The Supreme Court refused to recognize email and phone number as personal data

Intrusive ads will now become even more

Email is not personal data. This is the conclusion reached by the Supreme Court. Moreover, the benefits of a phone number for identifying a particular person, too, the cat cried. This means that all sorts of companies can collect this information about Russians as much as they like and in any way they like. Cybersecurity experts fear that Themis’ new position could untie the hands of companies attacking citizens with cold calls.

The dispute between the Moscow insurance company and Roskomnadzor forced the judges to take a fresh look at the problem of personal data of Russians. The auditors forced the company to remove a feedback form from its website, in which page visitors were asked to enter their e-mail and phone number. The RKN reasoned that this was the collection of personal data, and illegal. After all, the company did not have any storage systems and cyber protection.

However, judges of three instances, up to the Supreme Court, sided with the insurers. They did not find any violations and made a very curious conclusion: email and phone number are not personal data at all.

According to the courts, it is impossible in principle to identify a specific person only by e-mail and phone number. First, the address and phone number can be corporate. Secondly, by themselves, these data are not enough to accurately verify the identity of a citizen.

“The totality of data does not provide the ability to accurately determine the specific individual who owns the phone number and email address, since the form does not imply the provision of full “Last Name, Middle Name” and / or other identifiers, such as “Identity Document Number”, “TIN” , “SNILS”, “Date and place of birth”, – indicate the judges in the decision.

Officials tried to convince the courts that email and phone number have two properties that allow them to be treated as personal data – uniqueness and immutability when assigned. However, these theses also did not survive.

“In case of termination of the user agreement with the electronic mail service, removal of the electronic mailbox from the server (for any reason), exactly the same email address for the new user can be registered in the same domain, as well as in the event of termination of the contract with the telephone operator communication, the telephone number can be transferred to a new subscriber,” the decisions emphasize.

Cybersecurity expert Yevgeny Lifshits told MK that from a technical point of view, e-mail and phone number really cannot be a 100% guarantee of accurate identification of a person. This means that they cannot be considered personal data.

– E-mail definitely cannot be an element of personal data, – said Lifshitz, – A citizen can only be identified in conjunction, for example, e-mail plus passport data. You can create as many email addresses as you like. Moreover, when you start a “box”, there is a limitation: if you do not use it for a long period of time, the server automatically deletes it. After that, exactly the same address can be registered by a completely different person.

According to the expert, the Supreme Court and lower instances gave the correct interpretation of the law. But this does not mean at all that the e-mail addresses of Russians do not need to be protected. They regularly become the object of interest of hackers and leak into the public domain. If, for example, bank cards are tied to a stolen e-mail box, the consequences for the victim of cyber fraud can be dire themselves. But this is not the only problem. Leaving an email or cell phone number on a seemingly harmless site can lead to an uncontrollable flurry of advertising calls, information security expert Igor Masalovich notes.

– Companies have mastered a new trick with “cold calls”. You want to buy an apartment and go to the developer’s website. There you are offered to indicate a phone number and e-mail to receive a catalog with apartment options. As a result, you, of course, do not receive any catalog. Instead, various companies begin to call you advertising their services. Legally, everything is clean, because you yourself left your phone number and mail on the site. But there is nothing good in this. This issue requires state regulation, – the expert is sure.