Last Friday, Russia blocked LinkedIn based on a Russian court’s finding that LinkedIn violated Russian “localization” law that requires companies holding personal data of Russian citizens to store it on servers located within Russian borders. This law came as an amendment to Russian data privacy laws, “Regarding information, information technologies and the protection of information,” “Regarding telecommunications,” and the Codex of Administrative Violations. The amendments, which came into law in September 2015, required websites and telecommunications providers to begin storing “on the territory of the Russian Federation information regarding the receipt, transfer, sending and/or processing of voice information, written text, images, sounds or other electronic messages of the users of Internet,” within six months after the law went into effect.
Russia took the position that the new requirements were necessary to ensure personal data on Russian consumers is properly protected, something the Russian government said can only be done if the servers are within Russian jurisdiction. The penalty for violating the law by companies was established at 500,000 roubles (approximately $8,000). The law also contemplated a punishment much worse than the monetary penalty. Specifically, the amendment empowered Roskomnadzor, the Russian federal agency charged with overseeing telecommunications services and information technologies, to investigate violations of the new law and to petition courts to block websites who refuse to comply.
Following the adoption of this law, many companies that collect and process Russian citizens’ information began working toward achieving compliance by ensuring that this data stayed on Russian soil. Some, however, decried the law as forcing businesses to needlessly invest in servers in Russia and rework established data workflows.
Soon after the law went into effect, Roskomnadzor began exercising its investigative powers and taking suspected violators to court. To keep track of the adjudicated violators, Roskomnadzor created a special registry of websites marked for blocking in case of continued noncompliance following the adjudication. LinkedIn, which has over 6 million registered Russian users, made Roskomnadzor’s “black list” registry and, on Friday, November 18, became the first website to be blocked in Russia for the violations of the localization law.
Vadim Ampelonskiy, Roskomnadzor’s press secretary, stated that the agency attempted to work with LinkedIn earlier this year, but did not receive a satisfactory response to its inquiries. As a result, on August 4, Roskomnadzor sued LinkedIn in Taganskiy Court, seeking the blocking of the site in Russia. After the Court ruled in favor of Roskomnadzor, LinkedIn appealed to Mosgorsud (Moscow City Court). On November 10, Mosgorsud denied LinkedIn’s appeal and affirmed the order to block the site for the violations of the localization law. Welcoming the Court’s decision, Ampelonskiy, stated that the site may be blocked as early as the beginning of the following week. (Overview of the procedural history of the case is available here and here in Russian.)
On November 11, Roskomnadzor tweeted: “The Court entered an order to block LinkedIn on the territory of the Russian Federation for the violation of the rules related to processing and storage of personal data of its users.” The same day, Roskomnadzor also tweeted: “The compliance investigation was initiated in part due to reports of leaking of data” and “Telecom operators will be instructed to block the [LinkedIn] site within the next few days.” (The tweets are available here in Russian.)
Speculations about “leaked” personal data have been also swirling around the Russian Internet. For instance, Echo of Moscow website stated that violations of the localization law is only a part of the issue. According to Echo of Moscow’s undisclosed sources, there are reasons to believe that LinkedIn “collects and transfers” users’ personal data without consent. Without providing any bases, the site speculates that it is “a big question” to whom LinkedIn transfers this data and that possible answers range from “harmless” marketing companies to various governmental agencies.
On November 18, the day when the blocking of LinkedIn in Russia was carried out, Russian users attempting to access the LinkedIn website through major Russian telecommunications operators were greeted with a message in Russian saying: “Access to the resource you requested is restricted.”
In a message sent via e-mail to its Russian users, LinkedIn said it regretted the decision to block access, and was seeking to resolve the situation with Roskomnadzor. LinkedIn’s message to its Russian subscribers (available here in Russian) stated, in part: “We believe that our activities comply with the local laws, and we are currently exploring all possible ways of resolving the situation and moving forward. We contacted Roskomnadzor with an offer to meet to discuss the request for moving personal data.” According to Russian news reports, LinkedIn promised to continue maintaining Russian users’ profiles, making them visible through searches conducted abroad, and to allow headhunters and potential employers to contact the Russian users via email. Those Russian users who are subscribed to paid LinkedIn services and who cannot now use those services, will be compensated for the loss of those services for the duration of the time that LinkedIn remains blocked in Russia.
Spokesperson of the US Embassy in Moscow Maria Olson told TASS, a primary Russian news agency, that the United States is “deeply concerned” by Russia’s move to block access to LinkedIn.
“This decision is the first of its kind and sets a troubling precedent that could be used to justify shutting down any website that contains Russian user data. We urge Russia to restore access immediately to LinkedIn,” Olson said.
“We will continue to work with LinkedIn and other U.S. companies laboring under this and other anti-competitive and counterproductive market restrictions imposed by the Russian Government to the detriment of the Russian people,” she stressed.
The Russian officials appeared to view the impact of LinkedIn blocking quite differently. Commenting on these developments (available here in Russian), Olga Golodets, the Deputy Prime Minister of the Russian Federation, stated that the blocking of LinkedIn will not have any negative effects on employment opportunities of Russian citizens and will not have any influence on the labor market in the country.
Golodets stated that the primary website providing employment opportunities for the Russians is the portal of Rostrud, a database of vacancies covering all of Russia, “Work in Russia.” According to Golodets, last year alone, more than 4 million people found employment through “Work in Russia.”
Russia’s willingness to block LinkedIn showed that it takes its new localization law seriously and that it is willing to go to extreme length to hold foreign companies accountable. The blocking of LinkedIn is likely to be only the beginning of further enforcement actions.
Some foreign tech giants, however, are passing muster. For instance, on November 15, Roskomnadzor stated on its website that it is satisfied with the efforts of Microsoft Rus (the Russian branch of Microsoft) to correct the deficiencies discovered by Roskomnadzor through its audit earlier this year and that any questions related to Microsoft Rus’ compliance with the localization law are now “closed.” As such, companies doing business in Russia would be well advised to take Russian localization requirements seriously and to undertake concerted efforts to comply with the law. We will continue to follow and comment on the developments.