relevant Regulations.

Most often, an enterprise has to disclose information when issuing card accounts for an employee, powers of attorney for the right to receive goods and materials and represent interests, concluding contracts, issuing acts, invoices, invoices, issuing orders for the appointment of responsible persons and drawing up outgoing letters, etc.

In accordance with the law, this form must be filled out every time information is communicated to third parties. The employee's written permission is valid for a limited period, and even then the person has the right to withdraw his or her application.

To avoid troubles, it is recommended to obtain this consent even from the director and founder. Recently, this practice has become widely used when concluding contracts with large companies. This document began to appear very often as an appendix to them.

In some cases, the organization may disclose this information to third parties without obtaining the worker's permission. For example, at the request of government authorities.

For unlawful disclosure of information constituting the personal data of an employee, the company and its responsible persons may be subject to penalties in the form of imprisonment, compensation for damage suffered by the employee, including moral damage, as well as the imposition of fines. Supervision of compliance with legislation in this area is carried out by Roskomnadzor, which may conduct inspections from time to time.

Sample of filling out consent to the processing of personal data

Full name is indicated at the top right of the document. the person in whose name the permit is drawn up, his position, the name of the company.

After this, the title of the document is written in the middle of the sheet: “Consent to the processing of my personal data.”

Then in the application you need to indicate the personal data of the employee, his home address, full details of the passport or other available document confirming his identity - series, number, date and place of issue. It is imperative to make reference to federal law or other regulations. Then enter the name of the company to which this permit is submitted and its full location address.

Then you need to indicate for what purposes the information will be disclosed, and list all the personal information for the use of which consent is provided - this could be personal data, information about salary, length of service, incentives and penalties, etc. You also need to indicate a list of actions and what methods will be used for processing. If you plan to provide data to several places, then it is best to draw up a separate consent for each institution.

Below is the time period during which this document is valid. Then the text includes information about exactly how the permission can be revoked. It would not be superfluous to add information that the employee was explained about his rights in the field of personal data protection.

After this, the employee indicates his position, puts down a personal signature, deciphers it, and the date of completion.

The Personal Data Law establishes that every employer is an operator for their processing, therefore he must create all conditions and take various measures to ensure their confidentiality. In order to use or transfer personal information of its employee to a third party, the company must obtain his permission to do so.

The employee’s personal data includes his full name, passport details, residential address and telephone number, information about marital status and more. The law obliges the employer to protect this information, otherwise appropriate penalties may be applied to him.

The law defines cases when disclosure of information can be made without permission. These include providing information at the request of government agencies when the company provides medical, pension, social insurance, etc.

The company must register with Roskomnadzor as an operator, and also develop its own regulatory act - approved, with which each newly hired employee is familiarized with signature. It contains basic concepts, lists of information, procedures, methods of protection, rights and obligations of the parties in this area, liability, etc. The processing of personal data, that is, their collection, storage, use and transfer, in the company is carried out strictly in accordance with it.

Carrying out business activities, the company interacts with its counterparties through its employees. From time to time, to confirm their authority, she has to provide personal information about the staff.

For each such case, the company is obliged to obtain consent from the employee for the processing of personal data. In fact, this is the employee’s written permission to disclose strictly defined information. It must be remembered that this document is drawn up every time it is necessary to use his personal information.

Legislation provides the employee with the right to revoke this permission at any time. To do this, he must submit an application in writing.

The consent form for the processing of personal data is developed at each enterprise separately and is included as an annex to the Regulations of the same name. It is a template that is filled out by the employee, and then filed into his file by the HR department.

Roskomnadzor periodically has the right to inspect an enterprise in the field of personal data processing. One of the main documents that this body will require to provide is a statement of consent to the processing of personal data.

Sample of filling out consent to the processing of personal data

In the upper right corner, fill in the position of the manager and his full name, as well as the name of the company. The title of the document is written below.

The employee, in the first person, fills out his personal information, registration address, as well as his passport data - number, series, date and the authority that issued the identity document.

When filling out the consent, it is advisable to include a link to the legal acts in accordance with which it is drawn up.

