28
ROMAN ZAKHAROV v. RUSSIA JUDGMENT
personal data in the public and private sectors. The relevant parts read as
follows.
Article 8 – Additional safeguards for the data subject
“Any person shall be enabled:
a. to establish the existence of an automated personal data file, its main purposes, as
well as the identity and habitual residence or principal place of business of the
controller of the file;
b. to obtain at reasonable intervals and without excessive delay or expense
confirmation of whether personal data relating to him are stored in the automated data
file as well as communication to him of such data in an intelligible form;
c. to obtain, as the case may be, rectification or erasure of such data if these have
been processed contrary to the provisions of domestic law giving effect to the basic
principles set out in Articles 5 and 6 of this Convention;
d. to have a remedy if a request for confirmation or, as the case may be,
communication, rectification or erasure as referred to in paragraphs b and c of this
Article is not complied with.”
Article 9 – Exceptions and restrictions
“1. No exception to the provisions of Articles 5, 6 and 8 of this Convention shall be
allowed except within the limits defined in this Article.
2. Derogation from the provisions of Articles 5, 6 and 8 of this Convention shall be
allowed when such derogation is provided for by the law of the Party and constitutes a
necessary measure in a democratic society in the interests of:
a. protecting State security, public safety, the monetary interests of the State or the
suppression of criminal offences;
b. protecting the data subject or the rights and freedoms of others.
...”
Article 10 – Sanctions and remedies
“Each Party undertakes to establish appropriate sanctions and remedies for
violations of provisions of domestic law giving effect to the basic principles for data
protection set out in this chapter.”
141. The above Convention was ratified by Russia on 15 May 2013 and
came into force in respect of Russia on 1 September 2013. The instrument
of ratification deposited by the Russian Federation on 15 May 2013 contains
the following declaration.
“The Russian Federation declares that in accordance with subparagraph ‘a’ of
paragraph 2 of Article 3 of the Convention, it will not apply the Convention to
personal data:
...
(b) falling under State secrecy in accordance with the legislation of the Russian
Federation on State secrecy.