1. General provisions
1.1. This Regulation on the processing of personal data of employees of the Municipal Budgetary Institution of Additional Education "Children's Art School of the Republic of Simai" (hereinafter the Regulation) has been developed in accordance with the Labor Code of the Russian Federation, the Constitution of the Russian Federation, the Civil Code of the Russian Federation, the Federal Law "On Information, Information Technologies and the Protection of Information", the Federal Law "On Personal Data", and the internal labor regulations of the Children's Art School of the Republic of Simai.
1.2. The purpose of developing the Regulation is to determine the procedure for processing the personal data of employees of the Municipal Budgetary Institution of Additional Education "Children's Art School of the Republic of Simai" (hereinafter the Children's Art School of the Republic of Simai); to ensure the protection of the rights and freedoms of employees of the Children's Art School of the Republic of Simai in the processing of their personal data, and also to establish the liability of officials who have access to the personal data of employees of the Children's Art School of the Republic of Simai for failure to comply with the requirements of the norms regulating the processing and protection of personal data.
1.3. Procedure for putting the Regulation into effect and amending it.
1.3.1. This Regulation enters into force from the moment of its approval by the director of the Children's Art School of the Republic of Simai and is valid indefinitely, until it is replaced by a new Regulation.
1.3.2. All amendments to the Regulation are made by order.
1.4. The confidentiality regime for personal data is lifted in cases of their depersonalization and upon the expiration of 75 years of their storage period, or is extended on the basis of a conclusion of the expert commission of the Children's Art School of the Republic of Simai, unless otherwise provided by law.
2. Basic concepts and composition of employees' personal data
2.1. For the purposes of this Regulation, the following basic concepts are used:
- employee's personal data - any information relating to a specific or determinable employee on the basis of such information, including his surname, first name, patronymic, year, month, date and place of birth, address, family, social, property status, education, profession, income, and other information necessary to the employer in connection with labor relations;
- processing of personal data - collection, systematization, accumulation, storage, clarification (updating, modification), use, dissemination (including transfer), depersonalization, blocking, destruction of personal data of employees of the Children's Art School of the Republic of Simai;
- confidentiality of personal data - a requirement mandatory for compliance by the designated responsible person who has obtained access to employees' personal data, not to allow their dissemination without the employee's consent or another lawful basis;
- dissemination of personal data - actions aimed at transferring employees' personal data to a certain circle of persons (transfer of personal data) or at making personal data known to an unlimited circle of persons, including the publication of employees' personal data in the mass media, placement in information and telecommunications networks, or provision of access to employees' personal data in any other way;
- use of personal data - actions (operations) with personal data performed by an official of the Simay Republic Children's Art School for the purpose of making decisions or performing other actions that give rise to legal consequences in relation to employees or otherwise affect their rights and freedoms or the rights and freedoms of other persons;
- blocking of personal data - temporary termination of the collection, systematization, accumulation, use, and dissemination of employees' personal data, including their transfer;
- destruction of personal data - actions as a result of which it is impossible to restore the content of personal data in the information system of employees' personal data or as a result of which the tangible media containing employees' personal data are destroyed;
- depersonalization of personal data - actions as a result of which it is impossible to determine the ownership of personal data by a specific employee;
- publicly available personal data - personal data to which an unlimited number of persons has been granted access with the employee's consent or to which, in accordance with federal laws, the requirement to maintain confidentiality does not apply;
- information - data (messages, data) regardless of the form in which they are presented;
- documented information - information recorded on a tangible medium by means of documentation, with details that make it possible to identify such information or its tangible medium.
2.2. The personal data of employees of the Simay Republic Children's Art School includes documents containing information about passport data, education, attitude toward military obligation, marital status, place of residence, state of health, as well as their previous places of employment.
2.3. A set of documents accompanying the process of formalizing an employee's employment relations at the Simay Republic Children's Art School upon hiring, transfer, and dismissal.
2.3.1. Information provided by an employee upon entering employment at the institution must be in documentary form. When concluding an employment contract in accordance with Article 65 of the Labor Code of the Russian Federation, a person entering employment presents to the employer:
- a passport or another identity document;
- a work record book, except in cases where the employment contract is being concluded for the first time, or the employee is entering employment on a part-time basis, or the employee does not have a work record book because it was lost or for other reasons;
- a state pension insurance certificate;
- military registration documents - for persons liable for military service and persons subject to military registration;
- a document on education, qualifications, or the possession of special knowledge when entering employment that requires special knowledge or special training;
- a certificate of assignment of a TIN (if the employee has one).
