Overview of legislation on storage of personal data: December 2014

The draft law specifying the timeframes when Article 4 of Federal Law “On amending certain legislative acts of the Russian Federation as regards clarifying the procedure for processing personal data in information and telecommunication networks” (hereinafter the “Law No.242”) comes into force, was adopted by the State Duma of the Russian Federation in the third reading on December 17, 2014. The Law No.242 adopted earlier, provided a range of substantial amendments, including intensively negotiated provisions on establishing the placement of databases containing personal data of Russian citizens in the Russian Federation and establishing liability for violation of these provisions in form of entering violators into a specially created register and blocking their resources.

The first edition of Law No.242 provided that amendments should come into force starting from September 01, 2016, but later information appeared that the Russian State Duma is considering moving the specified term to an earlier date – January 01, 2015. The shorter term was almost immediately approved by the State Duma of the Russian Federation in the first and then in the second reading against the growing uneasiness on the part of the business and professional community, whose representatives asserted that transferring the existing information systems and databases by the end of 2014 was impossible and in any event would require substantial financial expenditures.

After additional discussion and several public events with participation of representatives from the business community, the lawmakers adopted a compromise decision: amendments will come into force starting from September 01, 2015, unless this term is declined by the President of the Russian Federation, which is unlikely taking into account the pace of developments.

As we have noted earlier, the amendments in the rules for storing, using and distributing personal data of Russian citizens seem to be insufficiently developed and do not take into account the opinions of many specialists as to their shortcomings in relation to technical implementation and further control over compliance with the new requirements. In such conditions, the market participants speak of the need for official comments and clarifications from the Federal Service for Supervision of Communications, Information Technology and Mass Media (Roskomnadzor), which would allow to at least elaborate a minimum action plan for compliance with the new rules. Without official comments, the procedure for applying the new rules remains vague and can cause some participants – operators of personal data to refuse to do business in the Russian segment due to ambiguity and uncertainty of the wordings of Law No.242.

Additional notes

Should any questions arise in connection with the above or if you need any additional materials, please contact Igor Gorokhov or Valentina Alikova, St. Petersburg Office of Capital Legal Services.

This Information letter keeps the clients of Capital Legal Services and other interested parties abreast of information that may, to any extent, affect their activity or cater to their particular interests. The opinions and commentaries expressed in this information letter shall not be deemed as legal opinions and do not cancel the need to obtain legal advice or legal opinion on separate issues