Overview of legislation on storing personal data

On December 31, 2014, the President of Russia signed a draft law requiring that databases containing personal data of Russian citizens be located on the territory of the Russian Federation starting from September 01, 2015.[1] The amendments will primarily affect IT companies, online stores, online resources used for booking airline tickets and hotels, social networks, mail services, insurance companies and other organizations processing personal data of Russian citizens.

In addition to the requirement that databases be located in Russia, the amendments also provide for including those who violate the requirement into a special register and blocking their information resources.[2]

This provided, the amendments pertain only to the storage of personal data in Russia and do not directly prohibit operators from storing such data outside the Russian Federation as well. It should be noted that the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data stipulates that the Russian Federation shall not prohibit or subject to special authorization transborder flows of personal data going to the territory of another state. It follows that operators should not be prohibited from storing personal data both in and outside the Russian Federation. However, it appears reasonable to wait for official clarifications on the issue.

It is obvious that the amendments to the Federal Law “On personal data” entering into force on September 01, 2015 will cause businesses to bear substantial expenses on creating databases and placing servers in Russia. It is reasonable for companies to consider a possibility of anonymizing personal data, i.e. taking measures aimed at making it impossible to identify the owner of such data without additional information, as one of the methods for reducing the scope of data to be stored in Russia. 

Please also note that the State Duma of the Russian Federation is currently discussing the issue of increasing liability for violations related to personal data processing.[3] In particular, it is proposed to increase the amount of penalties to be imposed on personal data operators for violating the personal data processing regulations. As provided by the proposed amendments to the Administrative Offences Code of the Russian Federation, the maximum amount of penalties for legal entities can be increased from the current 10,000 Rubles to 50,000 Rubles for each violation.

The above amendments to the legislation on personal data leave unresolved a number of issues that can be clarified through adopting respective by-laws and have been negatively perceived by Russian personal data operators. We will monitor the situation and wait for official clarifications on how to apply the above amendments.

Please find here the text of Federal Law No.242-FZ “On amending certain legislative acts of the Russian Federation in relation to the procedure for processing personal data in information and telecommunication networks” dated 21.07.2014.

Please find here the text of Draft Law No.683952-6 “On introducing amendments to the Administrative Offences Code of the Russian Federation”

Additional notes

Should any questions arise in connection with the above or if you need any additional materials, please contact Rimma Leshceva or Zara Russkikh, St. Petersburg Office of Capital Legal Services.

This Information letter keeps the clients of Capital Legal Services and other interested parties abreast of information that may, to any extent, affect their activity or cater to their particular interests. The opinions and commentaries expressed in this information letter shall not be deemed as legal opinions and do not cancel the need to obtain legal advice or legal opinion on separate issues.