Russia's State Duma on October 14 passed bill No. 404786-8 in its second and third readings, allowing banks and other financial institutions to transfer restricted information, including clients' personal data and information covered by banking secrecy, to external service providers.
Separate consent from clients would not be required for such transfers.
The legislation significantly limits the types of organizations eligible to process the information. Russian banks will be allowed to transfer data to accredited IT companies and certain banks with universal licenses that are under Russian control. Other categories of financial institutions will have their own lists of eligible service providers.
In ordinary cases, the contractor's information systems must be located in Russia.
A financial institution must notify the Bank of Russia in advance before engaging a contractor and submit the results of an operational audit. Data transfers may begin 60 days after notification unless the central bank prohibits the use of the particular provider.
A separate exception applies to Russian banks controlled by foreign banks. They will be allowed to outsource data processing to a foreign bank, but doing so will require approval from the Bank of Russia, the Federal Security Service and Rosfinmonitoring.
The rules cover not only banks but also insurers, private pension funds, microfinance organizations, credit bureaus and several other participants in the financial market.
The legislation does not mean the new system takes effect immediately. After the remaining legislative procedures are completed, the law is due to take effect one year after its official publication.