Employee Share Plans in Europe and the USA - Sorainen

Employee Share Plans in Europe and the USARussian Federationalso contains specific requirements with respect to the processing and transferby an employer of an employee's personal data. 168.2 Subject to certain exemptions, an individual's written consent must be obtainedfor the processing 17 (including collection, use and transfer) of the individual'spersonal data. 18 The processing of specified categories of personal data isnever exempt from a requirement to obtain such written consent. In particular,written consent is always required for cross-border transfers of an individual'spersonal data to countries with a lower standard of personal data protection thanthe standard stipulated by Russian law. 198.3 It is recommended that the documentation governing a particular employeeshare plan includes a template for each employee's consent for thosetransactions in relation to which personal data will be required for the purposesof implementing and administrating the plan. 208.4 In certain cases, a notification to the Russian personal data authority may berequired prior to commencing the processing of an individual's personal data. 219. Employment lawRussian employment law does not contain any specific regulations with respectto employee share plans. As a general rule, Russian employment law isfavourable to employees. However, there are no significant legal difficulties or161718192021These include, inter alia, a prohibition on the transfer of an employee's personal data to any thirdparties without the prior written consent of the employee.The term "processing" is defined in Federal Law No. 152-FZ ("On Personal Data" dated 27 July 2006(the "Personal Data Law") as, among other things, the collection, accumulation, systematisation,storage, specification (updating, alteration), use, dissemination (including transfer), depersonalisation,blocking and destruction of personal data. This definition is drafted very broadly and may beinterpreted as including almost any operations involving information on individuals.These exemptions include, inter alia, processing of personal data which is carried out for the purposeof the fulfilment of an agreement, to which the individual is a party. There is a view that an individual'sconsent to processing his/her personal data only has to be in writing in cases specified by law (e.g. inrelation to the individual's biometric data). However, given that this has not been specifically confirmedby the regulator, we recommend that where the individual's consent is required, this consent be alwaysgiven in writing.There is no exhaustive list of criteria for the assessment of the data protection regime standards. As aresult, it is recommended that an individual's written consent is always obtained when transferring hisor her personal data outside of the Russian Federation.The content of an individual's written consent is subject to certain statutory requirements.This requirement does not extend, inter alia, to the processing of: (i) personal data obtained in thecourse of employment relations with an individual; and (ii) personal data obtained for the purposes offulfilment of obligations under an agreement to which the individual is a party.UK/1729295/03 169 September 2010