The Ministry of Telecom and Mass Communications (the “Ministry”) has recently published the long-awaited guidance on implementation of new requirements for localization of Russian citizens’ personal data, which entered into force on 1 September 2015 – the Federal Law No. 242-FZ dated July 21, 2014 (the “Law”). We have previously provided updates on the status of this legislation in various publications.
The guidance is provided in the form of FAQs and responses. It is available on the official website of the Ministry (in Russian).
N.B. The Ministry’s answers are not legally binding, albeit this is a first publicly available official position of a state body which is responsible for the regulation of personal data in Russia. The Ministry supervises the Russian data protection regulator, which is known as the Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass (the “Roskomnadzor”).
Set out below is a short summary of the most important clarifications.
1. No Retroactive (Ex Post Facto) Effect of the Law
The Ministry has confirmed that the Law, namely, the data localization requirement, is not applicable if personal data was collected before the Law entered into force (1 September 2015). Rather, it applies only to processing of personal data which will take place after the Law entered into force. In other words, starting from 1 September 2015, collecting new personal data of Russian citizens must be done in accordance with the new data localization requirements.
2.Cross-border Transfer of Personal Data is Not Prohibited
Further, the Ministry elaborated on issue of cross-border transfer of personal data. In particular, the Ministry has made it clear that the Law does not impact the provisions of the Federal Law No. 152-FZ dated July 21, 2006 “On Personal Data” (“Personal Data Law”), which directly allow cross-border transfer of personal data subject to a number of formal requirements (e.g. obtaining a consent) – article 12 of the Personal Data Law.
The other question was how such cross-border transfers of personal data will work in light of the Law? See point 3 below.
3. Foreign Copy of Russian Database and Remote Access Thereto
The Ministry elaborated that generally cross-border transfer of personal data, i.e. storing personal data of Russian citizens in a foreign database (“secondary database”) is allowed, provided that such data is primarily collected, stored and kept updated in a database located in Russia (“primary database”). Secondary databases can be used, for example, for the purposes of keeping a back-up copy.
Therefore, the Ministry has confirmed that it is possible to have a foreign duplicate copy of a Russian database. Importantly, the Ministry provided two examples of when keeping Russian personal data outside of Russia is allowed:
- if the processing of such data falls under one of the exemptions, provided in the Law (see our previous publications)
- if the processing of such data does not fall under one of the exemptions but the volume of data kept in the foreign database is less than or equal to that kept in the database located Russian Federation
In addition, the Ministry has also confirmed that providing remote access to primary databases to someone located outside of Russia is not prohibited.
4.To Whom the Law Applies or the Criteria of Focused Activities
The Ministry proposed to answer an unpleasant question: whether the Law applies to persons without any presence in Russia (i.e. a subsidiary or branch or representative office). In answering this question, the Ministry has introduced the so-called criteria of focused activities. In other words, if one focuses on the Russian market by means as described below, the Law will apply.
The Ministry stated that the Law will focus on web resources, such as a website or a website page, which are used by a person to carry out activities focused on the territory of the Russian Federation. The focus of a website on the territory of the Russian Federation may be evidenced by:
- the use of a domain name associated with the Russian Federation or a constituent entity of the Russian Federation (.ru, .рф., .su, .москва, .moscow etc.) and/or
- the existence of the website’s Russian language version created by the website owner or another person acting on the website owner’s behalf (the use of plugins which provide the functionality of computer-aided translation from various languages by the website or a user per se should not be taken into account)
A website can be identified as focused on the territory of the Russian Federation if at least one of the following additional requirements is met:
- settlements may be carried out in Russian rubles
- a contract which is entered into via that website may be performed in the territory of the Russian Federation (goods may be supplied, services rendered or digital content used within Russia)
- advertising, which makes reference to the appropriate website, is made in Russian language
- other considerations which bear record to the intention of the website owner to incorporate the Russian market into its business strategy
Thus the Law will apply to foreign persons provided that they carry out activities focused on the territory of the Russian Federation in the absence of the exceptions expressly set forth in the Law.
In our view such criteria is vague, questionable and will be subject to further clarifications. In addition, neither the Law nor other Russian laws contain such criteria. Therefore, please note that this is only a non-binding position of the Ministry.
5.Processing of Personal Data Made in Course of Complying with Russian Labor Laws
The Ministry has confirmed the proposition that the Law will not apply to employers who process the personal data of Russian citizens (employees or candidates) provided that this is made solely for the purposes of conclusion and execution of employment contracts with them, i.e., in order to comply with requirements of Russian (labor) laws (one of the exceptions).
In such cases, keeping Russian data abroad is fine as long as consents are duly obtained including for the cross-border transfer and storage of personal data.
However, it is worth to mention that the Roskomnadzor reserves its right to examine the purposes for which the employer is transferring personal data to foreign databases and whether or not this falls under the respective exceptions.
6. Booking of Airline Tickets
Another clarification concerned a question whether the Law applies to booking airline tickets including online booking.
The Ministry has clarified that the answer is no. The Law will not apply because this falls under an exception (processing is necessary to achieve goals prescribed by an international treaty and federal laws).
This is so because Russia is a signatory to a number of international conventions relating to air transportation services, in particular the Chicago Convention, the Warsaw Convention and the Guadalajara Convention. In addition, in accordance with article 85.1 of the Air Code of the Russian Federation for the purposes of maintaining aviation security the carriers are to procure for the transmission of personal data of passengers on an aircraft to the computer data bases of passenger personal data in compliance with the legislation of the Russian Federation on transport security and the legislation of the Russian Federation on personal data and, in case of international air carriage, also to the authorized agencies of foreign countries in accordance with the international treaties of the Russian Federation or the laws of foreign countries of departure, destination or transit.
In this regard, the Ministry believed that the Law does not apply to the activities of:
- Russian as well as international air carriers
- parties acting on behalf of an air carrier (an authorized agent)
- other parties
The Ministry’s clarification applies to the extent relating to the processing of personal data of passengers solely for the purposes of booking, processing and issuance of airline tickets (travel tickets), baggage checks or other travel documents, including those in electronic form, for the domestic and international flights