TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout
PSR17_WebBanner_300x250-COPY
APF17_WebBanner_300x250-COPY
OneTrust_gdpr_tools_300x250_062317

Last week, Russian Federal Service for Supervision of Communications, Information Technology and Mass Media ("Roskomnadzor") included into the so-called "registry of prohibited websites" such messengers as BlackBerry Messenger (BBM), LINE, Imo.im, and audio-visual chat service Vchat. Roskomnadzor announced that not only the access to the websites of these platforms would be blocked but also access to their applications. Currently, all these platforms are unavailable within the territory of Russia.

Such blocking is a result of failure to provide Roskomnadzor with requested information as organizers of dissemination of information on the internet.

Legal requirements

Russian law defines the term "organizers of dissemination of information on the Internet" very broadly as those organizations ensuring the functionality of the informational systems and programs for electronic machines, which are aimed at and used in order to receive, transmit, deliver, and (or) process electronic messages of internet users.

Such organizers shall provide Roskomnadzor with information on their activities upon Roskomnadzor's request within five business days. If this is not done, Roskomnadzor sends a notification of violation and requests to cease the violation within 15 calendar days. If this ceasing is not done, Roskomnadzor starts the blocking procedure.

Separately, organizers of dissemination of information on the internet are obliged to:

  • Comply with requirements for equipment, software and technical means used in the information systems as instructed by respective law enforcement authorities.
  • Store in the territory of Russia information on the facts of receipt, transmission, delivery, and (or) processing of their Internet users' voice data, text messages, pictures, sounds, or other messages within one year as of the date of termination of such actions.
  • Provide the above information to respective security and enforcement authorities upon their requests.
  • Provide state security authorities with information necessary to decode users' messages in case of use of additional encryption of electronic messages or if you provide users with possibilities of such additional encryption.

Starting July 1, 2018, organizers of dissemination of information on the internet will be obliged to store in the territory of Russia their users' actual data of text messages, voice data, pictures, sounds, video-messages, or other electronic messages up to six months after the date of receipt, transmission, delivery and (or) processing of these messages.

Though the majority of the above requirements are in force since August 1, 2014, the main requirement related to storage of actual data was introduced in 2016 by the so-called "Anti-Terrorism Law" or "Yarovaya Law" establishing additional measures for counteracting terrorism and ensuring public security. This Anti-Terrorism Law entered into force July 20, 2016 except for certain limited requirements entering into force in 2018.

Liability

The administrative fines for organizers of dissemination of information on the internet are as follows:

  • Failure to notify respective state authorities on the start of their activity as organisers of dissemination of information: up to RUB 300,000 (~EUR 4,050) for legal entities.
  • Failure to comply with law enforcement authorities' requirements with respect to equipment, software and technical means used in the informational systems: up to RUB 500,000 (~EUR 6,800) for legal entities.
  • Failure to store the information on the facts of receipt, transmission, delivery and (or) processing of users' electronic messages: up to RUB 1,000,000 (~EUR 13,500) for legal entities.
  • Failure to provide state security authorities with information needed for decoding messages: up to RUB 1,000,000 (~EUR 13,500) for legal entities.

The tool for blocking access to organizers of dissemination of information's IT systems and (or) software used for receipt, transmission and (or) processing of electronic messages may be applied as follows: In case a breach of the above requirements is revealed and not remedied upon receipt of a request to remedy the breach, the access to respective information systems and (or) software may be blocked by communications operators (hosting providers) upon a court ruling or a decision of respective state authority until such organizers of dissemination of information on the internet remedy the breach.

Takeaways

Though it seems to be more problematic to impose a fine on a foreign entity, it must be kept in mind that the blocking tool may be used extraterritorially, and we have seen this in practice.

Therefore, in case companies (both Russian and foreign) have any platforms allowing users to exchange information, there is a risk of being considered as organizers of dissemination of information on the internet.

If such companies have business interest in the Russian market, it is recommended to consider the obligations imposed on such organizers and develop compliance options to be ready to quickly react to Roskomnadzor's requests and notifications on necessity to provide general information on the organizer, etc.

It is also recommended to liaise with Roskomnadzor before or immediately after receiving Roskomnadzor's notification to discuss all obligations and compliance options in detail.

2 Comments

If you want to comment on this post, you need to login.

  • comment Ray Everett • May 9, 2017
    In addition to any in-country storage/processing requirements, I know that LINE is one of several services that encrypts messages with keys shared only by the endpoints, thus making LINE unable to provide backdoor decryption per the requirement of the law.
  • comment John Bryan • May 24, 2017
    Considering that electronic communications can consist of parties in different countries, these sorts of security laws that require removal of privacy protections could eventual force operators to choose between which regions they want to operate in. Operators may have to block Russia(e.g.) if it becomes impossible to comply with both EU GDPR/DPA privacy requirements and state specific requirements to be insecure or perform tracking. 
    
    Even in the EU DPA & GDPR there is allowance for state derogations (defence, public security etc.) within their own regions. But individual non-EU state laws that do not grant operators legal permission to start data tracking the person at the EU end of the communication (even if the tracking does not physically occur within the EU). Something that perhaps should be considered by EU states (especially UK) as they start compiling their own derogations, as these presumably could have significant scope to clash in even any EU internal border data transfers.