Sample consent to automated processing of personal data. Important features and procedures, as well as an example of obtaining consent to the processing of personal data

The Personal Data Law establishes that every employer is an operator for their processing, therefore he must create all conditions and take various measures to ensure their confidentiality. In order to use the personal information of its employee in its activities, as well as transfer it to a third party, the company must obtain his permission to do so.

The employee’s personal data includes his full name, passport details, residential address and telephone number, information about marital status and more. The law obliges the employer to protect this information, otherwise appropriate penalties may be applied to him.

The law defines cases when disclosure of information can be made without permission. These include providing information at the request of government agencies when the company provides medical, pension, social insurance, etc.

The company must register with Roskomnadzor as an operator, and also develop its own regulatory act - approved, with which each newly hired employee is familiarized with signature. It contains basic concepts, lists of information, procedures, methods of protection, rights and obligations of the parties in this area, liability, etc. The processing of personal data, that is, their collection, storage, use and transfer, in the company is carried out strictly in accordance with it.

Carrying out business activities, the company interacts with its counterparties through its employees. From time to time, to confirm their authority, she has to provide personal information about the staff.

For each such case, the company is obliged to obtain consent from the employee for the processing of personal data. In fact, this is the employee’s written permission to disclose strictly defined information. It must be remembered that this document is drawn up every time it is necessary to use his personal information.

Legislation provides the employee with the right to revoke this permission at any time. To do this, he must submit an application in writing.

The consent form for the processing of personal data is developed at each enterprise separately and is included as an annex to the Regulations of the same name. It is a template that is filled out by the employee, and then filed into his file by the HR department.

Roskomnadzor periodically has the right to inspect an enterprise in the field of personal data processing. One of the main documents that this body will require to provide is a statement of consent to the processing of personal data.

Sample of filling out consent to the processing of personal data

In the upper right corner, fill in the position of the manager and his full name, as well as the name of the company. The title of the document is written below.

The employee, in the first person, fills out his personal information, registration address, as well as his passport data - number, series, date and the authority that issued the identity document.

When filling out the consent, it is advisable to include a link to the legal acts in accordance with which it is drawn up.

The following indicates who has the right to work with personal data, the purpose of their processing, and who is allowed to provide it. If you need to provide information to several organizations, it is advisable to fill out separate forms for each of them, rather than combining everything together. Also at this point it is necessary to consider in detail the list of actions that can be performed with this data.

Below, the employee writes down a complete list of personal information that he allows to work with. Here not only the employee’s personal data can be indicated, but also the amount of his salary, length of service, information about professional achievements, etc.

Then you need to fill in information about the time period during which this document will be valid, that is, the start and end date.

The consent must contain a clause according to which the employee has the right to revoke it if his information is used incorrectly.

The document is signed by the employee himself with a description of his position, full name.

The date of its registration is indicated below.

Nuances

It is advisable to include a clause in the consent to the processing of personal data stating that the employee has been explained all his rights and obligations regarding the protection of personal data.

The employer, as well as its officials, may be subject to administrative (fine 4,000-5,000 rubles), criminal (up to 5 years in prison), civil (compensation for material and moral damage) liability for the unlawful disclosure of an employee’s personal information.

Personal data of an individual is any information about him (passport information, marital status and place of work, age, etc.). Often such information is disclosed by the employer in the course of its activities. Despite the fact that this is not a violation by law, many people are interested in protecting information about themselves, and Russian legislation obliges the employer to provide such protection.

Federal Law “On Personal Data” No. 152-FZ was adopted on July 27, 2006, the last changes and additions to the document were made on September 1, 2015. According to this document, personal data can be processed, stored and transferred to third parties only with the consent of the subject.

But at the same time, the law does not always oblige to keep such information secret, dividing all personal data into three categories:

1. Special (nationality and religion, relationship with the law, information about health status and partly information about work).
2. Biometric (data relating to appearance and physiology).
3. Publicly available basic personal data (full name, date of birth, gender and other passport data).

