New rules regarding the localization of personal data of Russian citizens

The current version of the law imposed a positive obligation on operators to use databases situated in Russia when collecting personal data of Russian citizens. The new wording establishes a mandatory prohibition. The existing exceptions remain in place, namely the processing of personal data on the basis of international agreements or legislation, in connection with involvement in legal proceedings, for the purposes of the exercise of powers conferred on state bodies, and for the purposes of the conduct of the professional activities of journalists and mass media.

As yet, no official interpretation of the new requirement has been published, and the explanatory note to the bill provides no further commentary. This makes it difficult to assess the precise impact the changes will have on operators’ activities.

It should be noted that the mention of personal data operators has been excluded from part 5 of Article 18 of Law No. 152-FZ, which probably means that the relevant obligations would also apply to persons that process personal data on an operator’s behalf. There is also uncertainty over whether personal data of Russian citizens may be held in foreign databases after it has been localized in Russia. Previously, it was accepted without question that this was allowed, but the new amendments may indicate a shift towards a stricter approach.

In view of the absence of any official interpretation of the new rules, we advise operators and persons that process personal data on an operator’s behalf to stay alert to changes in the law and official clarifications and to act swiftly to adjust their business processes. Russia’s internet and communications regulator, Roskomnadzor, could probably release its position on how the new localization requirements should be interpreted in the very near future.