Be my guest – internet companies must go local in Russia

On 1 July 2021 a new law requiring online businesses to obey the national laws and register with the Russian authorities took effect. By the end of 2021, internet companies must open offices in Russia.

Purpose of new law

According to Parliament's explanatory note, the purposes of the Federal Law On Activities of Foreign Persons in the Information and Telecommunication Network Internet in the Territory of the Russian Federation (1 July 2021, 236-ФЗ) (the law) are to "formalize the official presence of foreign companies, whose business in the IT field affects interests of Russian nationals" and "establish equal business conditions for Russian and foreign persons". In fact, the law will help the authorities to apply their online and offline coercive measures to global websites or apps existing beyond the Russian borders.

Who must comply?

The law applies to the following businesses (the internet companies):

• non-Russian legal entities, other organisations and natural persons who own a website (or at least a page on a third-party website), mobile app or IT system (a web resource) that has more than 500,000 user visits from Russia daily and meets any of the following criteria:
  • it contains information in Russian, a regional language of the Russian Federation or other language of Russian ethnic
  • it disseminates ads intended for Russia-based customers;
  • it processes data about users located in Russia; and
  • the owner of the web resource accepts money from Russian natural or legal persons; and/or
• non-Russian natural persons or legal entities, regardless of the number of users, that are:
  • hosting providers or other persons that host web services used by Russians;
  • advertising networks if they disseminate ads intended for Russian customers; and
  • entities that operate information systems or software intended or actually used for receiving, transferring, delivering or processing electronic messages of web users, including those residing in Russia (so-called "organisers of data dissemination"). In other words, if a website or app supports user accounts, posting or messaging, it may fall under the law.

According to article 8 of the law, the Russian Data Protection Authority (Roscomnadzor) should record the owners of web resources in a publicly available register.

Under article 4(3) of the law, the government should establish a procedure for Roscomnadzor to identify hosting providers, advertising networks and organisers of data dissemination that are subject to the law. Roscomnadzor will list them on the aforementioned public register.

Opening Russian offices

As of 1 January 2022 internet companies will have to establish a branch office, representative office or subsidiary and ensure its functioning in Russia. Under article 7 of the law, this office or subsidiary must:

• accept and process correspondence from Russian nationals and entities;
• execute court judgments and decisions (demands) of the authorities addressed to the relevant internet company;
• represent the internet company before the Russian courts; and
• block or delete content that is illegal under Russian law.

According to article 55 of the Civil Code, the establishment of a branch or representative office will create a physical presence of a foreign company in Russia because these offices are regarded as standalone units of that company. A subsidiary is a legal entity incorporated and existing under Russian law. The subsidiary is not liable for debts of its shareholder(s). In cases where the parent company instructs its subsidiary to transact, the parent company may bear joint liability arising out of such transactions (article 6(3) of the Federal Law On Limited Liability Companies (8 February 1998, 14-ФЗ), as amended).

Other responsibilities

From 1 July 2021 the law requires that internet companies:

• place a feedback form on the web resource so that Russian nationals and entities may submit their letters (article 5(1) of the law);
• create an account at Roscomnadzor's official website and use it to liaise with the Russian authorities (article 5(2) of the law);
• apply to Roscomnadzor's register of internet companies within 24 hours of creating the account (article 8(2) of the law);
• install a user counting software proposed by Roscomnadzor on the web resources (article 8(10) of the law); and
• comply with the personal data localisation requirement – namely, ensure recording, systemisation, accumulation, storage, clarification (update, change) and extraction of personal data of Russian Federation nationals with the use of databases located in the territory of the Russian Federation when collecting this personal data in any manner, including via the Internet (article 10(4) of the law).(1)

Coercive measures

Roscomnadzor must monitor the web for internet companies that fall under the Law but that have not registered voluntarily and add them to the aforementioned register. Depending on the particular breach, Roscomnadzor may apply the following measures without recourse to the courts (article 10(4) of the law):

• partially or completely block access to a web resource within the territory of Russia;
• restrict money transfers to an internet company from Russian individuals and legal entities;
• prohibit an internet company from collecting Russian nationals' personal data and restrict cross-border transfers to the internet company from Russia;
• restrict advertising or including a web resource in search engine results; and
• inform users of the non-compliance of a web resource with Russian law by adding the relevant notice to search engine results.

What to do

The first step for companies is to check whether their web resources fall under the law based on the aforementioned criteria. If so, the following action plan may be considered:

• audit the compliance of their web resources with Russian law, with a special focus on:
  • the personal data localisation requirement;
  • content moderation rules; and
  • advertising;
• add a feedback form to their web resources as prescribed by the law;
• either voluntarily create an account with Roscomnadzor and apply to its register or wait until Roscomnadzor identifies their web resources;
• consider what type of local office fits best and how much time and effort they need to establish it in Russia; and
• keep monitoring all developments concerning the law as well as law enforcement cases and mass media.

For further information on this topic please contact Stanislav Rumyantsev at Gorodissky & Partners by telephone (+7 495 937 6116) or email (rumyantsevs@gorodissky.com). The Gorodissky & Partners website can be accessed at www.gorodissky.com.

Endnotes

(1) For further information please see "Russian Privacy Watchdog Inquires About Fulfilling Localization Requirement".