training-data-review

name	training-data-review
description	RU-unique. Review training data на compliance — 152-ФЗ ПДн в training data, авторские права (для generative AI — критично!), public datasets licensing, sensitive content filtering, sanctions-related sources (post-2022).
argument-hint	[training data source / описание]
user_invocable	true
ported_at	"2026-05-19T00:00:00.000Z"
adaptation_category	D
last_legislative_update	2026-05

/training-data-review

Назначение

Pre-training review data sources для compliance + risk avoidance. Critical для:

• Fine-tuning LLM на specific data
• Training classical ML на customer data
• Computer vision training на images
• Building NL processing dataset

Categories training data sources

A. Internal data (наша)

• Customer interactions (chat logs, support tickets, calls)
• Internal documents
• Employee data
• Business transactions

B. Public data (open source)

• Common Crawl
• Wikipedia
• Public papers / books in public domain
• Open datasets (HuggingFace, Kaggle, etc.)

C. Purchased / Licensed data

• Commercial datasets от vendors
• News archives под licenses
• Industry-specific data

D. User-generated content (UGC)

• Social media posts / comments (если у нас platform)
• Forum posts
• Reviews

E. Synthetic / generated data

• Augmented from real data
• Fully synthetic generation
• LLM-generated training data

Review framework

A. ПДн compliance (152-ФЗ)

Identify ПДн в training data

## ПДн assessment

- [ ] Имена / контакты
- [ ] Адреса
- [ ] Идентификаторы (ИНН, СНИЛС, паспорт)
- [ ] Биометрия
- [ ] Health data (special category — ст.10)
- [ ] Political / religious / sexual orientation (special category)
- [ ] Photos / voice — могут identifying
- [ ] Quasi-identifiers (комбинации dating, location, demographic — могут identify)

If any → 152-ФЗ applies.

Legal basis assessment

## Legal basis для использования ПДн в training

| Basis | Когда applicable | Documentation needed |
|-------|------------------|-----------------------|
| Согласие субъекта (ст.6 ч.1 п.1) | Если consent explicitly включает training AI | Запись согласия + scope |
| Договор (ст.6 ч.1 п.5) | Если training необходимо для оказания услуг по договору | Договор + анализ необходимости |
| Законные интересы (ст.6 ч.1 п.7) | Если интерес weighs over interest субъекта | Документация баланса interests + assessment |
| Public availability (ст.6 ч.1 п.10) | Если data publicly available **и** разглашена самим субъектом | Документация source — public |

⚠ **Если нет legal basis** → нельзя использовать ПДн.

Anonymization / De-identification

## Если anonymization possible

- **Direct identifiers removal** (имена, ID, контакты) — minimum
- **Quasi-identifiers** (combinations) — requires careful handling
- **k-anonymity / differential privacy** — для material exposure
- **After anonymization** — если truly anonymized, no longer ПДн (ст.3 152-ФЗ)
- **Risk re-identification** — high if data rich

→ Recommend anonymization где applicable; verify сложность re-identification.

Special category ПДн

## Special category check (ст.10 152-ФЗ)

If training data contains:
- Раса / этническое происхождение
- Политические взгляды
- Религиозные / философские убеждения
- Сведения о здоровье
- Биометрия (для identification)
- Sex life / sexual orientation
- Criminal records
- (новые с 2024: трудовая активность, имущественное положение, и др.)

→ Use требует **отдельное явное согласие** OR одно из ограниченных оснований
ст.10. **Higher scrutiny**.

B. Copyright + IP compliance

Copyright в training data

## Copyright assessment

### Licensed for training?

- [ ] Source имеет explicit "OK for AI training" — best
- [ ] Source имеет broad license covering ML use — good
- [ ] Source — public domain — OK
- [ ] Source — CC license — check specific (some restrict commercial use)
- [ ] Source — fair use claimed (с argument) — risky в РФ (нет US fair use doctrine)
- [ ] Source — unlicensed scraped — high risk

### РФ-specific copyright considerations

- РФ не имеет US fair use doctrine — strict licensing required
- **Ст.1274 ГК** — citation / scientific use allowed limited (не commercial training)
- **Произведения public domain** — после 70 лет с смерти автора (ст.1281 ГК)
- **Произведения с CC-BY** — атрибуция required
- **Произведения с CC-NC** — нельзя commercial use (в т.ч. training)

### Specific risk areas

| Source type | Risk | Mitigation |
|-------------|------|------------|
| News articles | High | Licensed datasets only |
| Books | High | Public domain only or licensed |
| Code (GitHub) | Medium | Check repository licenses; OSS licenses preserved |
| Images | High | Stock photo licensing или CC-BY/CC0 only |
| Music / audio | High | Licensed only |
| Movies / video | High | Licensed only |
| Wikipedia text | Low | CC-BY-SA — share-alike but attribution required |
| Scientific papers | Med | Open access (CC) OK; subscription — careful |

