Search for:

As of December 2, 2019 Russia significantly increased administrative fines for companies for violations of personal data localization rules and the requirements for online communication services. 1

New stricter liability measures apply to data controllers and processors, platforms with user-to-user communication functionality, instant messaging services, search engines and audiovisual services.

1. Personal data localization

Russia introduced administrative fines for citizens, officers and companies for violation of the obligation to initially record and store personal data of Russian citizens in Russia. Previously, Roskomnadzor, the Russian data protection authority and Internet watchdog, enforced the localization rules through minor administrative fines (of approx. USD 500 – 800) 2 or website blocking. The new law increases administrative fines for the first violation by legal entities to ~ USD 15,000 – 100,000. 3 Fines for repeat violations are within the range of ~ USD 100,000 – 300,000. 4

2. Online communication services

In Russia providers of online communication services with user-to-user communication functionality (for example, social networks, instant messaging programs, websites with user-generated content) must:

  1. register with Roskomnadzor,
  2. store certain information on users, user activities and user communications in Russia, including copies of the relevant textual, audio and video communications,
  3. provide law enforcement agencies with decryption keys for encrypted user communications, and
  4. install surveillance hardware and software for law enforcement purposes.

Roskomnadzor and the Federal Security Service previously had the right to impose fines and to block non-compliant services for violation of these obligations.

The law introduces new fines for repeated violation of these obligations:

a. for repeated refusal of companies that operate online communication services to register in Russia – in the range ~ USD 7,500 – 15,000; 5

b. for repeated refusal to locally store in Russia certain information on users, user activities and user communications, including copies of relevant textual, audio and video communications, and to provide law enforcement agencies with the above data or decryption keys – in the range ~ USD 30,000 – 100,000; 6

c. for repeated violation of the duty to install surveillance hardware and software for law enforcement purposes – in the range ~ USD 30,000 – 100,000. 7

The law also establishes administrative fines for repeat violations of requirements by search engines, audiovisual services and instant messaging providers.

DOWNLOAD ALERT

1 Federal Law of 02.12.2019 No. 405-FZ “On Introducing Amendments into Certain Legislative Acts of the Russian Federation” // http://publication.pravo.gov.ru/Document/View/0001201912020045?index=0&rangeSize=1
2 RUB 30,000 – 50,000 (Art. 13.11 (1) of the Code of Administrative Offences).
3 RUB 1,000,000 – 6,000,000.
4 RUB 6,000,000 – 18,000,000.
5 RUB 500,000 – 1,000,000.
6 RUB 2,000,000 – 6,000,000.
7 RUB 2,000,000 – 6,000,000.

Author

Denis Khabarov is highly recommended in the field of intellectual property by European Legal 500 – 2008, and has been recognized by European Legal Experts 2008 in the area of dispute resolution. He joined Baker McKenzie in 2001 and became partner in 2007. Prior to joining the Firm, Mr. Khabarov was an in-house attorney for the Moscow Companies Registration Authority, where he was in charge of the litigation practice. He currently serves as a member of the Moscow City Bar, the International Trademark Association (INTA) and International Anti-counterfeiting Coalition (IACC). Mr. Khabarov graduated from the Law Faculty of the Russian Peoples’ Friendship University in 2000, and was admitted to practice law in Russia in 2000.

Author

Edward Bekeschenko is a partner in Baker & McKenzie's Moscow office. He is ranked as a leading lawyer in dispute resolution by Chambers and Legal 500. Prior to joining the Firm in 2001, Mr. Bekeschenko headed the legal department of a major Russian metallurgical company and was vice president of a Belarusian law firm.

Author

Vadim Perevalov is a senior associate in Baker McKenzie's Moscow office and is a member of Information Technology & Communications and Intellectual Property practices. Vadim earned his Bachelor of Law and his Master of Law Degree in Commercial Law at the St. Petersburg State University, and was admitted to practice law in Russia in 2009. He currently serves as a member of the Russian Data Protection Authority’s Advisory Board.

Author

Maxim Kalinin serves as managing partner of Baker & McKenzie’s St. Petersburg office and head of the Mergers & Acquisitions, Corporate, Real Estate & Construction and Employment practice groups. He was named a European legal expert in Russia by European Legal Experts 2008, and was recognized by Chambers Europe "for his expertise in M&A and real estate work". He is also cited by Legal 500, Who’s Who Legal 2009, The International Who’s Who of Real Estate Lawyers 2008 and the Private Equity Handbook 2007/2008 for his corporate and real estate work