Personal data: are you ready for verification? Analysis of the features of the HR service

Let's define the concept.

For more than 3 years Russian legislation When processing personal data of employees, it guards the integrity of privacy, family and personal secrets, and monitors the protection of freedoms and rights of citizens and people. For this purpose, quite a lot of regulations were adopted that obligated to ensure the security of personal data, with which not only individuals and legal entities, but also various authorities interact. The most important regulations include:

• Federal Law of July 27, 2006 N 152-FZ “On Personal Data” (hereinafter referred to as the Law on Personal Data);
• Decree of the Government of the Russian Federation of September 15, 2008 N 687 “On approval of the Regulations on the specifics of processing personal data carried out without the use of automation tools” (hereinafter referred to as Decree N 687);
• Decree of the Government of the Russian Federation of November 17, 2007 N 781 “On approval of the Regulations on ensuring the security of personal data during their processing in personal data information systems” (hereinafter referred to as Decree N 781).

At a meeting of the State Duma in December 2009, bill N 284213-5 “On Amendments to Articles 19 and 25 of the Federal Law “On Personal Data” was adopted in the third reading. In accordance with these changes, requirements relating to the use of cryptographic security measures were excluded from the Law personal data. According to Article 25 of the Law on Personal Data, all personal data information systems that were created before the entry into force of this Law had to be brought into compliance with the requirements of the current legislation no later than January 1, 2010. And the bill proposed to extend the deadline until January 1, 2011.

But how do these changes relate to HR? What is new in this Law and Regulations that is not in Ch. 14 of the Labor Code of the Russian Federation? Firstly, all these documents define the procedure for working with personal data, and also clarify and expand the rules of law that are given in Labor Code RF. Secondly, they define rules for ensuring the security of working with personal data.

We suggest you look into this in more detail. When using personal data of employees to determine the scope of work, you should start from key concepts, such as “personal data” and “processing of personal data”.

According to the Labor Code of the Russian Federation personal data of employees– this is information relating to a specific employee and closely related to labor relations, which is necessary for every employer. And according to the Law on Personal Data, which clarifies and expands this concept, personal data may include any information relating to an individual identified or determined on the basis of such information (i.e., the subject of personal data), including his name, surname , patronymic, date and place of birth, residential address, education, profession, social, family, property status, income and other information. Thus, any employer who has entered into an employment contract with an employee receives all the necessary information that relates to personal data. As a rule, all this information is contained in the following documents presented by the employee when hiring. These include:

• passport;
• certificate of assignment of TIN;
• military ID (if available);
• pension insurance certificate;
• educational documents (including additional education, if the employee presents them when hiring or it is necessary to perform certain job functions);
• a driver's license and documents for a car, again, if this is necessary in connection with the performance of certain labor functions of the employee;
• certificate of completion of a medical examination (medical record), if necessary in connection with the performance of work functions.

The use of the above information by an enterprise in its activities is interpreted by law as " processing of personal data". Such actions include the following: collection, accumulation, systematization, clarification, storage, use, update, change, blocking, depersonalization, destruction, transfer, distribution and other actions. Usually all of the above operations are performed at any enterprise and in any organization, but in different volumes.

Particular attention should be paid to the concept " transfer of personal data", because in connection with it certain restrictions are imposed on the employer (Article 88 of the Labor Code of the Russian Federation). Firstly, the owner does not have the right:

• without the written consent of the employee, disclose his personal data for commercial purposes;
• without the written consent of the employee, disclose his personal data to a third party, except in cases where this is necessary to prevent a threat to the health and life of the first and other cases provided for by the legislation of the Russian Federation;
• request in medical institutions information about the employee’s health status, except for information directly related to the issue of the employee’s ability to perform his job functions.

In addition to the above, the employer must comply with the following requirements:

• warn persons who have received the personal data of any employee that this data can only be used for the purposes for which it was communicated, and require such persons to confirm that this rule has been complied with. All persons who receive the employee’s personal data are required to observe confidentiality (secrecy). However, this provision does not apply to the exchange of personal data of employees in the manner established by the legislation of the Russian Federation;
• access to personal data of employees is allowed only to specially authorized persons, and access only to those personal data that are necessary to perform specific functions;
• transfer personal data to employee representatives only in the manner prescribed by the legislation of the Russian Federation and limit all information only to those personal data necessary to fulfill the purposes specified by the representatives.

