New legislative changes in IT regulation in Russia in July 2023

Please be informed that major changes in regulation of information technologies and the Internet in Russia have been enacted recently by legislators in the third reading at the Russian Parliament. The bills are aimed at establishing new requirements for hosting providers, restrictions on the use of recommendation technologies on the Internet and authorisation methods on Russian websites, new fines for social media platform owners.

Law on hosting providers in Russia

As of December 01, 2023, hosting providers will be subject to the new requirements in Russia. This regulation applies to companies providing services for the provision of computing power for posting information in information systems permanently connected to the Internet.

The hosting providers will have the following obligations:

• To send a notification on commencement of hosting services to Russian Data Protection Authority (Roskomnadzor);

• To ensure the implementation of information security requirements;

• To ensure the implementation of requirements for conducting operational and investigative activities and to prevent disclosure of organisational and tactical methods of conducting such activities (the procedure for interaction of hosting providers with authorised state authorities shall be established by the Government of the Russian Federation);

• To comply with the requirements the 'Sovereign Runet' Law and other specified provisions of the Russian Communications Law1 ;

• To verify the identification or authentication of its customers.

Based on the hosting provider’s notification, a hosting provider shall be included into a special register which will be maintained by Roskomnadzor. As of February 01, 2024, the absence of information in the register will be an obstacle for the operation of hosting providers. Hosting providers that were operating before these changes came into force shall notify Roskomnadzor regarding commencement of hosting services by December 15, 2023.

Roskomnadzor will monitor the activities of hosting providers in Russia. If the hosting provider fails to eliminate violations identified by Roskomnadzor, within 10 business days from the date of the request (unless earlier deadlines are set out in the notification itself), the hosting provider will be removed from the register and prohibited to carry out its activities.

Regulation of recommendation technologies used in relation to Russian users

As of October 1, 2023, new requirements will be introduced for owners of websites, mobile applications or other information systems ('owners') when using information technologies to provide information based on the collection, systematisation and analysis of information relating to the preferences of users (so-called “profiling”) located in Russia ('recommendation technologies').

For instance, the respective amendments will be relevant for owners of social media platforms, video hosting platforms, streaming platforms, search engines, e-commerce platforms (marketplaces) that use various recommendation algorithms and the rest owners who performs profiling on their websites and mobile applications.

Owners using recommendation technologies or algorithms will be obliged to:

• prevent the use of recommendation technologies that violate the rights and legitimate interests of citizens and organizations and the provision of information in violation of the legislation of the Russian Federation;

• inform users about the use of recommendation technologies;

• provide an e-mail address for users to send their requests;

• publish the policy for the use of recommendation technologies in Russian language specifying the types of information on user preferences, sources of obtaining such information, a description of processes and methods of collecting, systematizing, analyzing information on user preferences, and methods of implementing such processes and methods.

Roskomnadzor will monitor compliance with the restrictions: in case of non-compliance with the requirements, it is authorized to send a notice to the owner to take measures to eliminate violations.

If the owner again fails to take any measures, Roskomnadzor may restrict access to such information resource. Such blocking of the resource may be removed based on the court’s decision, provided the owner eliminates the violations with further notification of Roskomnadzor.

Roskomnadzor is also expected to adopt rules for informing users about the use of recommendation technologies.

New rules on authorisation for users on Russian websites

As of December 1, 2023, owners of websites, mobile applications or other information systems ('owners') that are Russian legal entities or citizens of the Russian Federation are limited in the possible options for authorization of users located in Russia.

These restrictions, however, do not apply to foreign owners of websites, mobile applications or other information systems available in Russia.

As of December 1, 2023, only the following authorisation methods may be used:

• Via phone number in accordance with the procedure established by the Government of the Russian Federation based on an identification agreement concluded by the owner with a telecom operator;

• Via 'Gosuslugi' (a Russian state services platform);

• Via Unified Biometric System;

• Via another information system that meets information protection requirements. The owner of such a system may only be a citizen of the Russian Federation who does not have citizenship of another state, or a Russian legal entity. Thus, the use of various foreign authorization systems on Russian websites or applications, such as Apple ID, Google is restricted.

Therefore, Russian owners of websites, mobile applications or other information systems should review their user authorization solutions before the effective date of the new requirements.

New fines for social media platforms owners

As of September 1, 2023, administrative liability is established for violation of statutory duties by the owner of a social media platform.

New rules apply to companies whose information resources are used to disseminate information in Russian (other languages of the regions or peoples of the Russian Federation), on which advertising that attracts the attention of consumers located in the territory of the Russian Federation may be disseminated, and to which more than 500,000 Internet users located in the territory of Russia have access during the period of a day.

--table--

--table-border--

Only articles 561 (3), 562 (8 (1-3)) and 651 (4) of the Federal Law of the Russian Federation No. 126-FZ of 7 July 2003 on Communications shall apply to hosting providers. the Federal Law as of July 27, 2006, No. 149-FZ on Information, Informational Technologies, and Protection of Information