Navigating Amendments To Russian Personal Data Law

• Published date: 02 September 2022
• Subject Matter: Privacy, Data Protection
• Law Firm: Gorodissky & Partners
• Author: Mr Stanislav Rumyantsev

Introduction

In Summer 2022, Russia significantly amended its Personal Data Law (Federal Law on Personal Data No.152-?? dated 27 July 2006). The new rules and restrictions concern, among other things:

• cross-border transfers;
• the extra-territorial application of the law; and
• data breach notification procedures.

This article outlines the key amendments and provides guidance on how businesses can ensure their compliance.

Extra-territorial scope

Currently, the Personal Data Law applies within the borders of Russia. According to guidance from the Ministry of Digital Development, Communications and Mass Media, it also applies to international websites that contain content in Russian and meet other criteria which indicate that "the website owner seeks to expand its business over the Russian market".

As of 1 September 2022, the Personal Data Law applies in cases where foreign legal entities and/or natural persons process Russian nationals' personal data on the basis of either agreements concluded with data subjects or their consent. This rule may be understood such that non-Russian data controllers will be obliged to comply with all provisions of the Personal Data Law, including the requirement to process data "with the use of databases located in the territory of the Russian Federation" (the so-called "data localisation requirement"). It is unclear how foreign controllers with no presence in Russia are expected to learn about the rules applicable to them and how the local privacy watchdog (Roscomnadzor) might verify their compliance.

Cross-border transfers

The amendments to article 12 of the Personal Data Law provide that a data controller must notify Roscomnadzor prior to conducting cross-border transfers. The notice must describe, among other things:

• the destination country;
• the lawful basis of the transfer;
• the purpose of the transfer; and
• data categories.

Roscomnadzor has the power to prohibit the notified cross-border transfer within 10 business days of receipt of the notice.

If there is an adequacy decision in respect of the destination county, the data exporter may transfer personal data immediately upon notifying Roscomnadzor. There are adequacy decisions in respect of all parties to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (European Treaty Series No. 108) and several other countries shortlisted by Roscomnadzor (eg, Australia, Canada, Singapore and Japan). The data exporter may transfer...