On December 2, 2019, Federal Law No. 405-FZ1 entered into force. This act significantly increases administrative liability for violations of the requirements on the localization of databases containing personal data of Russian nationals. The localization requirement was first introduced into the Russian legislation in 2014 and imposed an obligation to locate servers with the personal data of Russian nationals only in the territory of the Russian Federation.
It should be noted that previously, the maximum fine for a violation of the localization requirements, that is, for a refusal to provide information on the implementation of the requirements of the law under Art. 19.7 of the Administrative Offenses Code, was RUB 5 thousand. Many major foreign companies were held liable for such violations under Art. 19.7 of the Administrative Offenses Code. Thus, in 2016, LinkedIn2 was blocked for such a violation, and in 2019, Facebook3 and Twitter4 were fined in the amount of RUB 3 thousand each.
According to the provisions of the new law, parts 8 and 9 of Art. 13.11 of the Administrative Offenses Code will provide for special liability for violations of the localization requirements and will introduce higher fines:
| Subject | Fine for the first violation | Fine for subsequent violations |
|---|---|---|
| Individual | from RUB 30 thousand to 50 thousand | from RUB 50 thousand to 100 thousand |
| Official | from RUB 100 thousand to 200 thousand | from RUB 500 thousand to 800 thousand |
| Legal entity | from RUB 1 million to 6 million | from RUB 6 million to 18 million |
The explanatory note to the draft law emphasized that a failure to fulfill the obligation to localize databases with personal data poses a threat to the security of the public, the functioning of critical information infrastructure, and impedes the efficient fight against terrorism and extremism, and therefore it is necessary to adopt sanctions for violations, stimulating compliance with the law.
A serious increase of the fines can lead to significant financial costs for foreign companies. If before, the maximum fine of RUB 5 thousand could not have the impact sought on the activities of large organizations, the new fines, which are comparable to the costs of implementation of these statutory requirements on the storage of personal data of Russian users in the territory of the Russian Federation, will indeed have an impact on such entities.
We believe that such new rules may adversely affect the participation of foreign commercial organizations in business in Russia and are unlikely to become a decisive factor in the fight against terrorism and extremism, referred to as the key purpose of these amendments.
1Federal Law No. 405-FZ dated December 2, 2019 “On Amending Certain Legislative Acts of the Russian Federation”
1Ruling of the Moscow City Court dated November 10, 2016 in Case No. 33-38783/2016
1Resolution of the Magistrate of Judicial Sub-District No. 422 of the Tagansky District of Moscow dated April 12, 2019 in Case No. 05-0762/19
1Resolution of the Magistrate of Judicial Sub-District No. 422 of the Tagansky District of Moscow dated April 5, 2019 in Case No. 05-618/19