On 7 July 2016 the President of the Russian Federation signed Federal Law No. 374-FZ “On Amendments to Federal Law “On Counteracting Terrorism” and to Certain Other Legal Acts of the Russian Federation with regard to Establishing of Additional Measures on Counteracting Terrorism and Ensuring Public Security” (the Law).
Among certain other anti-terrorism legislative amendments, the Law introduces substantial changes to the Federal Law No. 126-FZ “On Communications” and the Federal Law No.149-FZ “On information, informational technologies and protection of information” which relate to recording and storage of the telecom services’ customers and Internet users’ data and communications in Russia.
Particularly, the Law requires that telecom operators shall store in the territory of the Russian Federation information about facts of receipt, transmission, delivery and (or) processing of their customers’ voice data, text messages, pictures, sounds, video-messages or other messages within three years as of the date of receipt, transmission, delivery and (or) processing of such customers’ messages. Organizers of information dissemination1 shall store the same information with regard to the Internet users’ messages within one year.
It should be pointed out that organizers of information dissemination have already been required to store data about facts of receipt, transmission, delivery and (or) processing of Internet users’ messages since 1 August 2014, subject to requirements of the Federal Law of the Russian Federation dated 5 May 2014 No. 97-FZ; however, the period of such storage has been increased by the Law —from six months to one year. In addition, the organizers of information dissemination’s existing obligation to comply with state authorities’ requirements with respect to hardware and software used in their informational systems, as well as to ensure interaction with the state authorities’ systems for the aims of conducting operative research activities and ensuring public security, is further elaborated in the Law. The Law provides that organizers of information dissemination are obliged to provide state authorities information necessary to decode users’ messages in case organizers of information dissemination implement technical means of additional encryption of electronic messages (i.e. using https) or render the possibility for the user to apply technical means of additional encryption of electronic messages within the organizers of information dissemination’s system or service (i.e. encryption used in messengers).
The most important novelty provided by the Law with regard to the described subject relates to the storage of the contents of users’ messages (metadata). According to the Law, both telecom operators and organizers of information dissemination shall store in the territory of Russian Federation telecom operators’ customers and Internet users’ (accordingly) text messages, voice data, pictures, sounds, video-messages or other electronic messages up to six months as of the date of receipt, transmission, delivery and (or) processing of these messages. The manner, period and scope of data to be stored will be further specified in subordinate legislation. The above information shall be provided by organizers of information dissemination and telecom operators to state authorities responsible for conducting operative research activities and ensuring public security when it is required by the law.
The Law provides for administrative liability in a form of a fine which is up to:
- One million Rubles for not providing by organizers of information dissemination to state authorities:
- information necessary to decode electronic messages, as well as
- information about facts of receipt, transmission, delivery and (or) processing of their Internet users’ messages;
- 300,000 Rubles for using of uncertified technical means of encryption within transmission of messages on the Internet.
The Law will enter into force on 20 July 2016, except for requirements related to storage by telecom operators and organizers of information dissemination of users’ metadata, which will enter into force on the 1 July 2018.