Personal data in military registration

What is happening

Military registration is personal data in its purest form: fitness category, family details, education, health information and copies of military registration documents. Some of it falls into special categories, and the usual privacy policy — written for hiring and payroll — does not cover it.

The other half of the problem is disclosure. The company submits information to the military commissariat, sometimes to local authorities, and sometimes answers individual requests. Every such transfer needs a lawful basis and a record, and the data disclosed must not go beyond what the law actually requires.

In practice we most often see three gaps: employees are asked to sign consents where none is required, which adds risk rather than removing it; copies of documents sit in HR folders with no retention period and no access limits; and answers to requests contain more than was asked for. All of this is fixed with documents, not by rebuilding the HR function.

What the law says

• Law 152-FZ on personal data permits processing without the employee's consent where it is necessary to discharge a duty imposed on the employer by law — and that is the basis on which military registration mainly rests.
• Law 53-FZ on military duty and Law 31-FZ on mobilisation preparation define what information about employees a company must collect and report; that list marks the boundary of lawful processing.
• The Labour Code sets separate rules for handling an employee's personal data, including limits on access and the procedure for disclosure to third parties.
• Processing health information and fitness categories requires a narrower basis and a stricter access regime than ordinary HR data.
• Security and data-localisation requirements apply to military registration as well, including the working files and spreadsheets HR keeps for its own use.
• The Code of Administrative Offences provides for liability for data protection breaches separately from liability for military registration breaches — the two risks do not substitute for each other.

What we do

• We map the actual data flow: what the company collects, from which documents, where it is stored, and to whom and on what occasion it is disclosed.
• We establish the lawful basis for each category of data, remove consents that are not needed and draft those that are properly.
• We extend the privacy policy and internal regulations with a section on military registration and mobilisation preparation.
• We prepare employee notice forms, the procedure for submitting data to the military commissariat and a template reply to requests that limits the data disclosed.
• We set the storage and access regime: who may access military registration documents, where they are kept and what happens at the end of the retention period.
• We check that the person responsible for military registration is formally authorised to access this data, and prepare that authorisation if it is missing.

What we need from the company

• The company's current privacy policy and the related internal regulations.
• The list and forms of military registration documents actually maintained, including personal cards and working registers.
• Recent examples of requests from the military commissariat and your replies to them — anonymised is fine.
• Where the military registration data is held physically and in which systems, and who has access to it.
• Orders appointing the person responsible for military registration and authorising access to personal data, if they exist.
• Whether any external provider is involved in HR administration or in processing this data.