2.3.2. When processing an employee at the Simay Republic Children's Art School, the unified form T-2 "Employee's Personal Card" is filled out, which reflects the following questionnaire and biographical data of the employee:
- general information
(employee's full name, date of birth, place of birth, citizenship, education, profession, work experience, marital status, passport data);
- information on military registration;
- data on hiring;
Subsequently, the following is entered into the personal card:
- information on transfers to another job;
- information on certification;
- information on advanced training;
- information on professional retraining;
- information on awards (incentives), honorary titles;
- information on vacations;
- information on social guarantees;
- information on place of residence and contact telephone numbers.
2.3.3. The following groups of documents containing data on employees in individual or consolidated form are created and stored at the Simay Republic Children's Art School:
2.3.3.1. Documents containing employees' personal data (sets of documents accompanying the process of formalizing employment relations upon hiring, transfer, dismissal; a set of materials on questionnaires, testing; conducting interviews with a candidate for a position; originals and copies of personnel orders; personal files and work record books of employees; files containing the grounds for personnel orders; files containing materials on employee certification; internal investigations; a reference and information data bank on personnel (card indexes, journals); originals and copies of reporting, analytical, and reference materials transmitted to the management of the Simay Republic Children's Art School, heads of structural subdivisions; copies of reports sent to state statistics bodies, tax inspectorates, higher management bodies, and other institutions).
2.3.3.2. Documentation on the organization of the work of structural subdivisions (regulations on structural subdivisions, job descriptions of employees, orders, directives, instructions of the management of the Simay Republic Children's Art School); documents on planning, accounting, analysis, and reporting in the part concerning work with the personnel of the Simay Republic Children's Art School.
3. Collection, processing, and protection of personal data
3.1. Procedure for obtaining personal data.
3.1.1. All personal data of an employee of the Children's Art School of the Republic of Simai should be obtained from the employee himself. If the employee's personal data can only be obtained from a third party, the employee must be notified of this in advance and his written consent must be obtained. The employer's official must inform the employee of the purposes, intended sources and methods of obtaining the personal data, as well as the nature of the personal data to be obtained and the consequences of the employee's refusal to give written consent to its receipt.
3.1.2. The employer has no right to obtain and process personal data of an employee of the Children's Art School of the Republic of Simai concerning his race, nationality, political views, religious or philosophical beliefs, state of health, or intimate life. In cases directly related to matters of labor relations, in accordance with Article 24 of the Constitution of the Russian Federation, the employer has the right to obtain and process data on the employee's private life only with his written consent.
The processing by the employer of the said personal data of employees is possible only with their consent, or without their consent in the following cases:
- the personal data is publicly available;
- the personal data relates to the employee's state of health, and its processing is necessary to protect his life, health or other vital interests, or the life, health or other vital interests of other persons, and it is impossible to obtain the employee's consent;
- at the request of authorized state bodies in cases provided for by federal law.
3.1.3. The employer has the right to process employees' personal data only with their written consent.
3.1.4. An employee's written consent to the processing of his personal data must include:
- the surname, name, patronymic, address of the personal data subject, the number of the main document proving his identity, information on the date of issue of the said document and the authority that issued it;
- the name (surname, name, patronymic) and address of the operator receiving the consent of the personal data subject;
- the purpose of the personal data processing;
- the list of personal data for whose processing the consent of the personal data subject is given;
- the list of actions with the personal data for whose performance consent is given, and a general description of the methods of personal data processing used by the operator;
- the period during which the consent is valid, as well as the procedure for its withdrawal. For the form of the application for the employee's consent to the processing of personal data, see Appendix 1 to this Regulation.
3.1.5. The employee's consent is not required in the following cases:
- the personal data processing is carried out on the basis of the Labor Code of the Russian Federation or another federal law that establishes its purpose, the conditions for obtaining personal data and the range of subjects whose personal data is subject to processing, and also determines the powers of the employer;
- the personal data processing is carried out for the purposes of performing an employment contract;
- the personal data processing is carried out for statistical or other scientific purposes, subject to the mandatory depersonalization of the personal data;
- the personal data processing is necessary to protect the life, health or other vital interests of the employee, if it is impossible to obtain his consent.
3.2. Procedure for the processing, transfer and storage of personal data.
3.2.1. An employee of the Children's Art School of the Republic of Simai provides accurate information about himself. The person responsible for the processing of personal data verifies the accuracy of the information by comparing the data provided by the employee with the documents held by the employee.
3.2.2. In accordance with Article 86 of the Labor Code of the Russian Federation, in order to ensure the rights and freedoms of man and citizen, the employer and its representatives, when processing an employee's personal data, must comply with the following general requirements:
3.2.2.1. The processing of personal data may be carried out exclusively for the purposes of ensuring compliance with laws and other normative legal acts, assisting employees in employment, training and career advancement, ensuring the personal safety of employees, monitoring the quantity and quality of work performed and ensuring the safety of property.