For the processing of information of the third category, the consent of the carrier is not required. It is also not required when processing, storing and transmitting data of the first two categories in such exceptional cases as establishing the identity of a person in the absence of documents, as well as during any operational search work.

According to the law, every enterprise has an internal document that would stipulate what exactly is considered personal information, in what cases it can be transferred and disclosed, and an employee entering work at the organization must be familiarized with such a document and must give his consent to data processing.

Employees should not treat this information as materials that can somehow be used against them, since the harsh phrase “processing of personal data” actually only means the use of personal information (category 3) to process:

• employee salary card or account;
• powers of attorney to provide interests of the company or to receive material assets;
• accounts;
• contracts;
• outgoing letters of various types.

But at the same time, the employer is obliged to limit access to such data, providing it only to persons responsible for storing and processing this information. Such employees must also be competent to fill out the appropriate forms, which constitute the employee’s formal permission to use the information. This document must be drawn up each time the data is used and is valid for the period specified in it.

Example of filling out a consent form

The consent form for the processing of personal data can be drawn up according to the sample provided on our website, but if necessary, minor amendments and changes in design can be made to it. Full name is written in the upper right part of the form. and the position of the person in whose name the document is drawn up, and the name of the organization is also indicated.

Read also:

Employee personal card, sample filling (form T 2)

Next, write the heading “Consent to the processing of my personal data,” after which the employee’s passport information is indicated and the details of the organization giving the permission are written down. A reference to Federal Law No. 152-FZ is required.

After this, the purposes for which the organization intends to use personal information, as well as the information itself, are listed (this can be either personal data or specific facts regarding the employee’s field of activity). In some situations, personal data may be provided to several different institutions, and in this case it is not necessary to list them in one document: a separate form is drawn up for each.

At the end of the form, the period during which the document is considered valid is indicated, as well as a mention that the employee has the right to revoke his permission. After this, enter the employee’s position, his full name, signature and date of drawing up the form.

In some cases (for example, at the request of government agencies), the employer has the right to do without drawing up such a document. If an employee believes that information about him was transferred to third parties unlawfully, he has the right to file a complaint with Roskomnadzor. If the illegal transfer of personal information is confirmed, the employer may face punishment (fine or imprisonment).

The conclusion of an employment relationship between an employee and an employer obliges the latter to properly collect, systematize, accumulate, update, store and use any information relating to a specific employee or allowing him to be identified. Such information is combined under the concept of personal data, and the listed processes and operations are called processing. At the legislative level, both terms are defined and regulated by the Constitution of the Russian Federation, as well as Chapter 14 of the Labor Code of the Russian Federation. A sample permission to use personal data, which you can download below, is a mandatory document that must be issued to each employee and signed by him. In case of its absence, the company will face a fine.

Composition of the employee's personal data

Legislative documents do not contain a strict listing of personal data. As a rule, the employee provides the following information to the employer:

• about education;
• labor and general experience;
• family composition;
• military registration;
• wages;
• social benefits;
• position held;
• having a criminal record;
• address at the place of registration and residence;
• contact numbers;
• places of work or study of family members;
• terms of the employment contract;
• availability of declared material assets;
• materials on advanced training, retraining, certification and internal investigations and others.

What is a sample application for permission to process personal data?

First of all, this is the resolution itself, no matter how trivial it may sound. Work with information should begin by obtaining the employee’s consent, the need for which is dictated by clause 1 of Art. 6, which states that “consent... may be given by the subject... or his representative in any form that allows confirmation of the fact of its receipt, unless otherwise provided by Federal Law.” The employer is recommended to develop a permission form for the processing of personal data, which should contain:

• FULL NAME. and passport details of the employee or his representative;
• full name and address of the employer;
• purpose of information processing;
• list of data to be processed;
• validity period of the permit;
• ways to withdraw consent;
• employee signature.

