The State Duma has adopted a law on new fines in the area of personal data

The principal new development relates to administrative liability being introduced for the non-performance by personal data operators of their obligation to ensure that personal data (“PD”) is processed with the use of databases located in Russia[1].

The requirement to localise PD of Russian nationals in Russia has been in effect since 1 September 2015. It constitutes an obligation of a PD operator to ensure that, when PD is collected, the PD of Russian nationals is recorded, systematised, accumulated, stored, specified (updated, modified) and retrieved with the use of databases located in Russia.

In the version of the law that has been adopted, the amounts of the fines which have been added to article 13.11 of the Russian Code of Administrative Offences (the “Code of 

Administrative Offences”) have been insignificantly reduced: 

 

• the non-compliance of a PD operator with the PD localisation requirements triggers an administrative fine of RUB 100,000 to RUB 200,000 for an officer (previously it was from RUB 200,000 to RUB 500,000), and of RUB 1 million to RUB 6 million for a legal entity (the lower threshold has been reduced from RUB 2 million as compared with that stated in the text of the draft law adopted in the first reading);
• a repeated offence of such kind may trigger more stringent sanctions, and the amount of the fine may reach RUB 800,000 (initially this was RUB 1 million) for an officer, and RUB 18 million for a company.

The adoption of the draft law in the second and third reading within three business days without any material changes evidences that the state authorities, including the State Duma, are putting an increased focus on ensuring that the PD localisation requirements in Russia are met. In this connection we believe that there is a high probability that the Federation Council will approve the law and the Russian President will sign it in the near future. 

 

What to think about and what to do 

We recommend that companies now check their compliance with Russian PD legislation, specifically in terms of their compliance with the PD localisation requirements, and start preparing for potential control and supervision measures of Roskomnadzor (the Federal Service for the Supervision of Communications, Information Technology and Mass Media), specifically: 

 

• arranging the company's and its employees' activities in terms of processing PD in line with the current legal requirements:
• developing and implementing the necessary internal regulations;
• adopting the technical measures required to protect PD;
• obtaining relevant licences and other permits.

If the company uses foreign information systems or databases, it is recommended to make sure that the PD localisation obligation has been complied with. It can be helpful to conduct an audit of a company’s information resources. 

 

Help from your adviser

The specialists at law firm Pepeliaev Group are well versed in handling tasks involving compliance with PD legislation, including compliance with the localisation requirement. We are ready to offer you legal and technical assistance in preparing for and complying with such requirements, including structuring activities with PD within information systems, taking into account the requirements that databases containing PD of Russian nationals must be in Russia. We are also ready to represent your company and your employees within the scope of control measures and in disputes with administrative authorities. 

____________________________________

[1] https://sozd.duma.gov.ru/bill/729516-7