The law has been signed on how to use recommendation engines in the Internet

According to the Explanatory Note to the draft [1] Law, recommendation engines are understood as technologies that owners of information resources use to promote goods and services, engage and retain the attention of Internet users located in Russia and that are based on the processing of users’ personal data regarding their preferences.

Let us look at the proposed amendments in greater detail.

Federal Law No. 149-FZ “On information, information technologies and the protection of information” dated 27 July 2006 will be supplemented with article 102-2, which establishes:

1. A ban on the use of recommendation engines that infringe the rights and legal interests of individuals and companies, as well as Russian legislation

The Law does not establish an exhaustive list of possible infringements of rights and legal interests of individuals and companies and of Russian legislation, which is likely to enable enforcers to interpret this rule of law broadly.

2. The requirement for informing Internet users that recommendation engines are used on the information resources

Owners of information resources that use recommendation engines must inform Internet users located in Russia to this effect. The Russian Federal Service for Supervision of Communications, Information Technology and the Mass Media (known by the Russian abbreviation Roskomnadzor) will set requirements for the content of information about recommendation engines being used and for how such information must be placed on an information resource.

3. The requirement for making available to the general public the rules for using recommendation engines on information resources and contact data of their owners

Starting from 1 October 2023, the rules for using recommendation engines must be placed in the form of a document in Russian on an information resource where such engines are used. These rules must describe the following:

• the types of data that are used to provide information via recommendation engines;
• the sources of such data;
• the processes and methods for collecting, systematising and analysing data relating to Internet users’ preferences, and supplying information based on such data as well as how such processes and methods are implemented.

Internet users’ access to the rules for using recommendation engines must be unrestricted and free of charge.

In addition, owners of the relevant information resources will have the obligation to place on the information resource an e-mail address for legally significant communications and their own full names (for individuals) and company names (for companies).

4. The procedure forthe owner of an information resource to liaise with Roskomnadzor if any breaches of the Law are identified

Pursuant to the Law, Roskomnadzor may audit information resources in terms of whether they conform to the statutory requirements for using recommendation engines.

If Roskomnadzor identifies an information resource where recommendation engines are used in breach of the statutory requirements, it may request the owner of the information resource to provide information on the use of recommendation engines, as well as access to software and hardware components of such engines to assess whether they conform to Russian legislation.

When the owner of the information resource receives such a request, it must answer the request or provide the requested access within 10 days from receiving it.

Further to the assessment of conformity, Roskomnadzor may send to the owner of the information resource using recommendation engines a notice with a demand that measures be taken to eliminate the breaches. This must be done within 10 days from when the notice is received or within such other period as may be set forth in the notice.

If the owner of the information resource where recommendation engines are used fails to take measures to eliminate the breaches, Roskomnadzor immediately sends a demand that it stop supplying information using recommendation engines. The owner of the information resource that has received such a demand must stop supplying information using recommendation engines within twenty-four hours.

A failure to comply with Roskomnadzor’s demand may give rise to the following negative implications:

• access to the information resource may be restricted by the communications operator providing services of access to the Internet or by Roskomnadzor itself in situations established by Russian legislation until measures are taken to eliminate the beaches of the Law and the relevant notice is sent to Roskomnadzor;
• criminal or administrative liability may be imposed under Russian legislation.

At the same time, no special measures of liability are established.

The Law comes into force on 1 October 2023 and does not apply to operators of state information systems, state authorities and local government bodies.

What to think about and what to do

We advise owners of information resources using recommendation engines to start bringing their operations into compliance with the requirements of the Law, specifically, to develop rules for using such engines and place them on the information resource along with contact information.

Help from your adviser

The lawyers of Pepeliaev Group would be happy to provide comprehensive legal support to companies.

Pepeliaev Group provides the following types of services:

• advising on compliance with the requirements of the Law (including developing the rules for using recommendation engines on information resources);
• advising on issues of personal data processing;
• providing legal support in liaising with Roskomnadzor;
• other services. 

Translated by the Translation Department of Pepeliaev Group. 

---

[1] Draft Law No. 387593-8 “On amending the Federal Law ‘On information, information technologies and the protection of information’ (into the partextent relating to establishing the specifics of providing information)” // https://sozd.duma.gov.ru/bill/387593-8