How the authorities are fighting big IT companies over the data of Russian users

Where did the conflict begin?

It began with a personal data law. On September 1, 2015, the law came into force

"About personal data". In order to protect the personal data of ordinary Internet users, he introduces a number of restrictions on their processing. From now on, personal data of Russians should be stored and processed only on the territory of Russia. This means that large foreign companies wishing to serve the citizens of the Russian Federation are forced to locate their equipment in the country or rent it. In case of failure to comply with the requirements of the law, a measure familiar to users of Runet is envisaged - blocking.

The law was immediately perceived ambiguously as inuser circles and industry representatives. Already, some companies in unofficial channels express their unwillingness to comply with the new law. Formally, they could have been blocked as early as Tuesday. But "horror stories" about the blocked Facebook threaten to become reality only after at least January 1, 2016.

Determine the citizenship of the data carrierthe operator is offered independently, but if this issue has not been resolved, then it is proposed to apply the law to all data collected on the territory of the Russian Federation. The requirements do not apply to several types of activities, for example, air travel, visa issuance and areas governed by international law. The law does not prohibit cross-border transfer of data.

When collecting personal data, includingthrough the information and telecommunication network "Internet", the operator is obliged to ensure the recording, systematization, accumulation, storage, clarification (update, change), extraction of personal data of citizens of the Russian Federation using databases located on the territory of the Russian Federation.

The text of the law "on personal data"

The law was unsuccessfully proposed to be mitigated by manyways. Internet Ombundsman Dmitry Marinichev offered to allow the storage of the user's personal data in foreign countries, if the user gives his consent to this.

We are talking about states that have ratifiedthe Council of Europe Convention on the Protection of Individuals with Respect to Automatic Processing of Personal Data. At the moment, the document has been ratified by 46 countries, including Russia, Great Britain, France, Germany and Italy with Spain. Participants of the St. Petersburg Economic Forum at the beginning of this summer submitted to Russian President Vladimir Putin their proposals to amend the new law.

The essence of the proposal was not to punish for non-compliance with the law within a year after its entry into force - until September 1, 2016.

What do IT giants demand from?

Foreign companies are first checked for compliance with the new requirements. According to Alexander Zharov, the inspection mechanism will consist in visits by a representative of Roskomnadzor.

Roskomnadzor inspector during scheduled inspectionswill request an agreement with a Russian data center or documents confirming the existence of its own data center in our country. The plan of inspections was approved by the Prosecutor General's Office. […] Unscheduled inspections are also possible - as a response measure. For example, if we receive numerous complaints from citizens.

Alexander Zharov, head of Roskomnadzor.

Checks apply to Facebook, Twitter and othersmajor social networking services. RKN is primarily interested in companies that store a lot of sensitive information: passport data, banking information.

Therefore, all companies of this type must provide information that the data of Russian users of social networks is located on servers physically located in Russia.

Which companies have already transferred personal data?

  • Alibaba Group, an online trading company and owner of Alibaba.com. The Chinese company rents about 20 racks in the Moscow data center of Linxdatacenter (according to other sources - 25-30). Some sources say there are plans to rent 200 racks. Experts estimate the cost of renting two hundred racks at $ 3 to $ 4.8 million.
  • Booking.com, the most popular travel site in Russia. On June 10, the company announced its intention to comply with the new law. On June 31, it became known about the booked Russian data center of the British company IXcellerate. It will store the passport data of citizens who book hotels, and the data of bank cards used when ordering services.
  • Samsung Electronics, an electronics manufacturer. To comply with the law, a data center in Moscow was leased from DataPro. The area of ​​the data center built in 2014 is 16 thousand square meters, it has a total of 3000 racks.

What will happen to those who have not migrated the server?

Roskomnadzor requested information on data localization from Twitter and Facebook at the end of 2018. For refusal, both companies received fines of three thousand rubles.

