A draft law proposed in Russia would introduce severe monetary fines for noncompliance with Russia’s data protection law, including the data localization requirement, and violations of various internet activity laws.
Draft Law No. 729516-7, On Amending the Code of Administrative Offences of the Russian Federation (Draft Law), was put for consideration of the State Duma, a lower chamber of the Russian Parliament, on June 13. The Draft Law will most likely be considered later in 2019.
The main data privacy law in Russia is federal law On Personal Data, of July 28, 2006 (Personal Data Law). It mainly applies to so-called “personal data operators,” i.e., entities that organize and carry out the processing of personal data and determine the purpose of individuals’ personal data processing.
The Draft Law relates to the so-called “localization requirement” of the Personal Data Law, which came into effect on January 1, 2015. This requirement obliges personal data operators to collect, store, and otherwise process personal data of Russian citizens using databases and servers located in Russia. Notably, at present, there is no monetary penalty for failure to comply with the localization requirement in the Personal Data Law. The only sanction is the restriction to access websites or applications of noncompliant personal data operators, which sanction could be initiated by Roskomnadzor, a Russian data privacy and internet regulator, and imposed by the Russian court’s order.
The Draft Law now proposes to introduce separate penalties on personal data operators for failure to comply with the localization requirement. The penalties would include a fine of up to 6,000,000 rubles (approximately $91,000 at the current exchange rate); in the event of a repeat violation, the fine could be up to 18,000,000 rubles (approximately $273,000).
The Draft Law also proposes to introduce monetary fines for repeated violations conducted by certain types of internet businesses whose activity is specifically regulated by Russian law; namely, information dissemination organizers, audiovisual service owners, messenger organizers, and search engine operators.
The proposed monetary fines on an “information dissemination organizer” (e.g., social network, email service provider, and any other resource allowing internet users to communicate with one another) are as follows:
The proposed fines on an “audiovisual service owner” (e.g., online theatres) are as follows:
The proposed fines on a “messenger organizer” for a repeated noncompliance with any of its statutory obligations (e.g., failure to keep within Russia information about users) may lead to a fine of up to 2,000,000 rubles (approximately $30,000).
The proposed fines on a “search engine operator” are as follows:
The Draft Law has not yet been signed into law and it may be further amended; we will continue to follow its progress.