Personal data and public offer

Question

Data recovery

And so, we have:

Federal Law of 06.04.2011 N 63-FZ "On Electronic Signature"

Article 5. p. 2 A simple electronic signature is an electronic signature, which, through the use of codes, passwords or other means, confirms the fact of the formation of an electronic signature by a certain person.

Article 6. Clause 2 Information in electronic form, signed with a simple electronic signature or an unqualified electronic signature, is recognized as an electronic document equivalent to a paper document signed with a handwritten signature, in cases established by federal laws, regulatory legal acts adopted in accordance with them, or agreement between participants of electronic interaction.

Article 9. Use of a simple electronic signature
1. An electronic document shall be considered signed with a simple electronic signature if one of the following conditions is met:
1) a simple electronic signature is contained in the electronic document itself;
2) the key of a simple electronic signature is applied in accordance with the rules established by the operator of the information system using which the creation and (or) sending of an electronic document is carried out, and the created and (or) sent electronic document contains information indicating the person on whose behalf an electronic document has been created and (or) sent.

Federal Law of July 27, 2006 N 152-FZ (as amended on December 23, 2010) “On PERSONAL DATA”

Article 9. clause 4 In the cases provided for by this Federal Law, the processing of personal data is carried out only with the consent in writing of the subject of personal data .Equivalent to the written consent of the subject of personal data on paper containing a handwritten signature is the consent in the form of an electronic document signed with an electronic digital signature

In total we get:

EDS - password, login, our algorithm (63-FZ art. 5, 9)
Electronic document - the same agreement or contract signed with an EDS indicating the full name and phone number in the document (it will not be difficult to check the phone during registration) (63- Federal Law Articles 5, 9)
Agreement between the participants of electronic interaction - an offer on the site accepted by the user during registration (usually it looks like "I agree with the terms ...")

Description of the registration process:

1. When filling in the details during registration, two checkboxes “I agree to the processing of my personal data” and “I agree to the terms of the agreement”
2. After pressing the “Registration” button, a code is sent to the phone and prompted to enter it to confirm the number
3. After confirmation numbers, a simple EDS is formed, 2 electronic documents “Agreement for the processing of PD” and “Agreement between participants in electronic interaction” are signed with it, the documents are neatly folded on and stored on the operator’s server.

In this way, we get away from the need to obtain consent in writing.

Is everything completely legal? Or am I missing something?

Answer 1

Of course they missed it:
Here is the situation:
1) some Pindos enters someone else's personal data into the registration form and
puts two checkmarks
2) a confirmation code comes to the phone with a Ukrainian number, which the Pindos enters
3) then an EDS is formed on the server, documents are signed, added to the server and stuff like that
4) then this data starts to be used, and the PERSONAL DATA CARRIER finds out about it 5 )
he writes a cart to the FSB / FSTEC / Putin that YOU are illegally using his data
6) the mask show starts, they come and take the SERVER for verification