WEARABLE EMOTIONAL-BIOMETRIC REGULATION AND LEGAL FRAMEWORK IN RUSSIA

1. INTRODUCTION

Wearable emotional-biometric technology involves electronic devices that collect and analyse physiological and behavioural information to estimate an individual's emotional or psychological condition. These devices may include smartwatches, biometric wristbands, neural monitoring equipment, facial-expression sensors and wearable electroencephalography (EEG) systems.

Such technologies can measure heart rate, skin conductance, body temperature, sleep patterns, facial movements and neurological signals. Artificial intelligence systems may analyse these measurements to estimate stress, anxiety, emotional responses, attention levels and behavioural patterns.

In Russia, wearable emotional-biometric technology is not governed by a single dedicated federal statute. Its regulation arises from several overlapping legal frameworks concerning personal data, biometric identification, privacy, healthcare, consumer protection, employment and information security.

The principal legal challenge is determining when physiological information becomes personal data, biometric personal data or health-related information requiring additional legal safeguards.

2. PRINCIPAL LEGISLATIVE FRAMEWORK

A. FEDERAL LAW NO. 152-FZ OF 27 JULY 2006 ON PERSONAL DATA

This is one of the most important laws governing wearable emotional-biometric systems.

It regulates the collection, storage, processing, transfer and protection of personal information.

Important requirements include:

Establishing a lawful basis for processing personal data.

Identifying specific and legitimate processing purposes.

Ensuring that collected information is relevant and proportionate.

Protecting personal information against unauthorised access.

Providing applicable data-subject rights.

Implementing appropriate organisational and technical safeguards.

Article 10.1 is relevant where personal data is made publicly available under the applicable legal framework.

Wearable-device operators must establish an appropriate legal basis before collecting and analysing identifiable emotional or physiological information.

B. FEDERAL LAW NO. 152-FZ: ARTICLE 11 — BIOMETRIC PERSONAL DATA

Article 11 regulates biometric personal data.

Biometric personal data refers to information characterising a person's physiological or biological characteristics that is used by an operator to establish identity.

An important legal distinction exists between biometric monitoring and biometric identification.

For example:

A smartwatch measuring heart rate is not automatically processing biometric personal data under Article 11.

A wearable device using facial geometry to identify its user may involve biometric personal data.

An EEG device estimating stress without identifying an individual does not automatically fall within the specific Article 11 definition.

However, ordinary personal-data requirements may still apply when the information relates to an identifiable individual.

C. FEDERAL LAW NO. 323-FZ OF 21 NOVEMBER 2011 ON THE FUNDAMENTALS OF HEALTH PROTECTION

This legislation becomes relevant when wearable emotional-biometric devices are used for medical diagnosis, psychological assessment or healthcare monitoring.

It establishes principles concerning medical intervention, patient rights and confidentiality.

Where a device is marketed or used as a medical device, applicable medical-device registration and regulatory requirements must also be considered.

D. FEDERAL LAW NO. 149-FZ OF 27 JULY 2006 ON INFORMATION, INFORMATION TECHNOLOGIES AND INFORMATION PROTECTION

This law establishes general information-security obligations.

Its relevance includes:

Security of wearable-device platforms.

Protection of cloud-based biometric databases.

Prevention of unauthorised access.

Security of connected mobile applications.

Protection of electronic monitoring systems.

E. FEDERAL LAW NO. 98-FZ OF 29 JULY 2004 ON COMMERCIAL SECRETS

This legislation may apply when wearable emotional-biometric systems collect commercially sensitive workplace or organisational information.

Employers and technology providers must distinguish legitimate confidential business information from employees' protected personal information.

3. LEGAL REQUIREMENTS FOR WEARABLE EMOTIONAL-BIOMETRIC SYSTEMS

A. INFORMED CONSENT AND LAWFUL PROCESSING

Wearable-device manufacturers and operators must establish an appropriate legal basis for processing personal information.

Where consent is relied upon, it must satisfy applicable legal requirements.

Users should receive understandable information concerning:

What physiological measurements are collected.

Whether emotional states are inferred through artificial intelligence.

Whether information is stored locally or in cloud systems.

Whether third parties receive the information.

How long information is retained.

How users can exercise applicable data-subject rights.

Consent to ordinary wearable-device functionality should not automatically be treated as consent to every additional emotional-profiling purpose.

