B2B: Is New Data Protection Law a Sign of Things to Come?

The MT Conferences section did not involve the reporting or the editorial staff of The Moscow Times.

As the current crisis in Ukraine escalates, there is talk of Russia becoming increasingly isolated on the world stage. British Foreign Secretary Phillip Hammond even said this week that without a change in policy, "Russia risks becoming a pariah state." A report by Bloomberg refers to the possibility of further sanctions by the United States being imposed over the coming weeks, with "industry-wide sanctions probable in September." Russia, meanwhile, seems in some areas to be embracing the idea of isolation, at least if the recent amendments to data protection legislation are anything to go by.

This month, the State Duma adopted amendments to the existing laws in this field. The measure that has attracted most attention is the requirement that all personal data relating to Russian citizens will have to be stored in Russia from Sept. 1, 2016. (In this context, personal data means information from which it is possible to identify a specific individual.) Moreover, administrative liability under Article 13.11 of the Code of Administrative Offenses will be applicable when personal data is processed (which includes being recorded, systematized, assembled and stored) in databases located outside Russia. Businesses that commit this offense will face a fine, as may their officers.

Foreign companies doing business in Russia store information about their partners and customers on servers located outside Russia, so they will have to adjust. Some make use of industry-wide standard systems, such as the GDS online ticketing system in the aviation industry. This is used by Russian airlines as well as foreign carriers operating in Russia. However, the effect will be felt by Russian citizens, too: online travel booking, international payment systems and social networking sites will all be affected.

Unless the law is further amended, the result will be that data centers will have to be created in Russia to enable the information to be stored. "All of the [Internet] companies, including the foreign ones, are welcome to store that information," said State Duma Deputy Vadim Dengin, who helped to draft the legislation. However, Dengin wants that data stored only in Russia. "Most Russians don't want their data to leave Russia for the United States, where it can be hacked and given to criminals," the BBC quoted him as saying.

By setting a date more than two years away for the measure to come into force, legislators believe that they have been more than generous in allowing companies time to comply with the new regime. However, some aviation industry analysts reportedly consider that more than two years may be required to set up a viable replacement system in that particular sector.

Moreover, a number of big names in the online world, including Twitter, currently have no presence within Russia. Proponents of the law claim that for such companies, compliance will be simple, but it must nonetheless be open to debate whether companies that fall into this category will consider it worth their while creating data storage facilities purely to enable them to operate in just one market. Facebook already seems to be weighing its options, with its representatives reported to have visited Moscow for discussions with Roskomnadzor.

It seems that for businesses mainly or exclusively targeting a Russian customer base, the new measures will not present undue difficulty. Local hosting offers will no doubt abound in two years' time, and competition may well keep costs manageable. The issue is likely to be slightly more fraught for international players who have to segregate user data by country of origin. The costs of this are greater, and the Russia Beyond The Headlines website quoted the CEO of an international communications company as saying that compliance "will indeed be difficult for complex databases that mix international data." Still, the consensus seems to be that where there's a will, there's a way.

Critics see the measure in terms of aiming to gain further control over the Internet, a natural next step to follow from the blocking of sites promoting so-called "illegal activities" and requirements for bloggers to register. And maybe tightening supervision is part of the plan. However, the move can also be seen as consistent with the aim to establish a national, Russian version of the Internet, an insular measure in a country that both internal and external forces currently seem to be driving toward greater insularity.

The MT Conferences section did not involve the reporting or the editorial staff of The Moscow Times.