Withdrawal of consent to the processing of personal data - procedure, documents, sample, consequences

When is data revocation required?

As a rule, the need to revoke consent to the use of personal information arises when it comes to transferring it to third parties. For example, an employee, for some reason, no longer wants information about him to be posted on the company website or used in advertising materials. In another case, an applicant for a vacant position may change his mind about participating in the competition and prohibit the transfer of data to the security service. Often, a client of an organization wants to unsubscribe from receiving SMS or email messages. The most pressing situation is providing collectors with personal information about the bank borrower. One of the ways you can try to protect yourself is to revoke permission to process personal data.

Why is personal data withdrawn?

We transfer personal data when we get a job, take out a loan, or draw up any documents or certificates. Specifying an email address on the Internet in order to receive the newsletter will also constitute the provision of personal data.

To use such information, formal consent to storage and processing must be requested. When, by sending personal data through a website on the Internet, we check the box “I agree with the site’s privacy policy and user agreement,” we allow our data to be stored and processed.

Consent to use can be revoked by sending a statement to the operator - the person processing the data. It is possible to revoke permission to process personal data at any time at the request of the data owner. This measure will be required to:

avoid transferring information about yourself to third parties, for example, such a ban will make it impossible to transfer data about a citizen from the bank to a collection agency;
stop receiving newsletters;
personal information was not used for advertising purposes, for example, in the “our clients” section.

When revoking a permit, a citizen is not required to explain the reason.

What the law says

The possibility and procedure for revoking consent to the processing of personal data are described in the Federal Law of July 27, 2006 No. 152-FZ “On Personal Data”. Let's look at the consequences of withdrawing consent to the processing of personal data.

After receiving an application to prohibit the use of personal information, the operator is obliged to stop working with the data and, if possible, ensure its destruction. The period within which the operator must fulfill this obligation, in accordance with clause 5 of Art. 21 of Law No. 152-FZ, does not exceed thirty days. But Federal Law imposes certain restrictions on the revocation of permission to process information. For example, the operator, despite receiving the revocation of permission, processes and transmits data if this is necessary for the administration of justice (Clause 2, Part 2, Article 11 152-FZ) or protecting the life (health) of the subject (Clause 6, Part 2, Art. 152-FZ) 11 152-FZ). In addition, work with information continues regardless of the cancellation of permission to ensure pension payments, payment of taxes, compulsory medical and social insurance.

When can you withdraw consent?

The procedure for working with personal information is established by the Law “On Personal Data” dated July 27, 2006 No. 152-FZ.
From Art. 3 of the law it follows that individual data of a person includes any information about him that allows him to be identified. This information may include:

FULL NAME.;
residential address;
passport details;
information about place of birth;
other data.

The law does not contain a complete list of information; accordingly, in each specific case it is necessary to analyze whether it is possible to identify him or not using the information received from a person. Often, individual data is not personal because it is impossible to understand who exactly it belongs to. However, if the totality of information allows you to find out which person it relates to, then this is personal data.

Work with personal information is carried out on the basis of the written consent of the citizen whose information will be processed. There is no established form; each organization independently develops an agreement form for the processing of personal materials, which is signed by the citizen. Only after the subject has signed such a form, the institution has the right to begin working with information about the client.

Consent to processing can be obtained electronically using a simple electronic signature.

A citizen has the right to withdraw his consent to the processing of personal information at any time (Clause 2 of Article 9 of Law No. 152-FZ). Moreover, the legislator does not connect the revocation of personal data with any conditions or events. From which it follows that refusal to process personal data does not require justification.

What is the period for the destruction of personal data by the operator upon achieving the purpose of processing personal data or upon withdrawal of consent to their processing? The answer to this question is in ConsultantPlus. Study the material by getting trial access to the K+ system for free.

When withdrawal of consent does not matter for the personal data operator

Meanwhile, the operator can continue to work with the subject’s personal information materials even if the latter revokes his consent. The list of cases when he has such a right is specified in paragraphs. 2–11 hours 1 tbsp. 6, part 2 art. 10, part 2 art. 11 of Law No. 152-FZ. In particular, information about a person can be used by:

courts with the participation of a citizen in legal proceedings;
bailiffs in the execution of a judicial act;
government bodies in the exercise of their powers;
parties to civil contracts concluded with the subject of personal data;
any subjects, if necessary, to protect the life or health of the bearer of personal information;
journalists, if working with personal information is related to their professional activities;
entities involved in the implementation of international treaties;
statistical authorities, if personal data is anonymized.

Whether the processing of personal data by tax authorities without the consent of the subject of personal data is legal, find out in ConsultantPlus. If you do not have access to the K+ system, get a trial online access for free.

