Data protection law?

Question

Law in IT

As a consumer, they offer me to fill out various questionnaires, where the very item “Consent to the processing of Persian. I give data. So, I constantly cross out “I give” and write “I don’t give” on top of it.
Question - if I do not consent to the processing of personal data, can they transfer this data to third parties and can they use it themselves? Let's say it will be 1) advertising by SMS or 2) collection of stats. data of "refused to collect personal data". And 3) the question is whether they can refuse to provide services to me if I refuse to collect (they have no right to do so if there is money).

Answer 1

I will add to De Jure:
1. It is impossible to transfer to 3 persons without your explicit consent.
2. Processing is any action with your data (including reading them from the questionnaire) in paper form. In the Federal Law on this point, there are no indications of the DBMS at all.
3. Data can be de-personalized (i.e. not associated specifically with you) - then they cease to be personal and do not fall under the Federal Law.
4. The law also defines different types of data (confidential, personal, obtained from open sources and depersonalized) and the requirements for them are different for processing and storage.
De Facto:
KMK - all this does not work yet.

Answer 2

De Jure
1) cannot, because technically, such advertising requires entering data into the database, which is processing that you “opted out”.
2) theoretically they can work with the questionnaire, without entering data into the database. For example, send something by regular mail, using a paper registry (if it's funny, I assure you that many state structures still do this).
3) Depends on the legal side of the contract (if there is a clear line about the refusal of services “refusing to transfer data”), and on the technical implementation of the services themselves (after all, most of them involve working with databases).
De facto
Most often, such questionnaires do not go through the lawyers of the company, and most likely the manager will simply ignore your competent “refusal”, and the data will be transferred to be entered into the DBMS.
Judicial practice (at least loud) in this direction has not yet been.

Answer 3

Usually, in firms, the form of the contract is standard, verified by their lawyers, etc.
If you make corrections to it, no one on the part of the company will most likely conclude such an agreement, respectively, your data will not be entered into the database, but the questionnaire will not be taken into account.

Answer 4

By filling out the questionnaire and entering PD into it, and then transferring it to someone, you are already independently initiating the processing of PD. In this case, all your notes about the refusal do not make sense.
By concluding contracts for the provision of services, you automatically agree to the processing of PD, since without knowledge of the PD, the other party to the contract will not be able to execute it.

Answer 5

and can they use it themselves?

Article 6. Conditions for the processing of personal data
...
2. The consent of the subject of personal data provided for in paragraph 1 of this article is not required in the following cases:
...
2) the processing of personal data is carried out in order to fulfill the contract, one of the parties to which is the subject of personal data;