Sample permission to process personal data

Why is consent to processing during employment formed?

In fact, the employer gets access to the employee’s personal data at the time of reviewing the resume or application form, i.e. before official employment. Consequently, from this moment the employer can be involved, in accordance with Art. 90 of the Labor Code of the Russian Federation, to administrative, disciplinary or criminal liability in case of incorrect handling of the information received. To protect the interests of both parties, it is first necessary to provide the employee with a sample application for permission to process personal data for review. The corresponding document must be signed before concluding an employment contract.

If the employee refuses to sign the consent

In accordance with paragraph 1 of Art. 9, the provision of data about oneself is given by the subject voluntarily. Thus, an employee has the right not to give consent if the use of data about him is not directly related to the performance of job duties. In other words, refusal to sign a permit cannot interfere with labor relations. Moreover, it is not required when it comes to transferring information to the Pension Fund of the Russian Federation, the tax service and other bodies established by law. However, in practice, refusal may result in the inability to carry out work activities, for example, when the employer has established a pass regime.

How to properly organize work with personal data in an organization, video

Express your opinion about the article or ask the experts a question to get an answer

Often a person has to fill out various forms with personal data, submit documents to carry out the necessary checks and enter them into various official papers, etc.

Dear readers! The article talks about typical ways to resolve legal issues, but each case is individual. If you want to know how solve exactly your problem- contact a consultant:

APPLICATIONS AND CALLS ARE ACCEPTED 24/7 and 7 days a week.

It's fast and FOR FREE!

Thus, his personal data ends up with another person (employer, school, bank, etc.), but the law seeks to protect the confidentiality of such information.

Personal data can be processed only with written consent.

What it is

In certain situations, each person needs to fill out various forms, which include information about himself, and often passport data.

You also need to submit your documents to various organizations for paperwork.

Often this information refers to personal data, which means their processing is possible only with the written consent of the person.

Without this, you simply cannot do anything with this information, or it is better not to receive it at all.

Even in a school or kindergarten, parental consent is required for the processing of personal data of a minor.

Although without such processing it is simply impossible to organize the learning process itself, etc.

Often people claim that the employer or other organization does not have any consent to process the data.

Usually it's just their own carelessness. It is not necessary to fill out a separate form to give consent.

Questionnaires, surveys and other documents have long included a clause on consent to the processing of personal data. Only some organizations ask to write such a document on a separate sheet.

Although the processing of such information in most cases is more of a necessity, for example, without this, the employer simply will not be able to conclude an employment contract and pay the required taxes and contributions to insurance funds for the employee.

But obtaining consent is a must. Exceptions are possible only for the administration of justice, compliance with international treaties of the Russian Federation, etc.

Various criminals often try to obtain personal data. They are actively used in fraudulent schemes and other types of crimes.

It is for this reason that the processing and confidentiality of this information is regulated at the legislative level.

Legislation of the Russian Federation

For quite a long time, practically no attention was paid to issues of personal data in legislation.

But in 2006, Federal Law No. 152-FZ was adopted. It was he who gave the basic definitions, and also established the processing procedure and identified other important points regarding personal data.

With many changes, this legislative act still fulfills its functions today.

Main terms

When dealing with the issue of protecting confidentiality and processing of personal data, you need to know at least the basic terms related to it.

The main concepts are given in Article 3 of Federal Law-152 and it is this that should be carefully studied.

Let's consider the most important terms used in legislation and specialized literature devoted to the protection of personal data:

Categorization

In fact, the legislation does not describe any specific classification of personal data.

Although some of them are separated into separate categories due to the peculiarities of their processing.

But still, studying Federal Law No. 152-FZ, we can conditionally divide all data on a person into three categories.

We provide information about them in the following table:

Exceptions include some situations in law enforcement, judicial, medical institutions, etc.

What is the penalty for disclosure?

The legislation establishes liability for those who disclose personal data.