How to write an application for revocation of personal data

In order to revoke permission to use personal data, it is enough to send a corresponding application to the operator - this is the only way to revoke personal data provided by law. The application is written in free form; it is recommended to indicate the following points:

full name of the organization;
legal address, as well as the actual address of the branch, if we are talking about a bank;
applicant details: full name, passport details, registration address;
reference to legislative acts.

It is best to submit the application in person, in two copies. One copy, with a mark on registration of incoming documentation, remains in the hands of the applicant. If the application is sent to the bank, a photocopy of your passport and loan agreement should be attached to it.

Sample withdrawal of consent to the processing of personal data from an employer in 2021.

Procedure for revocation of individual data

Since citizens are often faced with the issue of permission to work with personal information, the natural question is how to revoke consent to the processing of personal data.

The step-by-step procedure is not prescribed in the legislation. Since permission to process information is given in writing, you must revoke consent by submitting a written application to the operator.

Refusal of consent to the processing of personal data is prepared in free form. You can submit your application to the institution:

Personally to the office or reception of the organization. In this case, it is necessary to prepare two copies of the document. On one of them, the organization will put a mark of receipt upon acceptance.
By postal correspondence (registered mail with notification). In this case, confirmation of receipt will be a notification returned to the sender.
In electronic form. For example, if consent to the use of personal information that the user provided to the operator via the Internet (for example, on the website) is revoked.

It is very important to confirm the date the operator received the request, since from this moment the period will begin during which the operator for processing individual information will have to stop working with the declared information.

How to organize the destruction of personal data

After the operator receives a withdrawal of consent to processing from the owner, he has a certain time to organize and destroy information about their owner. Destruction of personal data is such actions of the operator as a result of which the material media with this information are either completely destroyed (paper) or, if the information is stored on machines, they are erased so that it is impossible to restore the source (see subparagraphs 3, 8 of Article 3 of the Federal Law dated 07.27.2006 N 152-FZ).

Destruction period

Time to perform	Grounds for liquidation	Link to the norm of the Federal Law of July 27, 2006 No. 152-FZ
7 working days	When the PD subject or his representative provides information confirming that the data was illegally obtained or is not necessary for the stated purpose of processing	Part 1 Article 14, Part 3 Article 20
10 working days	When identifying illegal processing of personal data, if it is impossible to ensure its legality	part 3 of article 21
30 working days	Upon achievement of the purpose of PD processing	part 4 of article 21
30 working days	When the PD subject withdraws consent, if their preservation is no longer required for processing purposes	part 5 of article 21

Nuances

If it is not possible to destroy personal data within the period specified in the table above, the operator is obliged to block this information and destroy it within a period not exceeding 6 months, unless a different period is established by another law (see Part 6, Article 21 of the Federal Law of July 27, 2006 No. 152-FZ).

Latest Initiatives

On August 1, 2021, the Ministry of Telecom and Mass Communications prepared draft amendments to Federal Law No. 152-FZ dated July 27, 2006. The innovations concern the procedure for clarifying the requirements for the destruction of personal data. Thus, Article 21 of the Federal Law of July 27, 2006 N 152-FZ establishes the operator’s obligation to eliminate violations of the law committed during the processing of personal data, including the destruction of personal data. However, this norm does not contain requirements for the destruction of the data itself.

In order to eliminate this conflict, the Ministry of Telecom and Mass Communications proposed adding Part 7 to Article 21 with the following content:

“The destruction of personal data in the cases provided for in this article is carried out in accordance with the requirements established by the authorized body for the protection of the rights of personal data subjects.”

According to officials, the change is aimed at eliminating conflicts regarding the destruction of personal data, and at eliminating the possibility of a diverse interpretation of the understanding of actions confirming on the part of the operator the fact of destruction of personal data.

Consequences of withdrawal of consent to the processing of personal data

Withdrawal of consent by an individual to the processing of his personal data is the basis for the operator-organization to terminate the processing of such person, as well as the destruction of all data of the person within 30 days when the corresponding withdrawal was received.

If it is impossible to destroy the data within 30 days for some reason, then the operator must block the information and then destroy it within 6 months.

BUT : do not forget that, in cases specified by law, despite the fact that the person has withdrawn his consent, the processing of personal data by the operator will continue without the consent of the person.

As can be seen from the above information, withdrawal of consent to processing does not always entail the operator stopping the processing of the relevant data of the person.

Who to write a statement to if the bank sold the debt to collectors

Before writing an application to revoke personal data permission, you need to understand who to address it to. Bank or collectors. That is, you need to understand at what stage the debt collection from the borrower is currently at.

The algorithm we described above can only be used if your borrower remains a bank. If the bank sold your debt to collectors, you need to act differently.

Calls from collectors coming to you do not yet confirm the fact that the bank has sold your debt.

The bank can enter into an agency agreement with debt collectors and transfer to them part of its rights under the agreement: telephone and written notifications to the debtor about existing overdue debts, collection of information about the debtor, etc. That is, the debt itself does not pass into the hands of collectors. They are hired by the lender as representatives of the bank's interests and are limited not only by the Law, but also by the terms of the contract.

