Russian Data Residency Law Update: Sept. 1, 2015 effective date unchanged, non-binding guidance issued in August In early August, the Ministry of Telecom and Mass Communications of the Russian Federation ("Mincomsvyaz") issued a non-binding guidance for application of the localization law. It is now available in the FAQ section of the Mincomsvyaz website. This guidance provided further interpretations of some outstanding issues related to personal data localization, but what is more important, it suggested new liberal approaches that contradict with previous interpretations of the law by the Roskomnadzor. However, as of today, it is not quite clear whether these liberal approaches will prevail. Besides, the guidance did not give any grounds to believe that the effective data of the law will be changed, or that Russian authorities will offer a leniency period during which they will suspend enforcement against local and/or foreign companies. Below is a brief summary of the approaches provided by the Mincomsvyaz. 1. Criteria of a website targeting Russia Mincomsvyaz proposed using the following facts for initial guidance when considering whether a website targets the territory of the Russian Federation and, thus, is subject to localization requirements: a website is registered with a domain name related to Russia or its regions (e.g., ".ru", ".рф.", ".su", ".москва.", ".moscow", etc.); and / or a website is deliberately translated into the Russian language by the owner of the website or by third parties on the owner's instructions (i.e., cases where a website or particular visitor uses certain plugins for automatic translation will be disregarded). However, due to the fact that Russian is an international language for certain regions, according to Mincomsvyaz it is necessary that a website meets at least one of the below criteria in addition to criteria (a)-(b) or (b) above in order to be considered specifically targeting the territory of the Russian Federation: a website provides the possibility to make payments in Russian rubles; an agreement concluded through a website may be performed on the territory of the Russian Federation (delivery of goods to Russia, rendering of services or use of purchased digital content in the territory of Russia); use of adverts in the Russian language referring to a website; other facts obviously proving the intention of a website owner to target the Russian market. 2. Definition of "collection of personal data" The general understanding widely supported by the Russian authorities is that the localization requirements apply only if there is a collection of personal data by an operator directly from data subjects. Mincomsvyaz further clarified the above interpretation by stressing that only an intentional process of data receiving must be considered as "collection". If an operator unintentionally receives certain data or receives unrequested data, it will not be deemed collecting the data, and therefore, falling under the localization law. In order to illustrate this approach, Mincomsvyaz provided an example where a company unintentionally received an e-mail / mail containing personal data. Mincomsvyaz also indicated that it will not consider as "collection" a situation where a company receives corporate contact details of employees of another company directly from such employees, provided that they acted lawfully and in accordance with their job position when transferring such data. 3. Back-up databases Until recently, Russian authorities unanimously supported the approach that collection of data into a Russian database and mirroring such database abroad would contradict the law. This approach was based on the fact that the law requires a primary operator (the one who collects the data) to perform initial input, storage and output of collected data solely by using Russian databases. However, currently there are signs that a new liberal approach may be adopted with respect to foreign back-up databases. Namely, Mincomsvyaz stressed that once a certain set of personal data is localized in a Russian database, the goals of the law shall be considered reached, and thus, an operator may additionally record such data to its own foreign databases, if necessary. 4. Collection of data through third parties Both Roskomnadzor (in July) and Mincomsvyaz (in early August) stressed that if the data is collected by third parties on instructions and for the benefit of an operator, such operator would fall under the localization requirements despite the fact that technically it does not receive the data directly from the data subjects. 5. Air transport service Mincomsvyaz confirmed that the localization law will not be applied to the activities of Russian and foreign airline companies in so far as they relate to collecting and processing of the personal data of Russian passengers for the purpose of booking, processing and issuing them tickets, luggage tags and other shipping documents. The law will also not apply to the activities of airline companies' agents / other persons in so far as they relate to the processing of personal data of Russian passengers solely for the above purposes and subject to these activities of such persons are provided by the Russian law or the relevant international treaty of the Russian Federation. For more information, please contact Edward Bekeschenko, Alexander Tarasenko or Vadim Perevalov.