Required documents.

The employer, in order to comply with legal requirements, must comply with certain conditions processing of personal data. In accordance with Part 1 of Art. 6 of the Law “On Personal Data”, only the operator can process personal data, moreover, with the consent of the subjects of personal data. But there are exceptions given in Part 2 of Art. 6 of this law, which states that permission is not required if the processing of personal data is carried out on the basis of a federal law that establishes its purpose, the range of subjects whose personal data is subject to processing, and the conditions for obtaining personal data, and also determines the powers of the operator. Many believe that the Labor Code of the Russian Federation, which is a federal law, corresponds to this exception, but the Code stipulates some purposes for the processing of personal data and indicates that the employer must determine the scope, purposes and content of data processing. If this volume exceeds that given in the Labor Code, then the employer must obtain his permission before using the employee’s data, i.e. Before concluding an employment contract with an employer, the employee is required to write a statement of consent to the processing of his personal data. As a rule, such a statement must indicate:

• Full name, number of the document proving his identity, information about its date of issue and the authority that issued it, as well as the employee’s address;
• the name and address of the employer who obtains the employee’s consent;
• list of personal data, consent to the processing of which is given by the employee;
• purpose of processing personal data;
• a list of actions related to personal data, to which consent is given, and general description methods of processing personal data that the employer will use;
• the period during which the consent will be valid;
• procedure for withdrawing an application.

Purposes of processing personal data.

Let us consider in more detail the purposes of processing personal data. In the completed application, the employee must indicate in detail the options under which his personal data can be used. For example, before you order Business Cards with the employee’s surname, it is necessary to obtain his consent, the same is the case with assignment email address containing the employee's last name. It is imperative to agree on the period of use of the employee’s personal data after his dismissal.

The organization is obliged to store documents containing information about the employee for seventy-five years, so the employer should obtain consent in advance for their use, as well as determine the extent to which this information can be used. The employee retains the right to refuse the use of his personal data, but taking into account the possible consequences (Part 2 of Article 18 of the Law “On Personal Data”), this refusal must be in writing. As a rule, this type of situation occurs quite rarely at enterprises, but in order to avoid such complications, the employer is obliged to familiarize the employee with the Regulations on Personal Data and draw up a document confirming familiarization with the Regulations, which must be certified by the employee’s signature. The document must contain full list personal data provided by employees, and it also indicates where and how they will be stored; in addition, the document must list the measures taken to ensure the safe storage of information media and indicate the persons responsible for execution.

According to Art. 6 of Regulations N 687, all employees of the organization related to working with personal data must be instructed on the rules for working with personal data and the responsibilities associated with this work. As a rule, an employment contract is concluded with such employees, where separate clauses stipulate their duties and responsibilities for violation of confidentiality regarding the disclosure of personal data of other persons.

Requirements for working on various media.

During the activities of enterprises, the information received is stored on two types of media. This is usually paper and electronic document management- material and electronic media. The list of material media includes: work book, accounting journal work records, a log of incoming and outgoing correspondence, a log of orders and travel sheets, time sheets and other documents directly or indirectly related to information about the personal data of employees. The Personal Data Law stipulates the employer’s responsibilities regarding ensuring the storage of personal data on paper and its safety, as well as excluding access to these documents by persons without permission.

Electronic media of personal data include various databases that contain personal data of employees. This information is stored, processed and transmitted using technical means. Based on Art. 19 Personal Data Law Government Russian Federation decided to approve Regulation No. 781 of November 17, 2007 on ensuring the security of personal data during their processing in personal data information systems. The security of personal data on electronic media means maintaining confidentiality, excluding unauthorized entry, this also applies to penetration without malicious intent, which can lead to loss, distortion, modification, copying and other actions with personal data.