If for some reason the bank does not want to independently collect the problem debt from you or classifies it as “unreliable,” then it can simply sell this debt to collectors by concluding an assignment agreement (assignment of the right of claim) with the collection agency. That is, under this agreement, the collection agency pays off your debt to the bank (usually this amount is less than what you owe the bank, because the collectors also have to earn money, and the bank is trying to return at least something, as they say, at least a tuft of wool from a black sheep) and becomes your new creditor. Now you no longer owe the bank anything. You only owe the collection agency, it is your new creditor. Therefore, all applications must be addressed to them.

The question of the legality of such a debt collection scheme remains unresolved to this day. If we talk about judicial practice, courts very often recognize the sale of debt to debt collectors as legal if the condition on the possibility of transferring the debt and the rights of the creditor to third parties was stipulated in the loan agreement.

When assigning your debt to collectors, the bank is obliged to notify you about this in writing by sending a notice to your address with a copy of the agreement for assignment of the right of claim attached. Until you receive these documents, collectors have no right to demand repayment of the loan from you.

From the moment you receive the documents indicated above, provided that the loan collection period has not yet expired, all applications, including an application for revocation of permission to process personal data, must be sent to the collection agency.

Returning to the conversation about the statute of limitations for repaying a loan, which we wrote about in detail in the article “The statute of limitations on a loan - how to calculate correctly and what to do in case of a lawsuit,” I would like to remind you that banks often sell debts to collectors whose collection periods are have already expired. And the bouncers’ further actions are unlawful.

Consent can be revoked from any data controllers

Let us recall that on December 30, 2021, Russian President Vladimir Putin signed a law prohibiting the use of publicly available personal data without the consent of its owner, as well as granting the right to demand that the operator delete it. The changes boil down to one important point - the concept of publicly available personal data will no longer exist. That is, now the consent of the subject of personal data is the “exclusive legal basis” for the processing of information made publicly available.

According to the new law, any citizen can contact any personal data operator with a request to remove his personal data from public access without proving the fact of unlawful processing. Moreover, the law will allow verification of the subject of personal data without additional identification procedures. The law also excludes possible cases of the operator collecting redundant personal data.

According to RIA Novosti, the law introduces a new procedure for deleting data at the request of a citizen - now the personal data operator must delete the specified information within three working days without requiring evidence from the user. The collection of evidence is transferred to the operator himself. If an online resource does not comply with a citizen’s request, it will be fined.

The hybrid work environment is addictive

Business

The adoption of the document may lead to other legislative changes, for example, an increase in fines for violations in working with personal data, as well as an extension of the statute of limitations for relevant offenses. TASS wrote about this, citing the words of the initiator of the bill, Anton Gorelkin .

Basic writing rules

The document (review) must be drawn up in accordance with all the rules of business correspondence. Like the previously provided consent to the processing of personal data, its revocation is a document that has legal force.

When writing a review, it is advisable to adhere to some rules:

Create a standard “header” - in which you indicate not only your first and last name, but also basic contact information. Proper execution of this part of the application will facilitate and speed up communication between the operator and the subject in the process of working on the recall, if necessary.
It is also mandatory to indicate on which legislative acts the request of the information subject is based. In our case, we will need to enter paragraph 2 of Article 9 of the Federal Law “On Personal Data”, adopted on July 27, 2009.
After the main part of the application, indicate the date of writing - 30 days must be counted from it - or the date of the intended submission of the application, if you go to the operator on a different day.
At the bottom, the PD subject puts his signature (even if the form itself has been printed).

Where and what documents need to be submitted

How to correctly formulate a refusal to further process personal information?

The application must include the following information:

Full name of the organization performing the functions of the operator.
Legal and physical addresses.
Last name, first name and patronymic of the citizen, as well as his address.
Citizen's phone number.
Link to the Law “On Personal Data”.
List of actions prohibited for the operator.
List of information to be deleted.
Requirement to notify in writing of the operator’s decision.
If necessary, indicate the possibility of contacting Roskomnadzor.

Step-by-step instructions for revoking consent to the processing of personal data:

Complete the application in two copies.
Make a copy of your passport and documents confirming the absence of debts and obligations if the operator is a credit institution or employer.
Visit the operating organization and obtain stamps and signatures on the forms.
In case of refusal, contact the Roskomnadzor office.
Send your withdrawal of consent by mail, using registered mail with mandatory return receipt requested.

List of documents required to complete the withdrawal of consent:

Completed application form in 2 copies.
A copy of the citizen's passport.
Documents confirming the absence of obligations to the operator.

Ensure that an employee of the organization must affix stamps and signatures on all accepted documents. This will confirm the fact that the operator has received the withdrawal of consent to process the citizen’s personal information.