The following indicates who has the right to work with personal data, the purpose of their processing, and who is allowed to provide it. If you need to provide information to several organizations, it is advisable to fill out separate forms for each of them, rather than combining everything together. Also at this point it is necessary to consider in detail the list of actions that can be performed with this data.

Below, the employee writes down a complete list of personal information that he allows to work with. Here not only the employee’s personal data can be indicated, but also the amount of his salary, length of service, information about professional achievements, etc.

Then you need to fill in information about the time period during which this document will be valid, that is, the start and end date.

The consent must contain a clause according to which the employee has the right to revoke it if his information is used incorrectly.

The document is signed by the employee himself with a description of his position, full name.

The date of its registration is indicated below.

Nuances

It is advisable to include a clause in the consent to the processing of personal data stating that the employee has been explained all his rights and obligations regarding the protection of personal data.

The employer, as well as its officials, may be subject to administrative (fine 4,000-5,000 rubles), criminal (up to 5 years in prison), civil (compensation for material and moral damage) liability for the unlawful disclosure of an employee’s personal information.

Relatively recently, a new document called “Consent to the processing of personal data” was introduced into circulation in Russia. Very quickly it became widespread and is currently widely used in a variety of organizations, from government budgetary institutions to commercial companies.

FILES

What is consent?

Consent to the processing of personal data is a written permission of a citizen of the Russian Federation, which he gives to the interested party to receive, collect, store and use personal information about himself.

The document also guarantees a person that information about him will be used for strictly defined purposes and will be protected from unlawful actions.

When is consent most often required?

Now consent must be written almost everywhere:

• when submitting documents for a child to kindergarten or school;
• during employment;
• when concluding an agreement with a bank, insurance company, etc.

In other words, wherever a citizen provides his personal documents or documents of the person whose representative he is, fills out various tests and questionnaires, he signs such consent.

What does the term “personal data” mean?

The law clearly defines this concept: personal data means all information that directly relates to a person as an individual. This:

• Full Name;
• Date and place of birth;
• information from your passport, work book and other documents;
• as well as some characteristics of his personality.

It should be noted that consent to the processing of personal data is required even though not all of this information is confidential and classified.

In particular, they can be divided into three main types:

1. publicly available data (full name, gender, date, place of birth, citizenship, etc.)
2. biometric (physiological characteristics of an individual, his external parameters)
3. special (nationality, religion, health, etc.). This also includes, to some extent, information about a person’s place of work, his relationship with the law, habits, etc.

According to the law, consent to the processing of personal actions is strictly necessary only when it concerns the last two of the above categories, but it is often written in relation to information that is publicly available.

Why is consent to processing during employment formed?

When a person gets a job, he gives the employer’s representative his personal documents: passport, work book, SNILS, education certificate, medical book, military ID, etc. As soon as these papers reach the HR specialist’s desk, they receive confidential status (which is ensured by Article 14 of the Labor Code of the Russian Federation), therefore, for their further use (and there is no way to do without this in HR records), it is necessary to obtain the written consent of the employee (clause. 8 Article 65 of the Labor Code of the Russian Federation).

This document should describe in detail how, for what purpose and what specific information from personal data will be used, processed and stored.

It should be noted that by law, all personal information provided to the employer can only be used for business purposes.

If the employee refuses to sign the consent

The legislation of the Russian Federation clearly states that consent must be only and exclusively voluntary, that is, the employer does not have the right to force a subordinate to sign this document, therefore in the practice of HR specialists there are people who refuse to sign consent to the processing of personal data.

This is usually caused by the fact that they do not understand the true purpose of the document: to protect the rights of the employee, but on the contrary, they are afraid that personal information about them will fall into the hands of unscrupulous citizens.

In these cases, the law allows the processing of personal data without the employee’s consent, but only when it is necessary to implement the terms and purposes of a previously concluded employment contract.

Here it is necessary to emphasize separately that this applies only to those employees of the organization who are already enrolled in its staff, but in relation to new employees, consent to the processing of personal data must be obtained - without it, in most cases, a person today cannot even be accepted for work. work. This is due to the fact that an employment contract has not yet been concluded between the parties, which means that the employer does not yet have an obligation to fulfill it.