For such actions, an administrative fine of up to 1,000 rubles is provided for ordinary citizens, and for officials - up to 5,000 rubles.

But such fines may not have sufficient force and the law establishes criminal liability in certain cases.

If personal data was disseminated through the media or was obtained illegally, then Art. 137 of the Criminal Code of the Russian Federation provides for up to 2 years in prison for the culprit.

And if official position was also used, then the period can be increased to 4 years.

Or the court may impose a fairly large fine for such a crime (up to 200-300 thousand rubles).

Although permission is granted to the organization, the responsibility will be borne by the person directly responsible for the disclosure.

A citizen whose data was disclosed has the right to demand through the court also compensation for moral damage in full.

But today there is practically no practice in such proceedings. People themselves pay little attention to the protection of personal data.

Yes, and law enforcement agencies often limit themselves to minimal administrative fines, fearing difficulties in proving guilt.

Video: changes since 07/01/2017 and consent form for the processing of personal data

Sample application for processing of personal data

You can download a sample application for the processing of an employee’s personal data. A statement of consent to the processing of minor's data can be downloaded.

It can be used when developing your own version of the document. It is imperative to understand that it must contain a specific list of data that is allowed to be processed and the purposes.

The subject may limit the validity period of the permit issued by him.

After the specified period of time, the operator will have to stop processing the data and also take the necessary measures to destroy it.

Document structure

Although the legislation does not establish any special requirements for the content or format of the application, and it can actually be drawn up in simple written form, it is recommended to adhere to the established structure of the document.

We present it in the following table:

Why is it necessary?

Mainly, consent is taken with the aim of protecting the rights and interests of the person himself (the subject of personal data).

This document describes the specific purposes and methods of data processing, and specifies all detailed conditions.

You need to understand that consent to data processing must be exclusively voluntary. Only in certain cases can they be processed without a person's consent.

The operator (employer or other organization) can work with personal data only if there is consent. Without it, there is a high risk of facing a fine or even criminal liability.

In fact, many organizations simply had to consider themselves data controllers and obtain consent.

Without this document, today it is not possible to draw up a new employment contract with an employee, etc.

Comment. For old employees, it is also advisable to obtain consent, although without it the employer can continue to process their data.

But it will actually be impossible to hire a new employee without permission to process personal data.

Is it possible to revoke consent?

Consent to the processing of personal data can be withdrawn at any time. The sample can be downloaded.

The operator (employer, school, government agency) will have to stop processing them and destroy them in cases prescribed by law.

But this does not mean that this right can be abused. For example, a borrower can submit an application to the bank to revoke consent to the processing of personal data only after full payment of all debts.

Similarly, the employer’s consent can be revoked only after dismissal.

Upon termination of the processing of personal data, they must be destroyed in all cases where the operator no longer has contracts with the person.

The most important means of protecting the rights and interests of a citizen is consent to the processing of personal data. The use of personal information is applicable to almost all areas of activity.

Legal regulation of the procedure for disseminating such information is carried out within the framework of the Federal Law of July 27, 2006 No. 152-FZ “On Personal Data”. This regulatory act regulates in detail:

• List of information related to the citizen’s personal data;
• Basic conditions for the use, processing, storage and protection of personal information;
• Rights and obligations of participants in legal relations regarding working with the specified information;
• Responsibility for violation of the conditions for the protection of personal information of citizens.

The main condition for the use of personal information is the citizen’s consent to the processing of personal data. Its content depends not only on the composition of such information or the identity of the person, but also on the circumstances under which it is issued.

Employment in any institution requires a citizen to provide a number of mandatory and additional information, most of which fall under the definition of personal data. The list of mandatory information is regulated by labor legislation; without its provision, it is impossible for labor relations to arise:

• Information about the identity of the employed citizen, his passport details;
• Information about the number of the insurance certificate of compulsory pension insurance (SNILS);
• Work record book and information about the length of service contained in it;
• Military registration information for persons liable for military service;
• Education data.

Important! In some cases, a citizen is required to provide other, additional information, without which it is impossible to formalize an employment relationship. Such data includes criminal records, biometric information, medical examination data, as well as a number of other information and documents.

Any information that is directly or indirectly related to a citizen is part of his personal data, therefore their use requires consent from the subject of the specified information.

At the employment stage, when drawing up an employment contract, an individual not only submits an application for employment, but also signs consent to the use and processing of his personal data by the employer. This document, signed by the citizen, is stored in the employee’s personal personnel file and is the basis for working with his personal data during the term of the employment contract.

The sample consent for the processing of such data may differ depending on the specifics of the organization’s activities. If a potential employee refuses to give the said consent in writing, the establishment of an employment relationship is impossible.

For the visa

The list of information provided for processing and issuing a visa to a foreign country, or from foreign citizens wishing to enter the territory of the Russian Federation, may differ based on the purposes of processing visa documents, as well as the country of intended visit. However, most of such information is subject to regulation by Federal Law No. 152-FZ:

• Information about the identity of the applicant and his documents;
• Information about the applicant’s place of work and income;
• Information about the citizen’s marital status;
• Biometric data required by most visa centers.

When submitting the specified information and documents for obtaining a visa, the applicant also signs consent to the processing of personal data.

Note! This form is provided by the visa center or consular office of a foreign state, but the content must comply with the requirements of Federal Law No. 152-FZ.

In this case, the operator for processing information of a personal nature will be the embassy, ​​consulate or visa center. The consent to the processing of information will apply to delivery services for completed visa documents.

For a minor

With regard to the protection of personal information about minor children, there is a special procedure for the use, processing and storage of their personal data. Since full legal capacity and legal capacity of citizens occurs upon reaching the age of 18, minor children cannot fully understand the consequences of the misuse of their personal data.

For this purpose, the legislation provides that consent to the processing of personal information regarding children is given by their legal representatives (parents or other persons recognized as legal representatives). Registration of such consent is carried out in the process of representing the interests of a minor child in various authorities and organizations.

Note! Consent to the processing of such information can be provided only by one of the child’s parents.

The composition of information of a personal nature may vary depending on the gradation of the child’s age - up to 14 years (young children) and from 14 to 18 years (minor children). Refusal to formalize this consent may significantly limit the child’s ability to participate in public, social and cultural events.

For school

During the period of study in secondary schools, the interests of a minor child are represented by his legal representatives, who are required by law to obtain consent to the use and processing of personal information.

Starting from the moment of enrollment as a student and ending with the issuance of documents on the successful completion of the educational process, every legally significant action involving a minor student requires consent to work with his personal data. Such consent is drawn up in the form prescribed by a specific educational institution or an authorized authority in the field of education.

Important! Giving consent to the use and processing of a child’s individual data is the right of legal representatives, and not their obligation.

In addition to general information about the identity of a citizen, personal information about a minor child includes:

• Information about the completion of education (data on academic performance, information on participation in olympiads, etc.);
• Data on the student’s medical indicators obtained during the education process;
• Information about his relatives;
• Information about cases of prosecution for offenses.

Consent to the processing of individual information about a child is kept by the school in the student’s personal file.

Duration of consent

To avoid cases of abuse of citizens' rights, consent to the use of personal information is temporary.

Note! Federal Law No. 152-FZ provides for the right of citizens to withdraw their consent to the processing of personal information at any time.

When issuing consent, its validity period can be set in the following ways:

• An indication of the specific validity period of the consent;
• An indication of the moment of termination of its validity period (for example, the moment of termination of the employment relationship);
• An indication of the expiration date of the consent in cases expressly provided for by law.

The use and processing of such data after the expiration of the consent period is illegal, except in cases expressly provided for by regulations. For violation of these rules, the perpetrators are subject to administrative or criminal liability.