B. EMOTIONAL PROFILING AND ARTIFICIAL INTELLIGENCE

Artificial intelligence may use physiological measurements to classify individuals according to estimated emotional conditions.

Examples include stress classification, fatigue prediction, emotional-response analysis and behavioural-risk assessment.

Russian law does not establish a single comprehensive statutory framework specifically regulating all forms of emotional AI profiling.

Nevertheless, personal-data requirements apply where identifiable personal information is processed.

Operators should establish safeguards against inaccurate classifications, discriminatory outcomes and decisions based on unreliable emotional inferences.

C. EMPLOYMENT AND WORKPLACE MONITORING

Employers may use wearable technology for occupational safety, fatigue monitoring and certain health-related purposes.

However, continuous emotional surveillance raises significant privacy and labour-law concerns.

Relevant provisions include Article 86 of the Labour Code of the Russian Federation, which regulates the processing of employees' personal data.

Article 88 addresses the transfer of employee personal data.

Employers should ensure that:

Monitoring has a legitimate employment-related purpose.

Employees receive appropriate information.

Collection is proportionate to the stated purpose.

Sensitive information is not unnecessarily disclosed.

Emotional classifications are not treated as automatically reliable evidence of misconduct or incapacity.

D. MEDICAL AND HEALTHCARE APPLICATIONS

Wearable devices used to diagnose or monitor psychological and physiological conditions may fall within medical-device regulation.

Relevant requirements may include medical-device registration, conformity assessment, technical documentation and clinical evaluation, depending on the device's intended purpose and classification.

Manufacturers must distinguish general wellness devices from products intended for medical diagnosis or treatment.

E. DATA LOCALISATION AND INTERNATIONAL TRANSFERS

Russian personal-data legislation contains requirements concerning the recording, systematisation, accumulation, storage and other processing operations involving personal data of Russian citizens through databases located in Russia.

Article 12 of Federal Law No. 152-FZ regulates cross-border transfers.

Wearable-device operators must assess these requirements when using foreign cloud services, international analytics providers or overseas data-processing infrastructure.

4. REGULATORY AUTHORITIES

1. ROSKOMNADZOR

The Federal Service for Supervision of Communications, Information Technology and Mass Media supervises compliance with personal-data legislation.

It has relevant enforcement responsibilities concerning unlawful personal-data processing and data-protection violations.

2. MINISTRY OF HEALTH OF THE RUSSIAN FEDERATION

Responsible for relevant healthcare policy and medical-device regulatory frameworks.

3. FEDERAL SERVICE FOR SURVEILLANCE ON CONSUMER RIGHTS PROTECTION AND HUMAN WELLBEING (ROSPOTREBNADZOR)

Exercises public-health and sanitary-epidemiological supervisory functions.

4. FEDERAL SERVICE FOR TECHNICAL AND EXPORT CONTROL (FSTEC)

Has relevant responsibilities concerning technical information-security requirements within its statutory competence.

5. FEDERAL ANTIMONOPOLY SERVICE (FAS)

May become relevant where wearable-device marketing, misleading advertising or competition-related conduct raises issues under applicable legislation.

5. IMPORTANT CASE LAWS AND JUDICIAL AUTHORITIES

There is no established body of reported Russian judicial decisions specifically addressing wearable emotional-biometric surveillance. The following cases provide direct or analogous legal principles.

1. KONOVALOVA v. RUSSIA (2014) — DIRECT RUSSIAN MEDICAL-PRIVACY AUTHORITY

The European Court of Human Rights examined the presence of medical students during childbirth without adequately established consent.

The Court considered the protection of privacy and autonomy under Article 8 of the European Convention on Human Rights.

Relevance: Wearable devices collecting intimate physiological and emotional information must operate with appropriate transparency and respect for personal privacy.

2. S. AND MARPER v. THE UNITED KINGDOM (2008) — ANALOGOUS BIOMETRIC-DATA AUTHORITY

The Grand Chamber examined the retention of fingerprints and DNA profiles by law-enforcement authorities.

It found that indiscriminate retention violated Article 8.

Relevance: The judgment provides important guidance on the risks of excessive retention of sensitive biometric information. Similar principles are relevant when wearable-device operators retain extensive physiological records.

3. BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM (2021) — ANALOGOUS ELECTRONIC-SURVEILLANCE AUTHORITY

The Grand Chamber examined surveillance systems and the safeguards necessary to prevent abuse.

