New legislative changes in IT regulation in Russia in July 2023

New legislative changes in IT regulation in Russia in July 2023

27 July 2023

Please be informed that major changes in regulation of information technologies and the Internet in Russia have been enacted recently by legislators in the third reading at the Russian Parliament. The bills are aimed at establishing new requirements for hosting providers, restrictions on the use of recommendation technologies on the Internet and authorisation methods on Russian websites, new fines for social media platform owners.

Law on hosting providers in Russia


As of December 01, 2023, hosting providers will be subject to the new requirements in Russia. This regulation applies to companies providing services for the provision of computing power for posting information in information systems permanently connected to the Internet.

The hosting providers will have the following obligations:

  • To send a notification on commencement of hosting services to Russian Data Protection Authority (Roskomnadzor);

  • To ensure the implementation of information security requirements;

  • To ensure the implementation of requirements for conducting operational and investigative activities and to prevent disclosure of organisational and tactical methods of conducting such activities (the procedure for interaction of hosting providers with authorised state authorities shall be established by the Government of the Russian Federation);

  • To comply with the requirements the 'Sovereign Runet' Law and other specified provisions of the Russian Communications Law1 ;

  • To verify the identification or authentication of its customers.

Based on the hosting provider’s notification, a hosting provider shall be included into a special register which will be maintained by Roskomnadzor. As of February 01, 2024, the absence of information in the register will be an obstacle for the operation of hosting providers. Hosting providers that were operating before these changes came into force shall notify Roskomnadzor regarding commencement of hosting services by December 15, 2023.

Roskomnadzor will monitor the activities of hosting providers in Russia. If the hosting provider fails to eliminate violations identified by Roskomnadzor, within 10 business days from the date of the request (unless earlier deadlines are set out in the notification itself), the hosting provider will be removed from the register and prohibited to carry out its activities.

Regulation of recommendation technologies used in relation to Russian users


As of October 1, 2023, new requirements will be introduced for owners of websites, mobile applications or other information systems ('owners') when using information technologies to provide information based on the collection, systematisation and analysis of information relating to the preferences of users (so-called “profiling”) located in Russia ('recommendation technologies').

For instance, the respective amendments will be relevant for owners of social media platforms, video hosting platforms, streaming platforms, search engines, e-commerce platforms (marketplaces) that use various recommendation algorithms and the rest owners who performs profiling on their websites and mobile applications.

Owners using recommendation technologies or algorithms will be obliged to:

  • prevent the use of recommendation technologies that violate the rights and legitimate interests of citizens and organizations and the provision of information in violation of the legislation of the Russian Federation;

  • inform users about the use of recommendation technologies;

  • provide an e-mail address for users to send their requests;

  • publish the policy for the use of recommendation technologies in Russian language specifying the types of information on user preferences, sources of obtaining such information, a description of processes and methods of collecting, systematizing, analyzing information on user preferences, and methods of implementing such processes and methods.

Roskomnadzor will monitor compliance with the restrictions: in case of non-compliance with the requirements, it is authorized to send a notice to the owner to take measures to eliminate violations.

If the owner again fails to take any measures, Roskomnadzor may restrict access to such information resource. Such blocking of the resource may be removed based on the court’s decision, provided the owner eliminates the violations with further notification of Roskomnadzor.

Roskomnadzor is also expected to adopt rules for informing users about the use of recommendation technologies.

New rules on authorisation for users on Russian websites


As of December 1, 2023, owners of websites, mobile applications or other information systems ('owners') that are Russian legal entities or citizens of the Russian Federation are limited in the possible options for authorization of users located in Russia.

These restrictions, however, do not apply to foreign owners of websites, mobile applications or other information systems available in Russia.

