Data governance regulation

The UK experience

In September 2025, the UK discussed the idea of introducing the Smart Data Scheme, a mechanism for accessing user and business data. Smart data refer to any user and business data that is obtained from companies holding user data by special authorized third parties (ATP) on behalf of the user. Fintech startups, online platforms, analytical services, tariff aggregators, etc. can act as ATPs.

User data are accumulated by companies, but users cannot dispose of their own data, as this is technically difficult: first, they must request their data, then receive it in a machine-readable format, and then transfer it to another company (for example, one from which the user wants to receive a service). Under the Smart Data Scheme, users can instruct ATPs to obtain accumulated data from companies (for example, on banking transactions, tariffs, energy consumption, or subscriptions). Next, when ATP gains access to user data from other companies, it can analyze raw user data to create personalized digital products for the user. For example, ATP can be a financial services provider and use banking transaction data to provide this user with financial advice.

Another area of the Smart Data scheme concerns business data. Executive authorities may request businesses to disclose nonpersonal data accumulated in business processes: information about goods, services, digital content, terms of delivery, availability, price, quality, and user experience. If data are publicly disclosed by one company, other market participants will be able to use them to compare, analyze, and improve their goods and services.

Technically, the Smart Data scheme involves the creation of uniform standards for data formats and interfaces (APIs) through which information can be transferred smoothly, quickly, and securely among data circulation participants.

The UK has also issued guidance on the rules for storing data after the purpose of its processing has been achieved. The only permissible purpose for storage is to preserve the data of a minor user in the investigation of their death. The storage of such data is only permitted on the instructions of the Information Commissioner's Office (ICO). By comparison, in Russia, there is a requirement for telecommunications operators to store user metadata for three years, but this requirement applies to each operator at all times (rather than for a specific purpose), that creates costs for companies to store data which may not be useful to government agencies.

The US experience

In September 2025, California adopted regulations regarding the opt-out mechanism,¹ i.e., instrument for refusing to provide data. Now, browser providers are required to inform users of their right to opt out of sharing their data with digital service providers that they access through browsers and to explain them how to do so.

Russia’s experience

In Russia, personal data subjects are still limited in their ability to control their data, as the law does not provide for the right to transfer data between operators. Against the backdrop of foreign initiatives such as the Smart Data Scheme, this situation widens the gap between the capabilities of Russian and foreign users. The lack of tools such as an opt-out mechanism gives raise to a gray market of personal data and weakens the protection of user rights in the digital economy.

The prospects for the digitalization of the economy depend to a large extent on the quality of user data involvement in economic processes, i.e., on how consciously and actively users manage their own data. Therefore, in order to support national digital business, regulators may introduce amendments to personal data legislation, for example, to enshrine the human right to provide personal data for socially significant purposes, i.e., on altruistic grounds.

From the monitoring issue No. 9 (21), September 2025. Download the full issue (PDF) · issue page at the Gaidar Institute