The Russian data protection authority, Roscomnadzor, has given major U.S. technology companies extra time to comply with the Russian data localization law.
The law, which went into effect on September 1, 2015, requires companies to store and process all personal data of Russian citizens using databases located in Russia. The law imposes a variety of penalties for violations, including the authority to prevent offending companies from operating in Russia by blocking their access to local hosting and telecommunications infrastructure.
It is being reported that Russian regulators told certain U.S. companies such as Facebook, Google and Twitter that they have until at least January 2016 to comply with the data localization law, at which point the companies will be subject to compliance checks.
But pushing off the compliance deadline is not necessarily for the benefit of the companies. Roscomnadzor spokesman Vadim Ampelonsky acknowledged that Russian regulators do not yet have the resources to enforce compliance by companies as large as Facebook, Google and Twitter. Instead, Russian regulators intend to enforce the law against small and medium-size domestic and foreign companies with offices in Russia, though they have reserved the right to conduct spot checks on any organization if necessary.
Facebook, Google and Twitter have a charged relationship with the Russian government, following a prior dispute over the companies’ refusal to block certain politically-motivated pages at the request of the government. In response to the data localization law, the companies have either informed regulators that they will not establish new data centers in Russia in the immediate future, or have not indicated whether they plan to comply with the law. Other foreign companies, including Samsung, Uber and eBay, have indicated that they do plan to comply with the data localization law.
It remains unclear how Russia will enforce the data localization law against large, global companies. We will continue to follow the developments associated with the localization law and provide relevant updates on our blog.
To subscribe for updates from our Data Protection Report blog, visit the email sign-up page.
