We would like to inform you on the recent enforcement actions against data controllers who do not comply with the data localization requirement.
As you can recall, on December 02, 2019 the Federal Law dated June 13, 2019 No. 729516-7 “On Amending Code of Administrative Offences of the Russian Federation” entered into force. This Law introduced high fines (up to RUB 18,000,000 (approx. EUR 262,080, USD 284,220) for non-compliance with Russian personal data localization requirement (i.e. processing of Russian nationals’ personal data in Russia).
According to the Law, the fine imposed on the companies is up to RUB 6,000,000 (approx. EUR 87,360, USD 94,740) for the first localization offence and up to RUB 18,000,000 (approx. EUR 262,080, USD 284,220) for the subsequent offence.
It took just 2 months for Roskomnadzor to initiate and get the first enforcement judgment. On February 13, 2020 Tagansky District Court of Moscow has imposed administrative fines on Facebook and Twitter in the amount of RUB 4,000,000 (approx. EUR 58,240, USD 63,160) for each company.
Both companies were found guilty of violating Part 8 of Article 13.11 of the Code of Administrative Offenses (failure by the data controller to ensure processing of Russian nationals’ personal data in the country upon collection of the personal data).
Representatives of Twitter and Facebook, as well as representatives of Roskomnadzor, did not attend the court hearing, so the decision was taken based on written materials that were at the court’s disposal.
Companies are required to pay the fines within 60 days as of the entry into force of the court’s decision.
Such high fines can significantly affect the privacy landscape in Russia. Localizing data according to Russian laws still remains a great challenge requiring high costs (especially for datadriven companies), but now it may become a “must-have” measure for those companies which are planning to develop their business in the Russian market.
We hope that the information provided herein will be useful for you. If you or any of your colleagues would like to receive our newsletters via e-mail, please fill in the 'Subscribe' form at the bottom of the page.
Practices: Data Protection and Cybersecurity
Note: Please be aware that all information provided in this letter was taken from open sources. Neither ALRUD Law Firm, nor the author of this letter bear any liability for consequences of any decisions made in reliance upon this information.
We hope that the information provided herein will be useful for you.