The judgment emphasised the importance of effective oversight and safeguards in large-scale information collection.

Relevance: Continuous wearable emotional monitoring should incorporate purpose limitation, access restrictions and effective protection against misuse.

4. ROMAN ZAKHAROV v. RUSSIA (2015) — DIRECT RUSSIAN SURVEILLANCE-PRIVACY AUTHORITY

The Grand Chamber examined the Russian system of secret interception of mobile telephone communications.

It identified shortcomings in safeguards against arbitrary surveillance and violations of Article 8.

Relevance: This is particularly important when wearable devices are connected to communication networks, institutional monitoring systems or government information infrastructure.

5. BREYER v. GERMANY (2020) — ANALOGOUS DIGITAL-IDENTIFICATION AUTHORITY

The European Court of Human Rights examined the retention of personal information associated with prepaid mobile telephone registrations.

The decision addressed the relationship between personal information, identification and privacy.

Relevance: It provides useful guidance for assessing the privacy implications of collecting identifiable information through connected wearable devices.

6. VON HANNOVER v. GERMANY (NO. 2) (2012) — ANALOGOUS PERSONAL-PRIVACY AUTHORITY

The Grand Chamber examined the balance between freedom of expression and the right to respect for private life.

It considered the reasonable expectations of privacy and the public-interest justification for publishing personal information.

Relevance: The judgment is relevant when wearable emotional-biometric information is disclosed to employers, media organisations or commercial third parties.

These decisions provide comparative interpretative guidance rather than direct rulings on wearable emotional-biometric technology. The European Convention's applicability to Russia must also be considered in light of Russia's departure from the Convention system on 16 September 2022.

6. LIABILITY AND REGULATORY ENFORCEMENT

Violations involving wearable emotional-biometric systems may result in several forms of legal liability.

A. ADMINISTRATIVE LIABILITY

Article 13.11 of the Russian Code of Administrative Offences establishes administrative liability for various violations of personal-data legislation.

Potential violations include unlawful processing, failure to satisfy applicable data-protection requirements and certain security-related failures.

B. CIVIL LIABILITY

Under applicable civil-law principles, individuals may seek compensation for legally recognised harm resulting from unlawful disclosure, misuse of personal information or other wrongful conduct.

C. CRIMINAL LIABILITY

Depending on the circumstances, unlawful collection or disclosure of information concerning private life may engage Article 137 of the Russian Criminal Code.

Unauthorised access to protected computer information may also engage Article 272 where its statutory elements are established.

D. EMPLOYMENT-RELATED LIABILITY

Employers may face legal challenges where workplace emotional monitoring violates employee personal-data protections, privacy requirements or applicable labour-law obligations.

7. PRACTICAL COMPLIANCE REQUIREMENTS

Organisations developing or deploying wearable emotional-biometric systems in Russia should:

Identify whether collected information constitutes personal data or biometric personal data.

Establish a lawful basis for every processing purpose.

Provide transparent information about emotional profiling.

Avoid treating algorithmic emotional classifications as medically established facts.

Implement data-minimisation and retention controls.

Secure wearable devices, mobile applications and cloud databases.

Assess Russian data-localisation and international-transfer requirements.

Obtain appropriate consent where required.

Establish safeguards against discriminatory workplace monitoring.

Verify medical-device registration requirements where products have medical purposes.

Maintain procedures for responding to personal-data breaches.

Conduct periodic privacy and cybersecurity assessments.

8. CONCLUSION

Wearable emotional-biometric regulation in Russia is based on a combination of personal-data protection, biometric identification, healthcare, employment and information-security legislation.

Federal Laws Nos. 152-FZ, 323-FZ and 149-FZ, together with relevant Labour Code provisions, establish important legal requirements for the collection, analysis, storage and disclosure of wearable emotional-biometric information.

The distinction between ordinary physiological monitoring, emotional profiling and biometric identification is particularly important because each may trigger different legal obligations.

Although Russian case law specifically concerning wearable emotional-biometric technology remains limited, judicial authorities concerning biometric retention, electronic surveillance, medical privacy and personal autonomy provide relevant interpretative principles.

Ultimately, lawful deployment requires transparency, proportionality, appropriate legal grounds for processing, strong cybersecurity and effective protection against discriminatory or intrusive emotional surveillance.