In order to eliminate such situations, work with electronic media should be structured as follows:

1. At each enterprise, the information system must be qualified according to the degree of importance, the volume of personal data processed and the degree of threat of penetration. An organization that has passed the appropriate licensing has the right to conduct classification. After determining the class, the management of the enterprise draws up a list of measures used to protect existing personal data.
2. The organization, in order to prevent unauthorized hacking and illegal entry into the premises in which the information system that works with personal data is located, must organize appropriate security.
3. Organize measures to prevent accidental or intentional access to personal data. And if such a fact occurs, promptly detect the penetration and take measures to eliminate the consequences of the penetration, and eliminate actions that could lead to loss, damage or change of information.
4. Take urgent measures to restore lost or changed information about personal data.
5. Monitor the level of information security.

And lastly, to ensure work with personal data at the proper level, the enterprise and organization must have the following documents:

• Statement on personal data.
• Order on the appointment of those responsible for ensuring the security of personal data.
• Order on the appointment of persons responsible for working with personal data.
• Contracts and additional agreements with employees on the processing of personal data.
• Applications from employees for the processing of personal data.

Page
7

· copies of documents on education, assignment of an academic degree, academic title;

· characteristics;

· copies of orders for admission (hereinafter about transfer, dismissal);

· employment contract;

· cards for recording rewards and penalties;

· certification materials;

· submissions on appointment, release, transfer, dismissal, assignment to study;

· copies of award lists and nominations for awarding honorary titles;

· other documents characterizing the employee.

Personal files should not include documents of secondary importance, having temporary (up to 10 years inclusive) storage periods. Such documents include certificates of residence, living conditions, health status, etc.

A personal file is drawn up after the issuance of an employment order and is maintained throughout the employee’s entire work at the enterprise.

The employee responsible for the documentation support of personnel activities accepts documents from the person entering the service, checks their completeness and the correctness of the specified information in accordance with the presented documents.

Personal files are accounted for as documents “For official use” and are registered in the “Book (journal) of personal affairs”, which includes the following columns: serial number case, last name, first name, patronymic of the employee, date of registration of the case and date of deregistration.

Personal files can be issued for review only to employees designated by the head of the enterprise.

When working with a personal file issued for review, it is prohibited to make any corrections in previously made entries, make new entries into it, extract existing documents from the personal file or place new ones in it, and disclose confidential information contained in it.

When extracting any documents from a personal file, the person responsible for maintaining personal files is obliged to make a corresponding entry in the internal inventory.

To control the timely return of personal files issued or sent for review and to prevent their loss, a special control card is used, which is filled out for each case. It indicates the personal file number, last name, first name, patronymic of the employee for whom it was opened, the date of issue of the personal file, to whom it was issued, receipt of receipt, office telephone number of the person who received the file, and the date of return of the file.

However, personal files are not kept for all employees, but, as a rule, for management employees and specialists of the organization. Personal cards are drawn up for other employees (Form No. T-2).

The personal card is a list of questions about the employee’s biographical data, education, work performed from the beginning labor activity, stay abroad, government awards, military duty, marital status, place of residence, passport details, etc. The columns of the card are filled out by the employee in his own hand, legibly, without distortion or abbreviation of the names of the organizations in which he previously worked. Information about previous work activity is indicated on the basis of entries in the work book and other documents. An autobiography is written in free form, where, in addition to information about yourself and your activities, information about relatives and other information that is important when deciding on the more correct and appropriate use of an employee in a certain position is indicated. About all subsequent changes in biographical data (education, Family status etc.) employees are required to inform the personnel department at their place of work to make these changes in all their accounting documents.

In the HR department, personal files and personal cards are kept only for working employees. For storage, you should use safes and office cabinets in which personal files are arranged alphabetically. Cabinets or metal safes must be locked and sealed.

After an employee is dismissed, his personal file is removed from the folder and prepared for transfer to storage.

Case storage

From the moment of establishment until transfer to the archive, files are stored at the place of their formation.

Employee records are stored in specially equipped cabinets and filing cabinets. During the cessation of work, the premises where accounting documents are stored are sealed or placed under guard. Personal files are placed in fireproof cabinets in the order of numbers marked on the spine and front side of the personal file.

Some of the documents generated and generated in the activities of the enterprise are subject to transfer to the departmental archive.

For the temporary (over 10 years) storage of documents of practical importance, as well as documents on personnel, their recording, use, selection and preparation for transfer to state storage, departments form a central archive.

