companies still have an insufficiently high culture of working with data."

[tanjimajuha20]

"At the same time, the need for data anonymization solutions is only growing. For example, when making online purchases, you leave personal information: name, address, contact information, etc. Online platforms aggregate and store it, which requires additional efforts from businesses to anonymize it, as well as to restrict access to data among employees. For example, a courier should not know the composition and amount of the delivery, he only needs the afghanistan whatsapp number database parcel number, address and phone number of the recipient. Due to such "fragmentation", the company will be able to avoid unnecessary access to personal or critical information if it is really not needed, including reducing the risks of leakage, - a representative of the Sfera platform is sure. - In addition, the object itself does not know what data is collected about it and where it is used, having practically no leverage over this. B2C companies often accumulate a large amount of data for analytics - storing it in an anonymized form also minimizes costs."

"It is necessary to think about data and information protection at the very first stage of designing the architecture of an information system. It is necessary to provide for mandatory separation of credentials and identifiers, and select effective depersonalization technologies," recommends the press service of Roskomnadzor. "The adoption of a law on turnover fines for information leaks will help to form such a culture of creating information systems in IT companies. Liability measures should encourage companies to take personal data protection seriously and invest in the development of information security infrastructure."

IW Group Technical Director Alexey Obukhov directly linked the use of masking technologies with the activity of regulators, not only state regulators, but also industry regulators: "Where the regulator's requirements are strict, the situation is better than the market average. For example, banks have PCI DSS requirements - the payment card industry data security standard, which includes masking sensitive payment card data. But in industries where there are no mandatory standards, the situation is worse. In my opinion, you can't completely rely on the regulator, and IT specialists should be more responsible in general with personal data: not storing it in plain text and, in addition to encryption, using masking as an effective tool for data protection."

However, working with depersonalized personal data is in a grey area: the rules for depersonalization and working with data sets are not defined at the federal level, noted Boris Edidin, deputy chairman of the commission on legal support for the digital economy of the Moscow branch of the Association of Lawyers of Russia, for Forbes.

Read also
By trial and error: business has proposed to the state its own way of working with anonymized data
Business has proposed that the state introduce an experimental legal regime for testing technologies for depersonalizing personal data of Russians. It will help companies from various fields develop more technologically advanced services that better meet the needs of consumers. The initiative is, in fact, an alternative to the draft law of the Ministry of Digital Development, according to which companies, at the request of the state, will provide the personal data they have to the state information system for depersonalization and the formation of data sets. The document has been repeatedly criticized by businesses

At the same time, the problem of regulatory barriers that hinder the circulation of anonymized data is recognized by the country's top leaders. This topic was touched upon, among others, by President Vladimir Putin in his speech at the AI ​​Jorney'2022 conference, where he gave the order to speed up the passage through the chambers of the Federal Assembly of a bill that allows the use of anonymized data, for example, for training neural networks. This bill was introduced to the State Duma by the government back in 2021. The document gives businesses the opportunity to process personal data of clients for subsequent use in an anonymized form. The bill was adopted in the first reading, but its further passage has stalled.

Read also