Twitter paid a fine of three thousand rubles forrefusal to provide Roskomnadzor with information on the localization of data of Russian users in Russia. The money was received on July 26, 2019. Roskomnadzor drew up protocols on an administrative offense against Twitter and Facebook in February 2019. In April, the court fined both companies three thousand rubles. According to the regulator, Twitter and Facebook did not give specific answers about the storage of Russian data.

Facebook ignored the court order andTwitter tried to challenge the decision. On August 5, 2019, Maria Mikheenkova, an advisor at the Moscow office of the law firm Dentons and a Twitter lawyer in court, filed a complaint with the Supreme Court against the ruling of the magistrate of April 5, 2019. Then the court fined Twitter three thousand rubles for refusing to answer about the storage of data of Russian users in Russia.

According to the ruling of the magistrate court, the social networkinsisted that she had a foreign legal entity without a representative office in Russia, so Roskomnadzor had no right to request data from the company. The court said that legal entities are responsible regardless of their location, subordination and other circumstances.

Later, the court again fined both companies 4 million rubles for refusing to move servers with user data to Russia. Twitter also appealed a fine of 4 million rubles in court, but to no avail.

There are other measures that they plan to take against those who refused to transfer servers:

For foreign IT giants, the punishment may be toughened for non-compliance with the legislation of the Russian Federation, in particular, the law on the storage of personal data of Russians.

Instead of fines - today they amount to severalmillion rubles and are insignificant for large companies - it is proposed to slow down Internet traffic when users access resources. The initiative to legislate such a measure has already been made by the Commission on Legal Support of the Digital Economy with the participation of telecom operators, Internet companies and industry associations. The restrictions will come into effect if IT companies do not store user data in the Russian Federation.

Foreign online resources not performingthe requirements of Russian legislation can be punished by slowing down their traffic, Alexander Zhuravlev, chairman of the Commission on Legal Support of the Digital Economy of the Moscow branch of the Russian Lawyers Association, told Izvestia.

Violations include, but are not limited tonon-observance of the rules on the localization of data of Russian users on the territory of the Russian Federation and tax requirements, failure to delete illegal information and other violations of the law. New measures of influence are proposed to be extended to companies with at least 100 thousand visitors per day in Russia.

How did IT companies react?

Twitter on October 1 filed two lawsuits with Presnensky andMeshchansky district courts of Moscow to Maxim Dumakov, the bailiff for the proceedings on a fine for the company for 4 million rubles. This was reported by Kommersant with reference to the court's database. One of the lawsuits is about “challenging decisions, actions (inaction) of the bailiff-executor,” the court said. The company received a fine in February 2020 for refusing to transfer servers with data from Russian users to Russia.

Department for the execution of especially importantEnforcement proceedings of the Federal Bailiff Service (FSSP) initiated proceedings against the social network in June 2020, the newspaper reports. The department "is taking a set of measures aimed at fulfilling the requirements," the service has not yet received a claim, the FSSP press service commented.

Facebook is currently ignoring the court ruling and not paying the fine.

What will happen next?

In case of blocking any largea foreign website can expect an easy form of the Chinese scenario for the development of the local segment of the Web. In China, there is the so-called Great Wall of Fire: a firewall at the border of the Chinese Internet that filters all foreign traffic. Many sites are permanently blocked on the territory of China, among them there are web services popular all over the world. In this case, the market of the largest country in the world in terms of the number of inhabitants is divided between local players.

The Chinese do not use Facebook - it is blocked. Instead, they use QZone, Renren, Pengyou, and Kaixin001. The IMDB movie directory is blocked for a complete list of objectionable documentaries, instead there is M-time. Several copies of Google's Blogger.com can boast enviable traffic, largely due to the original blocking. Google itself is also blocked, which plays into the hands of Chinese Baidu and other local search engines.

A similar thing can happen in Russia: if the same Facebook is blocked, then a small part of its users will continue to visit the site using VPN and Tor, but the majority will join the user base of unblocked social networks.

Read also:

Researchers have developed clean energy from graphene for the first time

On day 3 of illness, most COVID-19 patients lose their sense of smell and often suffer from a runny nose

The Doomsday glacier turned out to be more dangerous than scientists thought. We tell the main thing