As of December 1, 2023, only the following authorisation methods may be used:

  • Via phone number in accordance with the procedure established by the Government of the Russian Federation based on an identification agreement concluded by the owner with a telecom operator;

  • Via 'Gosuslugi' (a Russian state services platform);

  • Via Unified Biometric System;

  • Via another information system that meets information protection requirements. The owner of such a system may only be a citizen of the Russian Federation who does not have citizenship of another state, or a Russian legal entity. Thus, the use of various foreign authorization systems on Russian websites or applications, such as Apple ID, Google is restricted.

Therefore, Russian owners of websites, mobile applications or other information systems should review their user authorization solutions before the effective date of the new requirements.

New fines for social media platforms owners


As of September 1, 2023, administrative liability is established for violation of statutory duties by the owner of a social media platform.

New rules apply to companies whose information resources are used to disseminate information in Russian (other languages of the regions or peoples of the Russian Federation), on which advertising that attracts the attention of consumers located in the territory of the Russian Federation may be disseminated, and to which more than 500,000 Internet users located in the territory of Russia have access during the period of a day.

--table--

--table-border--

Obligation of a social media platform owner Administrative fine for violation of the specified obligation
Annual posting of a report on the results of consideration of appeals about information disseminated in violation of the law and the results of monitoring the social media platform, and an electronic form for sending relevant requests;Posting a document in the social media platform that establishes the terms of use of the social media platform and informing users of any changes made to these terms. For officials - from RUB 200 000 to 400 000 (approx. from 2,200 USD to 4,400 USD);For legal entities - from RUB 600 000 to 1 000 000 (approx. from 6,615 USD to 11,000,00 USD).
Monitoring of the social media platform, taking measures to restrict access to information the distribution of which is restricted under the Law 149-FZ2;Fulfilment of Roskomnadzor's requirement to cancel measures taken by the owner to restrict access to users' information. For officials - from RUB 200 000 to 400 000 (approx. from 2,200 USD to 4,400 USD);For legal entities - from RUB 800 000 to 4 000 000 (approx. from 8,820 USD to 44,100 USD).
In case of repeated offence:

For officials - from RUB 500 000 to 800 000 (approx. from 5,510 USD to 8,820 USD); For legal entities - from RUB 4 000 000 to 8 000 000 (approx. from 44,100 USD to 88,200 USD).
Submission to Roskomnadzor the information on the owner of a social media platform or other information necessary for the maintenance of the relevant register. For legal entities - from RUB 50 000 to 300 000 (approx. from 550 USD to 3,300 USD).
Fulfilment of Roskomnadzor’s order to monitor a social media platform to identify information that is confusingly similar to the information in respect of which the owner was obliged to take measures to remove on the basis of an earlier request from Roskomnadzor. For legal entities – from RUB 4 000 000 to 6 000 000 (approx. from 44,100 USD to 66,150 USD).

Only articles 561 (3), 562 (8 (1-3)) and 651 (4) of the Federal Law of the Russian Federation No. 126-FZ of 7 July 2003 on Communications shall apply to hosting providers. the Federal Law as of July 27, 2006, No. 149-FZ on Information, Informational Technologies, and Protection of Information

Download the text as a PDF file

We hope that the information provided herein will be useful for you.

If any of your colleagues would also like to receive our newsletters, please send them the link to complete a Subscription Form .
Learn more about our practices:
Telecommunications, Media and Technology



Note: Please be aware that all information provided in this letter was taken from open sources. Neither ALRUD Law Firm, nor the author of this letter bear any liability for consequences of any decisions made in reliance upon this information.

If you have any questions, please, do not hesitate to contact us.

Sincerely,
ALRUD Law Firm

Lesnaya st., 7, 12th fl., Moscow, Russia, 125196
Т: +7 495 234 96 92, Т: +7 495 926 16 48, info@alrud.com
alrud.com
We use cookies to offer better performance of the website and fulfill some other purposes specified in the Privacy Policy. By way of ticking the box you provide your consent to use of cookies. Otherwise, we will only use technical cookies, which are necessary for proper functioning of the website.
Accept