Audit of the educational platform website: pitfalls

One of our clients is actively working to improve communication among food-producing organizations. 

The community website is a multifaceted and diverse resource that promotes both an educational platform (seminars, presentations, conferences) and various expert opinions, as well as advertising. Of course, the resource also includes channels for collecting personal information. 

During the site audit, we discovered risks related to latent violations, among other things. According to Article 2 of the Federal Law “On Information, Information Technologies, and Information Protection”: 

• A website on the Internet is a set of programs for electronic computers and other information contained in an information system, access to which is provided through the information and telecommunications network Internet by domain names and/or network addresses that allow identifying websites on the Internet (clause 13).
• A domain name is a symbolic designation intended for addressing websites on the Internet and providing access to information posted on the Internet (clause 15);
• A website owner is a person who independently and at his own discretion determines the procedure for using an Internet website, including the procedure for posting information on such a website (clause 17). 

Part 2 of Article 10 of the Law on Information expressly states that the owner of a website is required to post the following information on the website: name, location and address, and email address. The absence of such information raises the possibility that personal data is being processed by an unidentified person, which carries a fine of up to 700 thousand rubles. 

Documents are created to record the fact of website creation, depending on whether the website is being created to order from a third-party contractor according to a website creation agreement or by employees. In any case, it is necessary to create a comprehensive set of documents and a website acceptance certificate, as well as record additional work and costs for technical support, content, and modernization. 

The audit process also includes an examination of whether, in addition to distinct images, videos, and texts with designated authorship, there are photographic and text materials whose authorship is unknown. This involves independent risks. The amount of compensation sought for the use of such objects could range from several hundred thousand to five million rubles. 

The website owner may only use a trademark on his page with the permission of the copyright holder of that trademark. If the owner owns the trademark copyright, he has the right to display it on his page without restriction. However, if the website's owner uses another person's trademark without permission, this may violate the owner's rights and result in legal consequences. The trademark holder may seek removal or compensation for the unauthorized use of his mark. 

When placing trademarks in the partners section, the copyright holder's consent is also required. Another important aspect of the audit is discussed here: advertising and its verification for compliance with legal requirements, as well as the presence of online advertising marking in cases specified by law. When auditing sites, we pay special attention to the issue of correct execution of informed consent for the processing of personal data, as well as the presence of such processing rules within the organization. At the same time, companies frequently forget that cookie collection needs the site user's separate informed consent to the purposes of such processing. Thus, a legal audit of a site assists its owner in ensuring comprehensive protection from risks posed by regulatory authorities as well as commercial risks that were not properly mitigated in time.