What is considered "collection of information" in terms of 152-FZ (law on personal data)?

Question

Information Security

152 FZ defines what personal data processing is. But it is not clear what is meant by collection? Let's say there is a website or a mobile application, it has a personal account with arbitrary fields (such as tell us about yourself, like on a toaster). If a person enters his full name and passport data there, is this considered a fee and then does this site / mobile application fall under the ISDN and is it necessary to take measures under 152 FZ? That is, it is clearly not requested from him. I would like to see a line of law and judicial practice. And, if, nevertheless, a person has driven data there, should the owner of the resource monitor and clean it?

Answer 1

In short, no, the case you described does not fall under the violation of 152-FZ.
More:
Usually, the definition of the newly introduced or refined terms is contained within the law itself.
In 152-FZ, there is Art. 3., Clause 1:

personal data - any information relating directly or indirectly to a specific or identifiable natural person (subject of personal data);

and item 3:

processing of personal data - any action (operation) or a set of actions (operations) performed ... with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data;

Yes, the wording is very vague, and this allows the law to be manipulated in the interests of those authorized to make decisions on this issue. Those. in two [conditionally] identical circumstances, two diametrically opposed decisions can be made, and both can be quite legal.
But the situation as a whole is as follows: if you pull an owl on a globe and stick to a pole, then you can try to interpret the filling in by the user of a column like "About me" with information containing passport numbers or even just a full name, as a record and storage (i.e. processing) personal data site.
However, if it comes to real proceedings, then the site has (should have) rules of use. Usually, by default, it says that the user himself is entirely responsible for user generated content. Moreover, the user officially agrees with this, because. put the corresponding checkbox during registration.
Accordingly, the user can write his passport number with his full name, as he can write anything like "kill the infidels" or "take out a weapon and seize the Duma." Yes, the site should remove this to the extent technically possible, and preferably on its own initiative. But the owners are not responsible for the very fact of the publication of such content by users. Only for inaction upon discovery
- and then on the condition that the content is clearly illegal.
Now, if the RKN officially decided to remove the content / close the general access to the page, etc., and the site did not do this on time, it will fly by the header. Otherwise, no, the voluntary inclusion of a passport in "About Me" by users does not bring the site under 152-FZ if:
1) The rules of use are correctly drawn up
2) The site clearly did not require the input of personal data ("your name" != "what written in the passport")
3) The person whose data was posted does not require their deletion.
Here, for example, the rules of the Toaster itself. There, from the very beginning, reinsurance from all sides is just for your question.
Of course, it cannot be 100% guaranteed, because we all periodically see news about strange and controversial court decisions handed down by Russian courts. But in general, there will be no problems.