Last week a Russian court fined Google’s local subsidiary 3 million rubles (around $41,000 at the current exchange rate) for violating Russia’s personal data storage law, reports TASS news agency.
While the US digital giant had previously been fined for refusing to remove censored information and for abusing dominant position, it is the first fine imposed on Google for refusing to localize Russian users’ data.
According to a legislation applicable since September 2015, companies operating in Russia are required to store Russian users’ or clients’ personal data on servers physically located in the country. Numerous foreign and domestic players were concerned, including global players who tended to store their users’ data in borderless clouds (see white paper by EWDN and EY).
A range of international businesses — including Alibaba, Booking.com, AliExpress, Apple, LG Electronics and Microsoft— have managed to transfer user data from foreign data centers to Russia. In total, “as of today around 600 representative offices of foreign companies in Russia have localized the storage of personal data of Russian users,” stated Roskomndazor, the Internet and telecom regulator, cited by TASS.
Several key international companies have been less law-abiding, playing cat-and-mouse with the Russian authorities for years already. Thus, Roskomnadzor requested Facebook and Twitter, which had sent both positive and negative signals on the matter, to report on their compliance with the law, and even fined them for non compliance.
In April 2021, Roskomnadzor gave again Google, as well as Twitter, Facebook and WhatsApp until the end of May to respond to questions about the localization of Russian users’ data. Roskomnadzor warned that if the agency didn’t receive a response, it would seek to hold the tech companies accountable for violating Russia’s personal data laws.
On July 1, Roskomnadzor observed that neither Google, Facebook and Twitter, nor some other social media giants, had yet localized the personal data of Russian users according to the law.
Under a law imposing stiffer fines that President Vladimir Putin signed in December 2019, fines for repeat offenses go up to 18 million rubles (almost $290,000).
The authorities may even block access to their sites from Russia – as was the case with LinkedIn in 2016, following two court decisions.
