A draft law establishing new fines of up to 18 million roubles (approx. €255,000) in the sphere of personal data has passed its first reading in the State Duma

The draft law proposes to introduce administrative liability for the non-performance by personal data operators of their obligation to ensure that personal data (“PD”) is processed with the use of databases located in Russia.

In our opinion, the likelihood is high that the draft law will be passed shortly since current legislation does not provide for a fine for non-compliance with what is referred to as the PD localisation requirement. The only measure to influence a PD operator is the restriction of its access to information systems (databases). Given the attention the government is paying to the PD localisation issue, the draft law came as no surprise. Please be reminded that the requirement to localise PD of Russian nationals in Russia has been in effect since 1 September 2015. It constitutes an obligation of a PD operator to ensure that, when PD is collected, the PD of Russian nationals is recorded, systematised, accumulated, stored, specified (updated, modified) and retrieved with the use of databases located in Russia.

The draft law supplements article 13.11 of the Russian Code of Administrative Offences (the “Administrative Code”) with two new provisions:

• the non-compliance of a PD operator with the PD localisation requirements triggers an administrative fine of RUB 200,000 to RUB 500,000 (approx. €2,800 to €7,000) for an officer of a company and of RUB 2,000,000 to RUB 6,000,000 (approx. €28,000 to €83,500) for a legal entity;
• a repeated violation may result in more stringent sanctions, i.e. the amount of the fine may reach RUB 1,000,000 (approx. €14,000) for an officer of a company and RUB 18,000,000 (approx. €250,000) for the company itself.

On the whole, the draft law met a favourable reception from competent committees and departments of the State Duma. Moreover, one of the opinions suggests that administrative liability (obviously to a greater extent) is advisable for other repeated offences in the sphere of PD.

What to think about and what to do

We recommend that companies now check their compliance with Russian PD legislation, specifically in terms of their compliance with the PD localisation requirements and start preparing for potential control and supervision measures of Roskomnadzor (the Federal Service for the Supervision of Communications, Information Technology and Mass Media), specifically: 

• arranging the company's and its employees' activities in terms of processing PD in line with the new legal requirements:
• developing and implementing the necessary internal regulations;
• taking the technical measures required to protect PD;
• obtaining relevant licences and other permits.

In addition, if the company uses foreign information systems or databases, it is recommended to make sure that the PD localisation obligation has been complied with. It can be helpful to conduct an audit of a company’s information resources.

Help from your advisers

The specialists at law firm Pepeliaev Group are well versed in handling tasks involving compliance with PD legislation, including compliance with the localisation requirement. We are ready to offer you legal and technical assistance in preparing for and complying with such requirements, including structuring activities with PD within information systems, taking into account the requirements that databases containing PD of Russian nationals must be in Russia. We are also ready to represent your company and your employees within the scope of control measures and in disputes with administrative authorities.