The central archive of the department stores documents of the central apparatus, organizations - predecessors of the department and, if necessary, other organizations in accordance with the list of organizations - sources of archive acquisition, approved by the head of the department.

Cases of permanent, temporary (over 10 years) storage of personnel are transferred to the central archive. Their transfer is carried out only according to inventories. Cases of temporary (up to 10 years inclusive) storage are not subject to transfer to the central archive; they are stored in structural units even after the expiration of the storage period and are subject to destruction in the prescribed manner.

Compliance with the rules for maintaining and storing personnel documentation, as well as the timely submission of this documentation to the archive, is the professional duty of every personnel service employee. Constant monitoring of the activities of the personnel service, prompt elimination of deficiencies is one of most important tasks director of the enterprise.

Protection of personal data of employees in the personnel service

The work of the HR department is directly related to the personal data of employees. The bulk of the information related to the activities of HR department employees is confidential. Therefore, an important area of ​​activity of the personnel service is the processing, protection and storage of this type of information.

In accordance with the Federal Law of July 27, 2006 No. 149-FZ “On information, information technologies and information protection,” personal data is classified as confidential information. The collection, storage, use and dissemination of information about private life, as well as information that violates personal confidentiality, is not allowed, family secret, the secrecy of correspondence, telephone conversations, postal, telegraph and other messages of an individual without his consent, except on the basis of a court decision. Personal data cannot be used to cause property and moral harm to citizens or impede the exercise of their rights and freedoms.

Employers who have information about citizens are liable in accordance with the legislation of the Russian Federation for violating the regime for protecting, processing and using this information.

Answer

Computerization is the process of introducing computer technology into all spheres of human activity, including activities related to providing interested parties with information resources. The purpose of such activity, ultimately, to facilitate access to information and work with it.

The computer revolution, caused by the widespread use of various fields human activity of personal computers, allows you to form a solid technological base for the automation of the personnel service (department).

A personnel officer today must be not only a qualified employee, but also a competent user in the field of modern information computer technology, capable of replacing traditional work technology with an automated one, based on the use of a personal computer and the corresponding software.

Currently, using computer programs it is possible to perform the following functions:

1) draw up a staffing table;

2) keep parallel records of current, planned and archival staff units;

3) arrange the reception of employees;

4) maintain Personal cards;

5) store personal data about the employee (residence and registration addresses, education, passport data, family composition, information about disability, etc.);

6) keep records military duty employees (rank, military training, suitability, registration with the military registration and enlistment office, special registration, etc.);

7) enter taxpayer data (TIN);

8) record the admission, transfer and dismissal of employees (group transfer, vacation and dismissal of employees) with the automatic generation of relevant orders;

9) plan employee vacations and maintain vacation history;

10) record information about advanced training of employees, certifications, specialties, additional responsibilities, etc.;

11) take into account Various types length of service (general, continuous, continuous at the enterprise, etc.);

12) keep records of certificates of incapacity for work;

13) record incentives and penalties for employees;

14) keep a business trip log and issue travel certificates;

15) keep records of employment agreements (contracts) of employees;

16) keep a journal of the movement of work books and inserts for them;

17) create lists of employees in accordance with certain filters (by department, category, profession, position, length of service, education, place of residence and registration, etc.);

18) generate a variety of custom reports (with the ability to automatically upload to MS Excel);

19) generate primary accounting documents:

a) No. T-1 “Order (Order) on hiring an employee”;

b) No. T-2 “Employee’s personal card”;

c) No. T-2GS “Personal card of a civil servant”;

d) No. T-3 “Staffing table”;

e) No. T-4 “Registration card of a scientific, scientific and pedagogical worker”;

f) No. T-5 “Order (Order) on the transfer of an employee to another job”;

g) No. T-5a “Order (Order) on the transfer of workers to another job”;

h) No. T-6 “Order (Order) on granting leave to an employee”;

i) No. T-7 “Vacation Schedule”;

j) No. T-8 “Order (Instruction) to terminate Employment contract(contract) with the employee”;

k) No. T-8a “Order (Order) on termination of the Employment Agreement (Contract) with employees”;

l) No. T-9 “Order (Order) on sending an employee on a business trip”;

m) No. T-10 “Travel certificate”;

o) No. T-10a “Official assignment for sending on a business trip and a report on its implementation”;

p) No. T-11 “Order (Order) on employee incentives.

