On 1 July 2021,[1] Federal Law No. 236-FZ on the Internet Activities of Foreign Entities in the Russian Federation (the “Law”)[2] came into force, requiring establishment of local presence, such as a branch, a representative office, or a subsidiary, for foreign Internet companies whose activities are focused on Russian users. The Law supplements the personal data localisation requirements under the Personal Data Law,[3] in effect since 1 September 2015. Those earlier localisation obligations have run into enforcement challenges, and the Law is intended to facilitate interaction between foreign Internet companies and Russian authorities and users and, in turn, improve compliance.
Applicability. The Law defines “foreign Internet companies” as companies that own a website, information system, or software (“information resource”) which is accessed daily by more than 500,000 users residing in Russia. The Law applies if one of the following conditions is met:
- the information resource contains or disseminates information in Russian or languages of Russia’s constituent republics or nationalities;
- the information resource contains advertisements targeting Russian users;
- the foreign Internet company processes data relating to Russian users; or
- the foreign Internet company receives payments from Russian individuals or legal entities.
Federal Service for Oversight of Communications, Information Technologies and Mass Media (“Roskomnadzor”) determines which foreign Internet companies are subject to the Law and will make their list available on its website.[4] A foreign Internet company can be removed from Roskomnadzor’s list (1) pursuant to its application, if its information resource has been accessed by fewer than 500,000 Russian users daily for 3 months; or (2) on Roskomnadzor’s initiative, if the information resource has been accessed by fewer than 500,000 Russian users daily for 6 months.
Legal Requirements. A foreign Internet company subject to the Law must:
- place an electronic contact form for Russian users on its information resource;[5]
- register a user account on Roskomnadzor’s website and use it to communicate with Russian authorities;
- beginning on 1 January 2022, establish and maintain local presence in Russia through a branch, a representative office, or a Russian legal entity.
That local establishment must accept and consider inquiries from Russian users, represent the foreign Internet company in courts, comply with court judgments and decisions of authorities issued in respect of the foreign Internet company, and limit or remove access from Russia to information that is contrary to Russian law.
Enforcement. If a foreign Internet company fails to comply with the Law or other Russian law requirements, Roskomnadzor may:
- take measures that the Russian users of the information resource are informed that the company is in breach of Russian law;
- prohibit advertising of and by the company in Russia;
- restrict money transfers by and payments to the company via Russian lending institutions and mobile and postal service operators;
- restrict search results relating to the information resource of the foreign Internet company on search engines focused on Russian users;
- prohibit collection and cross-border transfer of personal data of Russian citizens; or
- partially or fully limit access from Russia to the information resource of the foreign Internet company.
These enforcement measures can be taken for the breach for the Law or other Russian legal requirements by foreign Internet companies. Specific measures to be implemented would depend on the severity of the breach, with the more severe measures limited to circumstances where the company does not initially comply with Roskomnadzor’s rulings. In particular, failure to localise Russian personal data, as required by the Personal Data Law, can give rise to the most severe measures described above, in addition to the measures already envisioned for the breach of the Personal Data Law.
* * *
We would be happy to answer any questions you may have.
To subscribe to the Data Blog, please click here.
[1] Certain provisions will enter into force on 1 January and 1 September 2022.
[2] The Law’s electronic docket can be accessed by following this link: https://sozd.duma.gov.ru/bill/1176731-7.
[3] The obligation to ensure that the recording, systematisation, accumulation, storage, specification (updating, amendment), and extraction of personal data of Russian nationals are performed through databases located in the Russian Federation as required by Article 18(5) of Federal Law No. 152-FZ on the Personal Data dated 27 July 2006.
[4] Roskomnadzor Order on the Procedure for the Placement of the List became effective on 2 August 2021, however, the list is not available on Roskomnadzor’s website.
[5] The requirements for such form will be established by Roskomnadzor.
