Russia Significantly Increases Fines for Violations of Data Localization Requirement

Orrick, Herrington & Sutcliffe LLP
Contact

Orrick, Herrington & Sutcliffe LLP

Under Russian Data Protection Law, when collecting personal data, data operators (controllers) must ensure that recording, systematization, accumulation, storage, updating and extraction of personal data relating to Russian citizens are performed utilizing databases located in Russia (data localization requirement).

The new law, adopted by the Russian parliament and signed into law on December 2, 2019, introduces substantial fines for violations of that requirement.

Currently, the most stringent liability for violating the localization requirement is the right of the Russian data protection authority (Roskomnadzor) to block access to internet websites belonging to the entities violating the localization requirement. The most widely known instance of this sanction’s application was the blocking of LinkedIn on the territory of Russia, imposed back in 2016. The blockage still applies – all Russian Internet service providers currently have to deny access to LinkedIn in Russia.

There are currently no substantial fines specifically punishing violations of the localization requirement. The new law introduces significant fines specifically for failure to localize the personal data:

  • for the first violation: fines on private citizens up to RUR 50,000 (approx. USD 780); on officials up to RUR 200,000 (approx. USD 3,100); and on legal entities up to RUR 6 mln. (approx. USD 93,750); and
  • for repeated violations: fines on private citizens up to RUR 100,000 (approx. USD 1,600); on officials up to RUR 800,000 (approx. USD 12,500); and on legal entities up to RUR 18 mln. (approx. USD 281,000).

All companies collecting personal data on Russian citizens would be well advised to review their compliance practices.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Orrick, Herrington & Sutcliffe LLP | Attorney Advertising

Written by:

Orrick, Herrington & Sutcliffe LLP
Contact
more
less

Orrick, Herrington & Sutcliffe LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide