Russia Considers Monetary Penalties for Noncompliance with Data Protection, Internet Laws

A draft law proposed in Russia would introduce severe monetary fines for noncompliance with Russia’s data protection law, including the data localization requirement, and violations of various internet activity laws.

Draft Law No. 729516-7, On Amending the Code of Administrative Offences of the Russian Federation (Draft Law), was put for consideration of the State Duma, a lower chamber of the Russian Parliament, on June 13. The Draft Law will most likely be considered later in 2019.

Proposed New Sanctions for Violations of the Russian Data Protection Law

The main data privacy law in Russia is federal law On Personal Data, of July 28, 2006 (Personal Data Law). It mainly applies to so-called “personal data operators,” i.e., entities that organize and carry out the processing of personal data and determine the purpose of individuals’ personal data processing.

The Draft Law relates to the so-called “localization requirement” of the Personal Data Law, which came into effect on January 1, 2015. This requirement obliges personal data operators to collect, store, and otherwise process personal data of Russian citizens using databases and servers located in Russia. Notably, at present, there is no monetary penalty for failure to comply with the localization requirement in the Personal Data Law. The only sanction is the restriction to access websites or applications of noncompliant personal data operators, which sanction could be initiated by Roskomnadzor, a Russian data privacy and internet regulator, and imposed by the Russian court’s order.

The Draft Law now proposes to introduce separate penalties on personal data operators for failure to comply with the localization requirement. The penalties would include a fine of up to 6,000,000 rubles (approximately $91,000 at the current exchange rate); in the event of a repeat violation, the fine could be up to 18,000,000 rubles (approximately $273,000).

Proposed Increased Monetary Penalties for Repeated Violations of Certain Internet Laws

The Draft Law also proposes to introduce monetary fines for repeated violations conducted by certain types of internet businesses whose activity is specifically regulated by Russian law; namely, information dissemination organizers, audiovisual service owners, messenger organizers, and search engine operators.

The proposed monetary fines on an “information dissemination organizer” (e.g., social network, email service provider, and any other resource allowing internet users to communicate with one another) are as follows:

• A repeated failure to notify Roskomnadzor on one’s commencing the activity of an information dissemination organizer may lead to a fine of up to 1,000,000 rubles (approximately $15,000).
• A repeated failure to store information about website users’ communications and related metadata and make it available to Russian enforcement authorities, as well as a repeated failure to provide these authorities with decoding keys (if information is encrypted), may lead to a fine of up to 6,000,000 rubles (approximately $91,000).
• A repeated failure to implement technical solutions required to provide information to Russian enforcement authorities may lead to a fine of up to 6,000,000 rubles (approximately 91,000 US dollars).

The proposed fines on an “audiovisual service owner” (e.g., online theatres) are as follows:

• A repeated distribution of a nonregistered TV channel or TV program, or its distribution without due broadcasting license, may lead to a fine of up to 1,000,000 rubles (approximately $15,000).
• A repeated violation of the child protection laws (e.g., failure to label content with appropriate age rating information signs) may lead to a fine of up to 1,000,000 rubles (approximately 15,000).
• A repeated distribution of civil disobedience and extremist content may lead to a fine of up to 5,000,000 rubles (approximately $76,000).

The proposed fines on a “messenger organizer” for a repeated noncompliance with any of its statutory obligations (e.g., failure to keep within Russia information about users) may lead to a fine of up to 2,000,000 rubles (approximately $30,000).

The proposed fines on a “search engine operator” are as follows:

• A repeated failure to provide necessary information to be included to the state system of information resources and networks may lead to a fine of up to 5,000,000 rubles (approximately $76,000).
• A repeated failure to customize search engine results as required by the Russian law may lead, depending on the type of search results, to a fine of up to 5,000,000 rubles (approximately $76,000) or to a fine of up to 3,000,000 rubles (approximately $45,000).

 The Draft Law has not yet been signed into law and it may be further amended; we will continue to follow its progress.