Personal data protection in Russia in the light of the delegated legislation

The recent reforms of the Russian data privacy laws demonstrate the enhancement of personal data protection guarantees and, at the same time, enable to trace a trend towards vesting the lawmaking authority necessary to ensure them in the Federal Supervisory Service for Communications, Information Technology and Mass Media. The regulatory framework including federal laws and delegated legislation is to be considered within the framework of the right to personal data protection, and regard to the constitutional requirements for the delegation of lawmaking authority. The analysis of the legislation entrusting the Federal Supervisory Service for Communications, Information Technology and Mass Media with regulatory powers, as well as the delegated legislation reveals its inconsistency with the principle of legal certainty, which is an essential element for adequate data protection. The Russian delegated legislation in some cases leads to the weakening of the personal data protection guarantees and unjustified restriction of the data controllers’ rights and legal interests.