Subject to new requirements of Federal Law No.152-FZ, starting from September 1, 2015, the recording, systematization, collection, storage, adjustment (updating and alteration) and retrieval of personal data of Russian citizens must be carried out using databases located in the Russian Federation. In response to numerous requests of the business community, the Ministry of Communications published on its web site some clarifications of the provisions coming into effect.

As follows from the clarifications, only the personal data received as a result of acts specifically aimed at collecting such data directly from individuals or through third parties engaged for such purpose, is subject to localization, but not the data obtained as a result of incidental (unrequested) receipt of personal data, e.g. from letters sent by email or otherwise.

Also not subject to localization is the personal data being contact information of employees or representatives of a legal entity if received by another legal entity in the ordinary course of business.

New requirements apply to Russian companies and foreign companies doing business aimed particularly at Russia (e.g. when using a domain name related to the Russian Federation, having a Russian-language version of a web site, ensuring that payments can be made in Russian Rubles or if an agreement concluded through a web site can be performed in the Russian Federation (delivery of goods, provision of a service, etc.), placing advertisements in Russian, etc.). Moreover, requirements for localization do not apply to databases created prior to September 1, 2015, as long as the data contained in such databases is not updated.

In accordance with the clarifications, transfer of personal data outside the Russian Federation is possible, same as earlier, subject to conditions set by the Personal Data Law (in particular, consent of the individual concerned to cross-border transfer of his personal data is required). Personal data of Russian citizens initially registered and updated in a database located in Russia (the “primary database”) can then be transferred to databases located outside Russia (the “secondary databases”) administered by other entities, subject to compliance with provisions on the cross-border data transfer.

In addition, it should also be noted that when a company collects information containing personal data, and processes such information using the computing capacity of another company, the former company is liable for compliance with the statutory requirements, taking into account that its activities are aimed directly at collecting and processing the respective information.

The procedure for determining the citizenship of individuals for purposes of complying with the localization requirements in Russia is to be developed by companies independently, subject to the specifics of their business. In the event a company does not have a citizenship determination procedure, new requirements for localization of personal data in Russia can apply to all personal data collected in the Russian Federation.

It should specially be highlighted that in accordance with the clarifications of the Ministry of Communications, requirements to use databases located in Russia do not apply to activities of airlines and their agents as regards the collection and processing of personal data of passengers for purposes of booking and issuing flight tickets and other carriage documents. 

Pavel Karpunin   Partner   St. Petersburg    pkarpunin@cls.ru   Tel.: +7 (812) 346 79 90

Rimma Tolmacheva   Senior Associate    St. Petersburg       Tel.: +7 (812) 346 79 90

Additional notes

Should any questions arise in connection with the above or if you need any additional materials, please contact Pavel Karpunin or Rimma Tolmacheva, St. Petersburg Office of Capital Legal Services.

This Information letter keeps the clients of Capital Legal Services and other interested parties abreast of information that may, to any extent, affect their activity or cater to their particular interests. The opinions and commentaries expressed in this information letter shall not be deemed as legal opinions and do not cancel the need to obtain legal advice or legal opinion on separate issues.