It is logical that the administration of the enterprise strives to avoid situations where, for example, even in such trifles as issuing a pass to the company’s territory, the lack of consent to the processing of personal data can play a negative role.

What is the penalty for disclosing personal data?

As mentioned above, the actions that the employer can perform with the personal data of employees are clearly stated in the text of the consent.

If powers are exceeded to some extent, and, even more so, if some kind of abuse occurs, the most serious liability may arise: ranging from disciplinary and administrative, even criminal.

In order for the employee to have a clear idea of ​​whether the information requested from him does not go beyond what is required by law or whether the authority of the company’s employees according to the text of the consent is not exceeded, one should analyze the document in advance (possibly even using the help of a qualified lawyer) and only then put sign your consent.

In particular, information about whether a citizen has served time in prison is needed only when the position for which he is applying directly requires the absence of a criminal record (in other words, if an applicant wants to work as an advertising manager, he has the right not to have such data give).

How to notify

The legislation states that representatives of organizations must notify Roskomnadzor about the processing of all personal data received at their disposal (Article 22 of Law No. 152-FZ). You can see whether the employer complies with this provision of the law on the website of this government agency.

Is it possible to revoke consent?

Typically, the action with consent to the processing of personal data occurs like this: when applying for a job, a person signs a document, after which he safely forgets about it. But in some cases, there is a need to revoke a previously signed consent. As a rule, this happens when an employer violates the conditions for storing, using and ensuring the secrecy of information received at its disposal, as well as upon dismissal.

In order to issue a review, you just need to write a statement in free form, demand in it to stop the collection, processing, use, storage of personal data and destroy all information about the subordinate (you must refer to Law No. 152-FZ: clause 1 of article 9 and paragraph 5 of article 22).

This requirement must be met no later than one month after writing the review.

Sample consent

The consent is written in any form or according to a template that is developed and approved within the organization. In this case, the form must contain the following information:

• name of the employing company;
• place and date of document preparation;
• last name, first name, patronymic of the employee, his passport details and information about his place of residence.

• what personal data the document concerns;
• for what purposes and what exactly is permissible to do with them;
• the validity period of consent and the possibility of its revocation (although this is already guaranteed by law).

It is imperative to mark that the consent was written without coercion and voluntarily. After this, a signature is placed under the document.

AGREEMENT
FOR PROCESSING PERSONAL DATA

Ivanovo

I, Kovtun Inna Olegovna, passport 2495 564738, issued by the Leninsky District Department of Internal Affairs of Ivanovo, registration address: Ivanovo, st. Melnichnaya 73, apt. 8, I give my consent to KomZhilFond OJSC to process my personal data. Consent concerns the surname, name, patronymic, information about gender, date of birth, citizenship, type of identity document (its series, number, date and place of issue), as well as information from the work book: work experience, place of work and position.

I agree to the use of personal data solely for the purpose of creating the company’s personnel document flow, accounting operations and tax deductions, as well as storing all of the above data on electronic media. Also, with this consent, I authorize the collection of my personal data, their storage, systematization, updating, use (including transfer to third parties for the exchange of information), as well as the implementation of any other actions provided for by the current law of the Russian Federation.

It has been brought to my attention that KomZhilFond OJSC guarantees the processing of my personal data in accordance with the current legislation of the Russian Federation. The validity period of this consent is unlimited. Consent may be withdrawn at any time upon my written request.

I confirm that by giving my consent I act without coercion, of my own free will and in my own interests.

Kovtun I.O. (signature)

An agreement for the processing of personal data is a document that gives the right to use passport data, address, date of birth and even the last name, first name and patronymic of a citizen. All this is information that is especially protected by law. Persons who, for one reason or another, receive, process, transmit or store such information are operators and must obtain consent to any actions with the information received.

