On 17 December, the State Duma (the lower chamber of the Russian Parliament) passed legislation that would change the effective date of Russia's new law requiring the local storage in Russia of the personal data of Russian citizens (Data Localization Law) from 1 September 2016 to 1 September 2015. The legislation currently is subject to the Federation Council's (the upper chamber of the Russian Parliament) and president's approvals.
The effective date of the Data Localization Law has been a major point of debate. When originally passed this July, the law was due to go into effect 1 September 2016. Subsequently, legislators proposed to move the date forward to 1 January 2015 and this date change successfully passed three readings within the State Duma. However, consensus on a 1 January 2015 effective date faltered as practical considerations of reworking IT systems to meet the deadline increasingly were voiced by the business community.
While impacted businesses had hoped that the Data Localization Law's effective date would remain 1 September 2016, after having various consultations with IT specialists, legislators decided to set a compromise date of 1 September 2015 and returned the proposal to the State Duma for a second reading. The State Duma adopted the new date in the second and third readings on 17 December 2014. Should the Federation Council and president approve this change, impacted businesses will lose a year of reviewing and implementing their compliance obligations under the law.
For more information on the law’s requirements, our recent webinar on the Data Localization Law is available here. And, for insights on the Data localization Law from the Russian Data Protection Authority's conference on personal data protection, please see our previous post here.