3.2.2.2. When determining the scope and content of the personal data being processed, the employer must be guided by the Constitution of the Russian Federation, the Labor Code of the Russian Federation and other federal laws.
3.2.2.3. When making decisions affecting the interests of an employee, the employer has no right to rely on the employee's personal data obtained exclusively as a result of their automated processing or electronic receipt.
3.2.2.4. The protection of an employee's personal data from their unlawful use or loss is ensured by the employer at his own expense in the manner established by federal law.
3.2.2.5. Employees and their representatives must be familiarized, against signature, with the documents of the preschool institution establishing the procedure for processing employees' personal data, as well as with their rights and obligations in this area.
3.2.2.6. In all cases, an employee's waiver of his rights to preserve and protect secrecy is void.
4. Transfer and storage of personal data
4.1. When transferring an employee's personal data, the employer must comply with the following requirements:
4.1.1. Not to disclose an employee's personal data to a third party without the employee's written consent, except in cases where this is necessary in order to prevent a threat to the employee's life and health, as well as in cases established by federal law.
4.1.2. Not to disclose an employee's personal data for commercial purposes without his written consent. The processing of employees' personal data for the purposes of promoting goods, works and services on the market by means of direct contacts with a potential consumer using means of communication is permitted only with his prior consent.
4.1.3. To warn persons who have received an employee's personal data that this data may be used only for the purposes for which it was communicated, and to require these persons to confirm that this rule has been observed. Persons who have received an employee's personal data are obliged to observe the secrecy (confidentiality) regime. This Regulation does not apply to the exchange of employees' personal data in the manner established by federal laws.
4.1.4. Transfer employees' personal data within the Organization in accordance with this Regulation.
4.1.5. Permit access to employees' personal data only to specially authorized persons, and such persons shall have the right to receive only those personal data of the employee that are necessary for the performance of a specific function.
4.1.6. Not request information about the employee's state of health, except for information relating to the question of the employee's ability to perform their labor function.
4.1.7. Transfer the employee's personal data to employees' representatives in the manner established by the Labor Code of the Russian Federation, and limit this information to only those personal data of the employee that are necessary for the said representatives to perform their functions.
4.2. Storage and use of employees' personal data.
4.2.1. Employees' personal data are processed and stored in the human resources department.
4.2.2. Employees' personal data may be obtained, undergo further processing and be transferred for storage both on paper and in electronic form – on the local computer network.
4.3. When obtaining personal data not from the employee (except in cases where the personal data were provided to the employer on the basis of a federal law or where the personal data are publicly available), the employer, before starting to process such personal data, is obliged to provide the employee with the following information:
- the name (surname, first name, patronymic) and address of the operator or their representative;
- the purpose of processing the personal data and its legal basis;
- the intended users of the personal data;
- the rights of the personal data subject established by this Federal Law.
5. Access to employees' personal data
5.1. The right of access to employees' personal data is held by:
- the director of the Simay Republic Children's Art School;
- employees of the human resources department;
- employees of the accounting department;
- heads of structural subdivisions in their area of activity (access to the personal data only of employees of their own subdivision).
5.2. The Simay Republic Children's Art School has the right:
5.2.1. To obtain access to their personal data and to familiarize themselves with them, including the right to receive, free of charge, copies of any record containing the employee's personal data.
5.2.2. To demand that the Employer clarify, exclude or correct incomplete, incorrect, outdated, unreliable, unlawfully obtained personal data or personal data that are not necessary for the Employer.
5.2.3. To receive from the Employer:
- information about the persons who have access to the personal data or to whom such access may be granted;
- the list of personal data being processed and the source of their obtaining;
- the periods for processing the personal data, including the periods for their storage;
- information about what legal consequences for the personal data subject the processing of their personal data may entail.
5.2.3. To demand that the Employer notify all persons to whom incorrect or incomplete personal data were previously communicated of all exclusions, corrections or additions made to them.
To appeal to the authorized body for the protection of the rights of personal data subjects or to a court against the unlawful actions or inaction of the Employer in the processing and protection of their personal data.
5.3. Copying and making extracts of an employee's personal data is permitted exclusively for official purposes with the written permission of the head of the human resources department.
5.4. Transfer of information to a third party is possible only with the written consent of the employees.
6. Liability for violation of the norms regulating the processing and protection of personal data
6.1. Employees of the Simay Republic Children's Art School guilty of violating the norms regulating the obtaining, processing and protection of an employee's personal data bear disciplinary, administrative, civil-law or criminal liability in accordance with federal laws.
6.2. The director of the Simay Republic Children's Art School bears administrative liability for violation of the norms regulating the obtaining, processing and protection of an employee's personal data in accordance with Articles 5.27 and 5.39 of the Code of Administrative Offenses of the Russian Federation, and also compensates the employee for damage caused by the unlawful use of information containing the employee's personal data.