C. Sensitive content filtering

## Sensitive content в training data

- [ ] Hate speech / extremism (запрещён ст.6 ФЗ-114 для distribution)
- [ ] Criminal content
- [ ] Sexually explicit material
- [ ] Content involving minors
- [ ] Self-harm / suicide content
- [ ] Misinformation / disinformation
- [ ] State secrets

→ Filter / remove before training. Otherwise:
- Model может generate such content
- Liability для harmful outputs
- Compliance violations

D. РФ-specific concerns post-2022

## Sanctions / source country issues

### Sources from недружественных stran

- US-origin datasets — потенциальная access ограничена (HuggingFace might restrict)
- Some datasets могут содержать content "discrediting" РФ (ст.20.3.3 КоАП) — flag

### Russian government data

- Открытые государственные dataset (https://data.gov.ru) — OK
- Restricted source data — separate clearance

### Foreign vendors

- US OFAC may restrict providing data services к РФ entities
- Practical workarounds (proxy / VPN access) — business risk

E. Quality + bias

## Quality + bias

- [ ] Data representative of population AI будет serve?
- [ ] Subgroup coverage adequate?
- [ ] Labels / annotations quality verified?
- [ ] Data freshness / staleness OK?
- [ ] Outliers / noise managed
- [ ] Class imbalance addressed

Workflow

Шаг 1. Inventory training data sources

## Training data inventory

| # | Source | Type | Volume | License | ПДн? | Risk |
|---|--------|------|--------|---------|------|------|
| 1 | Internal chat logs 2023-2025 | Internal | 1M conversations | Internal use | Yes (имена, content) | 🟡 |
| 2 | Wikipedia RU | Public | 5GB | CC-BY-SA | No | 🟢 |
| 3 | Customer support tickets | Internal | 500k | Internal use | Yes | 🟡 |
| 4 | Industry papers (purchased) | Licensed | 100GB | Vendor license | Maybe (authors) | 🟢 |
| 5 | Web scrape news 2024 | Scraped public | 50GB | None | Yes (subjects in news) | 🔴 |

Шаг 2. Per-source compliance check

Apply checklists A-E above to each source.

Шаг 3. Risk findings + mitigation

## Findings

### 🔴 Critical

1. **Web scrape news (source 5)** — copyright violation risk + ПДн без legal basis
   - Mitigation: drop этот источник, ИЛИ licensed alternative

### 🟡 Medium

1. **Internal chat logs (source 1)** — ПДн в training requires legal basis
   - Mitigation: anonymize before training, ИЛИ documented legitimate interests

### 🟢 OK

1. Wikipedia, licensed papers

Шаг 4. Remediation plan

## Action items

- [ ] Drop / replace problematic sources
- [ ] Anonymization pipeline implemented
- [ ] Legal basis documented для каждого ПДн source
- [ ] Licensed alternatives explored для replacement
- [ ] Filtering pipeline для sensitive content
- [ ] Documentation of training data lineage (для audit)

Шаг 5. Documentation

Создать Datasheet для training data (industry best practice):

• Sources
• Legal basis per source
• Volumes
• Date range
• Known issues
• Mitigations applied

Output

# Training Data Review — [model / use case]

## Bottom line

[Proceed with training / Modify and re-review / Cannot proceed without fundamental changes]

## Sources analyzed

[Table from Step 1]

## Critical issues

[From Step 3 🔴]

## Mitigations applied

[From Step 4]

## Datasheet attachment

[Link to formal datasheet]

## Sign-off needed

- [ ] DPO (для 152-ФЗ aspects)
- [ ] IP counsel (для copyright)
- [ ] AI Officer

Что НЕ делает

• Не performs actual anonymization (это data engineering)
• Не licensed datasets (это procurement + legal)
• Не handles legal review для material commercial models — engage outside-адв ФПА

Why RU-unique

US fair use doctrine — allows certain unlicensed training (с растущим legal challenge). РФ — no fair use; strict licensing required. Plus 152-ФЗ + sanctions overlays.

Правовая основа:

• 152-ФЗ (особ. ст.6, ст.10, ст.18.1)
• Часть 4 ГК РФ (особ. ст.1270, 1274, 1281)
• ФЗ-114 «О противодействии экстремизму»
• ФЗ-149 «Об информации»
• ст.20.3.3 КоАП («discrediting» РФ ВС — для filtering)

---

⚠ Юридический disclaimer

Данный skill — техническая платформа, не оказывает юридических услуг по ст.2 ФЗ-63 «Об адвокатской деятельности». Outputs не заменяют консультацию лицензированного юриста / адвоката ФПА.

AI может галлюцинировать, выдавать устаревшие нормы, неверно интерпретировать факты. Material decisions (увольнение, M&A, налоговый спор, IP litigation) — обязательно engage outside-адв ФПА с релевантной специализацией.

Проект ru-legal и его contributors не несут ответственности за решения, принятые на основе outputs системы. Использование — на свой риск.