Data Protection & Privacy Laws 2018 / Russian Federation

This article is part of the Data Protection & Privacy Laws Annual review 2018 by Financier Worldwide. For a full list of contents, please visit https://www.financierworldwide.com/annual-review-data-protection-privacy-laws-2018/

In your experience, do companies in the Russian Federation need to do more to fully understand their data privacy and protection duties in the digital age?

Data privacy and protection has become one of the most discussed topics in the information technology (IT) sector in recent years. In the digital age, amid evolving data privacy laws, companies, including those operating in Russia, as well as foreign investors, should carefully assess their data protection strategies and achieve data privacy compliance to mitigate the associated risks. However, not all of them are fully aware of their rights and obligations in this particular area, especially their confidentiality duties, required security measures, data transfer rules and the ‘localisation’ requirement, when processing personal data online or offline. Indeed, this might be a big challenge for them following the imposition of tougher sanctions for data breaches on a local and global level. More specifically, I am talking about the recently introduced new local administrative fines for various privacy violations and the implementation of the General Data Protection Regulation (GDPR).

Could you outline the latest legal and regulatory developments affecting corporate storage, handling and transfer of data in the Russian Federation?

Of course, companies that are data operators should have an understanding of the major legal and regulatory requirements affecting collection, storage and transfer of personal data in Russia. First, when collecting personal data, the data operator must provide the data subject with certain required information, including but not limited to, the legal grounds and purposes of data processing, methods and duration of data processing, as well as information on cross-border data transfer, if required. If the provision of personal data is mandatory under the law, the data operator is obliged to explain to the data subject the legal consequences of refusing to provide such personal data. In those cases where personal data is collected through the internet, the data operator is obliged to ensure that the recording, systematisation, accumulation, storage, clarification and extraction of personal data related to citizens of the Russian Federation is made with the use of databases located within the Russian Federation. In other words, the ‘localisation’ requirement must be met under the national data protection law. Retention of personal data must be done in a form which allows the data subject to be defined for as long as the purposes of data processing are effective or necessary, unless the specific term of storage of personal data is set forth by the law, or by the agreement to which the data subject is a valid party, beneficiary or guarantor. Personal data must be destroyed or anonymised as soon as the objectives of the data processing have been achieved, or in the event that the achievement of such purposes is no longer effective or necessary, unless otherwise is provided by the law. The transfer of personal data outside of Russia is regulated under Article 12 of the Personal Data Act. In the event of a cross-border data transfer, the data operator must ensure, before such a transfer is made, that the rights and interests of the respective data subject are fully protected in an ‘adequate manner’ in the corresponding foreign country. Cross-border data transfer to countries that do not provide a level of ‘adequate protection’ is permitted if the written consent of the respective data subject has been received, or it is made for the performance of the contract to which the data subject is a party to.

In what ways have the authorities increased their monitoring and enforcement activities with respect to data protection and privacy in recent years?

It is very important to note that local data privacy laws have been heavily enforced in recent years, and the Russian Data Protection Authority is quite active in terms of monitoring data protection compliance. There have been a growing number of data breach cases lately, and the national court practice devoted to data privacy enforcement is developing constantly in Russia.

From 1 July 2017, the administrative sanctions for different privacy violations were increased substantially. For example, data processing, which is not in line with legal requirements for the volume of data provided in the written consent of the data subject, may result in a fine of RUR 75,000. Also, in the case of illegal data processing on the web, access to the infringing website may be blocked in Russia via court decision. Criminal prosecution and imprisonment is available for certain specific categories of privacy violations.

What insights can we draw from recent high-profile data breaches? What impact have these situations had on the data protection landscape?

Recently, the social network ‘LinkedIn’ has been blocked in Russia for not meeting the ‘localisation’ requirement. Also, in Telegram, the Russian court fined the instant messaging service RUR 800,000 for failing to provide the Federal Security Service (FSS) with the decoding keys, as prescribed by Article 10.1 (4.1) of the Russian Data Protection Act. On 22 October 2018, Telegram’s appeal was rejected and the administrative fine was enforced. The law requires all messaging services to ensure the confidentiality of their users’ communications.

In this case, FSS, although entitled to see such communications by law, was refused access by Telegram, which argued that it lacked control over the encoding and decoding processes. The Telegram case shows that if the relevant technology of the messenger does not allow state authorities to gain access to the decoded information, including certain categories of personal data, this may be deemed a data breach.

What steps can companies take to mitigate data risks arising from the use of third parties, such as consultants, agents and distributors?

Third-party processors, including consultants and agents, are basically subject to the same legal requirements as data operators, and they must comply with established data processing rules. Usually, such third parties will be acting under specific data processing agreements, and data operators will be liable for all acts or omissions of processors in front of data subjects, while respective processors must take responsibility before data operators. Importantly, data subjects must consent to the transfer of their personal data to third-party processors.

What can companies do to manage internal data privacy risks and threats, such as liabilities arising from lost devices or the actions of rogue employees?

Internal data privacy risks and threats, such as those arising from lost devices and data leaks, can be mitigated through the implementation of necessary and sufficient security measures prescribed by local laws, regulations and standards. In other words, certain legal, technical and organisational steps have to be undertaken in terms of overall data processing management and compliance. When processing the personal data of employees, it is also very important to have a clear picture of general data protection requirements set forth by the national labour legislation, in addition to requirements provided by the Russian Data Protection Act and the Russian Personal Data Act.

What essential advice can you offer to companies in the Russian Federation on managing data risk and maintaining regulatory compliance going forward?

It is essential to manage data risks and maintain regulatory compliance properly. For these particular purposes, the appointment of data protection officer (DPO), the adoption of a data protection policy, and other required documents, as well as the implementation of appropriate security measures, will be the first key things to do. Allocating functions and responsibilities between competent employees is also necessary. Parties should conduct periodic data privacy audits and ensure ongoing data security controls are in place and that the company is compliant with national data protection requirements.

View PDF