The concept of personal data and its handling is regulated by Federal Law of July 27, 2006 No. 152-FZ as amended on February 22, 2017. In accordance with this document, personal data of citizens protected by law should be understood as any information that directly or indirectly relates directly to their subject (that is, an individual). Such information allows you to clearly determine which person you are talking about. But a person is the absolute owner of his data, and any organization does not have the right to dispose of it unless he has signed a consent form for the processing of personal data 2019.

What is personal information of citizens

There are no specific indications in the legislation of what information about a person is his individual and protected data. According to established practice, it usually hides:

• Full Name;
• Date and place of birth;
• residential address (place of registration);
• family, social and property status;
• education, profession;
• income, property and liabilities.

Typically, a person provides such information about himself to many government agencies, medical and educational institutions, credit organizations, and even to commercial structures, for example, during employment. In addition to the above information, which is general, there is also special personal data, such as nationality, religion, political views, health status and other information of this kind.

What documents contain a citizen’s personal data?

There are a number of documents that are inherently sources and at the same time repositories of personal information. These include, in particular:

• citizen's passport (domestic and foreign);
• other identification documents;
• employment history;
• military ID;
• birth certificate;
• education documents,
• documents on family composition;
• income certificates;
• questionnaires filled out during employment;
• autobiography;
• characteristics;
• personal cards of employees (form T-2);
• other documents.

Obviously, most of these documents, originals or copies, are kept by citizens' employers. They, and all other persons to whom such information comes, are personal data controllers.

Operators of personal data and actions with them

Article 3 of Law No. 152-FZ states that the operator is the person who organizes and carries out the processing of personal data. All employers, both legal entities and individual entrepreneurs, are such operators by default; the circle of other persons who acquire this status is practically unlimited. This can be any person to whom the person has entrusted information about himself by signing consent to the processing of personal data.

We will pay special attention to the concept of processing personal information. They talk about it everywhere, but no one really knows what it is. Whereas Part 3 of the same Article 3 of Law No. 152-FZ regulates this concept as any action (or a set of actions) performed with personal information. By actions, legislators understand:

• collection;
• recording;
• systematization;
• accumulation;
• storage;
• clarification (update, change);
• extraction;
• usage;
• transmission (distribution, provision, access);
• depersonalization;
• blocking;
• deletion or destruction of data.

All operations are carried out either in paper manual mode or using automation tools, including online. For all these actions, the operator is obliged to obtain consent from the owner for the processing of personal data (a sample form and form can be seen in the article). For employers, this is a separate case, since the purposes of their processing are regulated, among other things.

Statement of consent to the processing of personal data and document requirements

As mentioned above, operators are required to obtain consent from citizens to process personal data on the website or in paper form. First, let’s determine the general requirements for the preparation of these documents - this will help answer the question of how to fill out consent. And it is necessary to take into account that the sample consent form for the processing of personal data for organizations and institutions is slightly different from the application that his employer will take from each new employee.

Norms Article 87 of the Labor Code of the Russian Federation It has been established that all organizations independently determine the procedure for storing and using information received from employees. A similar principle applies to all other operators. The main thing is not to violate the requirements established by federal laws and codes. Before starting processing and deciding which sample agreement for the processing of personal data to use, it is necessary to approve the local act of the organization “Regulation on Personal Data”. This document must contain all the basic requirements for the rules of documentation. The regulations are approved by the manager with the consent of the trade union body (if any).

When it comes to employers, it is important to take into account that according to the norms of clause 8 of part 1 Article 86 of the Labor Code of the Russian Federation All employees and their representatives should be familiarized with the approved Regulations upon signature. They even start a special journal for these purposes. If there are no Regulations in the operating organization, this is a gross violation for which the rules Article 13.11 of the Code of Administrative Offenses of the Russian Federation a fine is provided.

Sample of filling out consent to the processing of personal data

The requirements for consent given by the owner of personal information for its processing by the operator are defined in Part 1 of Article 9 of Law No. 152-FZ. The main requirement is that such consent must be specific, informed and conscious - and must be in writing. An electronic form is also acceptable if the interaction between the owner and operator occurs via the Internet. In any case, the operator must be able to confirm the fact of its receipt at any time.

