One year ago the President of the Russian Federation signed the Federal Law No. 242-FZ "On Amendments to Certain Laws of the Russian Federation in Order to Clarify the Procedure for Personal Data Processing in Information and Telecommunications Networks" (the "Localization Law"). The Law which still poses many unanswered questions to companies with presence in Russia will come into force on 1 September 2015.
Local commentators in Russia suggest that the new amendment is intended to prevent foreign intelligence services from accessing Russian citizens’ data, as well as facilitating such access by Russia’s own law enforcement agencies.
The main legal amendment implemented by the Localization Law includes the obligation for operators to ‘record, systemise, accumulate, store, update, change and retrieve personal data with the use of data centres located in the territory the Russian Federation’.
The new law applies to all companies conducting business activities in Russia that involve processing of personal data of Russian citizens. Law also is applicable to all types of legal entities: to local companies and subsidiaries, branches, representative and sales offices of large multinationals.
Law does not stipulate if data must be processed solely within databases located in Russia or if copies of data are allowed outside Russia. As per unofficial commentary from the local data Protection Authority ("Roskomnadzor"), companies have to ensure that the processing of personal data of Russian citizens should be performed using primarily databases that are located in Russia. New law does not prohibit data transfers outside Russia, therefore personal data of Russian citizens could be transferred abroad, provided that such international transfers are in accordance with data protection laws.
The law allows only for a narrow set of exceptions in the following circumstances: achieving the objectives of international treaties or laws, the implementation of an operator’s statutory powers and duties, the administration of justice, the acts of public law entities and organisations that provide state and municipal services, the professional activities of journalists and/or the lawful activities of mass media, or scientific, literary or other creative activities provided that this does not violate a data subject’s rights and legitimate interests.
When notifying Roskomnadzor about the commencement of processing of personal data, company will be required to provide data on the location of the database containing Russian citizens’ personal information. However, such notification is not required in some cases, in particular where personal data is processed in accordance with labour laws in connection with the conclusion of a contract to which a personal data subject is a party or where personal data subjects’ full names only are collected.
Failure to comply with the Localization Law may result in the imposition of sanctions on the company that process Russian citizens data. The Localization Law grants Roskomnadzor two significant powers: the first power allows Roskomnadzor to block access to the websites and online resources which process personal data in an illegal manner. The second power allows Roskomnadzor to create ‘naming and shaming’ register. The online register will maintain banned domain names, network addresses and other details of law infringers.
In additional to blocking websites and creating register of infringers, the current sanctions under the Russian Data Protection laws will apply. Current monetary fines for data protection law violations are between RUB 5,000 – RUB 10,000. (approx. 100.00-150.00 EUR). Currently monetary fines do not seem to be significant; however it is not clear whether the fines will be computed on a per incident basis or according to the number of data record affected.
The Russian parliament is currently discussing the draft bill that proposes to increase monetary fines to up to 4,500 EUR.
Businesses are eagerly waiting for Roskomnadzor or other relevant authorities to issue official comments or practical guidance before law is tested in practise.
Access to the Roskomnadzor website (In English) can be found here.