And this is only half of what can be done using computer programs.

And how much easier it is to search for any data. For example, it is urgent to find a place of residence for an employee. You simply open the program you need, search for an employee by name and that’s it – the data is in front of you and it takes no more than two minutes.

The computer has become reliable and, dare I say it, an indispensable assistant personnel worker.

Automated HR systems, created by software development companies, are constantly being improved and improved, greatly facilitating the work of personnel officers.

HR software today must contain a database that is constantly updated with reliable information, ensure the efficiency of searching for the necessary information, and the clarity of presentation of information from the database. Software tools should also include programs that regulate the organizational activities of the head of the personnel service, ensure decision-making on specific situations, implement prompt communication, i.e., ensure business activities, communication and decision-making.

One of the most popular is the 1C: Salaries and Personnel program. The standard configuration of this program allows you to almost completely automate the work of the personnel service at enterprises, institutions and organizations of any form of ownership, including those financed from the budget, with the preparation of all the necessary primary documents.

Another fully functional system that allows you to optimize the business process of the HR service is "BOSS personnel officer."

This program allows you to plan the structure of a new department, prepare reports, update personnel reference data on the corporate portal and resolve a complex conflict, while complying with labor laws.

"BOSS-Kadrovik" contains many regulatory reference books approved by law: OKPDTR, OKONKH, OKSO, OKSM, reference books on tax legislation, personalized accounting and many others.

The automated system “Military registration worker (body) of the organization “Gran-VUR” will help to maintain military records of citizens in organizations.

The system allows:

1) automate the solution of problems of military accounting work in the organization (accounting, control, search and analysis);

2) automate the exchange of reporting information with a higher territorial or sectoral military accounting body.

The system is single-user, i.e. this option The system is designed for accounting and working with documents at one workplace. Microsoft Jet is used as a data storage and management tool (DBMS).

System functionality:

1) accounting of citizens working in the organization who are in the reserves or subject to conscription;

2) recording the facts of booking and de-booking of employees of the organization;

3) search (selection, filtering) of employees of the organization from general list according to various criteria;

4) automated calculation of indicators and generation of a report on the number of citizens employed and reserved in the organization who are in reserve (form No. 6);

5) automated calculation of indicators and generation of an organization’s accounting card (form No. 18);

6) Filling out and printing personal cards of the organization’s employees according to form No. T-2 (VUR) and No. T-2GS (VUR);

7) maintaining and printing a journal of personal cards of working conscripts and citizens in reserve;

8) automated generation name list citizens assigned to teams, and notification cards at the place of work of workers with a mobile order;

9) automated generation of lists containing basic military registration data of the organization’s employees transmitted for verification to the relevant military commissariats;

10) automation of information exchanges on magnetic media with a higher military registration authority equipped with the Gran-Bronirovanie system.

Automated personnel management system "Pharaoh" is a computer program that allows you to keep track of any personnel transactions, automates office work, and also offers convenient tools for planning and analyzing personnel management. The main features of Pharaoh are its clarity and flexibility.

Using the Pharaoh system you can:

1) organize your work effectively;

2) develop a holistic view of your company;

3) promptly solve assigned tasks;

4) use modern computer technologies;

5) easily obtain any information about personnel;

6) conduct office work in accordance with the law;

7) building an organizational structure.

Software product “Documentation support for personnel services” is a new generation of OASIS software for automating the work of a HR inspector. This program is built on the principles of reference and information systems. It presents two catalogs of documents (on the technology of the HR service and on the types of documents) to ensure correct documentation of the work activities of employees and personnel records. In a programme features implemented:

1) use of document templates to prepare a catalog of internal documents;

2) convenient search according to the document database;

3) printing of documents;

4) “masters of personnel operations”, providing control over any personnel operation and carrying out elements of training for a personnel service employee.

The variety of programs for HR services is simply amazing. Often they simply duplicate each other, so you need to carefully choose the program that would ideally suit the specifics of your activity. When choosing a program, it doesn’t hurt to contact software specialists who probably exist in your organization.