Vkontakte API: users.get and personal data protection?

Question

In contact with

There is a website, the general meaning is this: look, they are fools and VKontakte profiles are posted. Visually, it is a wall of avatars signed with the name, surname, country, city. When switching to one of the profiles, additional data appears on the page: university, faculty, date of birth, home phone (if any), mobile phone (if any), status.
The collection of all data is carried out by a PHP script, it loads users from certain VK groups using the users.get method. Only the information that is available to unauthorized applications is obtained. In reality, 95% of profiles contain only the first name, last name, profile picture (link to the VKontakte server), country, city. Users either hide the rest of the data or write nonsense (phone: SAMSUNG). There is a search on the site (just a string, it searches for all parameters at once)
Any user can log in and either delete their profile or add someone else's. The process is in 1 click, without any monetization and other things.
In connection with the functioning of this site, the question arose - is it legal to collect and store such information?

Answer 1

As has been repeatedly said in the light of 152-FZ about such cases:
"If they want, they will find a violation, if you have a competent lawyer, turn it down."
The fact is that even the last wording of 152-FZ says that personal data is such a set that allows you to uniquely identify the subject - everyone starts from this phrase (only from different angles).
In the aspect of your question:
- "Kuznetsov Alexander, Moscow" - definitely? No !
- "Aristarchov Savvaty, Great Boulders" - definitely? Yes !
If you have at least one unique line (and the probability of this is very, very high) - you have violated 152-FZ (without consent from the subject or instructions from the source operator).
According to my feelings, on average, out of 10 courts under 152-FZ, 9 end in favor of the supervisory authorities, the remaining 1 is a case of involving a competent lawyer (in your case, you can probably refer to a) public availability, b) unreliability, etc. - but it's not easy.)
By the way, one sensational extreme came to mind:
One of the courts in St. Petersburg even recognized the combination of full name and passport data as not being part of personal data, on the basis that the series and number of the passport are a characteristic of a specific paper document ("booklet"), and not a person.
Unfortunately, we do not have case law.