Russia’s Internet Privacy Act will have wide implications for foreign companies

Russia's State Duma (Lower House of Parliament) on 4th July and Federation Council (Upper House of Russia’s Parliament) on 9th July adopted amendments to Russia’s personal data protection act which require that personal data of all Russians is stored inside the country. This “data localization” obligation will have a major impact on global social networking companies but also other companies that transmit electronic communications over the Internet.

The new provisions stipulate that:

∙ When collecting, recording and processing personal data of Russian nationals, data controllers must use servers located on Russian territory. The only exception to this requirement concerns the cases of personal data processing for the purpose of implementation of an international agreement or related Russian law, administration of justice and enforcement of court rulings, provision of public and municipal services, mass media or creative work.

∙ Russia's Data Protection Authority (DPA) will be able to block public Internet access to any service that does not comply with this requirement. In particular, it is assumed that a Register will be created to list those in breach of data subjects’ rights. This would include identifiers, such as domain names and/or indices of web pages of violators, and network addresses.

The body authorized to monitor execution of the law requirements and take actions to enforce the judicial acts will be the DPA, the Federal Agency for Supervision of Communications, Information Technologies and Mass Media (Roskomnadzor).

The Bill is waiting for the signature of the Russian President, Vladimir Putin, and may become effective on September 1, 2016. It means that any foreign company using the personal data of Russian nationals outside Russia must locate its servers in Russian Federation territory. Otherwise, access to this type of information resource will be blocked.

Reported by Ekaterina Lopatnikova, EMBA, Head of Legal Department, Peugeot Citroen, Russia