At the same time, although the law itself makes no mention of the written form of this document, according to the provisions of Article 13.11 of the Code of Administrative Offenses of the Russian Federation, punishment will follow if the operator begins processing:

without written consent of the subject of personal data to the processing of his data in cases where such consent must be obtained under the legislation of the Russian Federation, if these actions do not contain a criminal offense.

Therefore, it is recommended to immediately fill out a statement of consent to all manipulations with personal data and not worry about it anymore. There is no universal form for such a document: each operator can develop it independently or use the proposed sample consent to the processing of personal data.

Sample agreement between employee and employer

An arbitrary form of consent or statement does not exclude a number of requirements established in Article 9 of Law No. 152-FZ for its content. It must indicate:

1. Last name, first name and patronymic of the person, his address, full details of the document proving his identity (similar requirements for representatives of the citizen).
2. Name or full name and operator address.
3. Purpose of obtaining personal information.
4. List of data to be processed.
5. Data from an organization or individual entrepreneur to whom the operator has entrusted any manipulation of data.
6. A list of actions with information about a person to which he has given his consent, a general description of how it is stored and used.
7. The period during which the consent is valid and the method of its withdrawal.
8. Personal signature of the citizen.

We talked about what personal data is, what are the general requirements for their processing and protection, and gave an example of the Regulations on the processing and protection of personal data of employees. In general, the processing of a person’s personal data is carried out with his consent (clause 1, part 1, article 6 of the Federal Law of July 27, 2006 No. 152-FZ). We will tell you how to formalize such consent in our material, provide a sample of written consent to the processing of an employee’s personal data, and also remind you whether an employer always needs to obtain consent to process an employee’s personal data.

Form and content of consent to the processing of personal data

Consent to the processing of personal data is provided in writing in paper or electronic form. In this case, it must be certified with a handwritten or electronic signature, respectively. Consent must include, in particular, the following information (Part 4, Article 9 of Federal Law No. 152-FZ of July 27, 2006):

• FULL NAME.;
• individual's address;
• information about the main identity document (number, date of issue and issuing authority);
• name or full name and the address of the operator who receives consent to data processing;
• purpose of processing personal data;
• list of personal data for the processing of which consent is given;
• name or full name and the address of the person who will actually process personal data on behalf of the operator (if processing is entrusted to another person);
• a list of actions with personal data for which consent is given, a general description of methods for processing personal data;
• the period during which the consent is valid, as well as the method of its withdrawal;
• signature of the person giving consent.

Consent form for the processing of personal data: sample

Here is a sample for filling out consent to the processing of personal data:

Consent to the processing of personal data:

When drawing up consent to the processing of personal data of a minor, the same sample can be used, taking into account some features. Federal Law No. 152-FZ of July 27, 2006 does not specify the procedure for obtaining consent to the processing of personal data of a minor. Only in relation to incapacitated people is it stated that consent to the processing of their personal data is given by legal representatives (Part 6, Article 9 of the Federal Law of July 27, 2006 No. 152-FZ). Considering that minors have limited legal capacity, it is advisable to formalize the consent of minors over 14 years of age both on behalf of the minors themselves and their legal representatives (parents, adoptive parents, guardian). At the same time, in the sample consent form for the processing of personal data, it is necessary to provide space for indicating the relevant information (full name, address, passport details) of both the minor and his legal representative.

When consent to the processing of personal data is not required

The obligation to obtain a person's written consent to process his or her personal data does not mean that, for example, an employer must always obtain such consent from its employees. Thus, consent to the processing of personal data of employees is not required in the case when the processing of personal data is carried out in the performance of a contract concluded with the employee and within the framework of the obligations that are assigned in this regard to the employer. For example, data processing when concluding an employment contract, when data is processed from documents or information presented when applying for a job; when filling out a personal card in form No. T-2; when transferring mandatory information about an employee to the Social Insurance Fund, Pension Fund, tax authorities; when processing information in accordance with the collective agreement. This also includes, in particular, the processing of personal data of a dismissed employee as part of accounting and tax accounting (Explanations of Roskomnadzor).