The largest social networks Facebook and Twitter once again did not pay fines for refusing to store personal data of Russian users in Russia. Until mid-May, they were supposed to pay four million rubles, but this did not happen. The failure of IT companies to comply with Russian law annoys lawmakers a lot. What really threatens foreign social networks in Russia and why they refuse to localize the data of Russians is in the Lenta.ru material.
The confrontation between Roskomnadzor and American social networks has been going on for several years. Amendments to the Law on Personal Data, which oblige companies to store and process personal data of Russians in Russia, came into force in 2015. Social networks were in no hurry to comply with the requirements of the new legislation, although the social law was already blocked in Russia for the new law to establish LinkedIn business contacts. Soon, representatives of Roskomnadzor approached Facebook and Twitter. Since then, the situation has changed little.
rambler without ads
At first, representatives of Twitter went on a dialogue and even promised to localize the data of Russians in Russia by the summer of 2018. Regulators waited until December, after which they drew up an administrative offense against the microblogging network. A similar administrative proceeding began in relation to Facebook.
Under the then law, for such a violation with Facebook and Twitter, you could be charged only up to three thousand rubles. Such fines were imposed to them in April 2019, but even such a symbolic amount, representatives of Twitter tried to challenge. During the hearing, the company's lawyers referred to the unsubstantiated claims of Roskomnadzor and insisted that Russian law could not be applied to foreign social networks.
However, in the end, Twitter still had to pay a fine – this happened four months after the announcement of the verdict. At the same time, Facebook representatives ignored the court decision and did not even cover the minimum penalty. After drawing up the first protocol of violation, both companies were given another nine months to transfer the servers to Russia, but the social networks did not provide information on the localization of data from Russians. Then Roskomnadzor again sued both companies.
In 2019, fines for refusing to store personal data of Russians in the country were increased – and this time they demanded 4 million rubles from Facebook and Twitter. Twitter again tried to appeal the verdict, but to no avail, and Facebook simply ignored the court’s next demands. 60 days were allotted to both social networks for the execution of new penalties, but none of them paid a fine on time.
rambler without ads
The situation with Twitter and Facebook developed against the backdrop of one of the most high-profile Internet scandals of 2016 – LinkedIn blocking. The social network was blocked for the same reason – she refused to move the server to Russia. She was also accused of illegally collecting and transmitting information about citizens who are not users of the social network without their consent. LinkedIn lawyers tried to challenge this allegation, insisting that its users are actually virtually outside of Russia, but the court sided with Roskomnadzor.
Despite the block, LinkedIn representatives said they were planning to restore activity in Russia. But at the same time, they did not indicate any specific deadlines and solutions to the problem.
Unlike Facebook and Twitter, the giant Google moved the server to Russia. After that, the company faced other problems. Google had to pay a total of 1.2 million rubles in the form of fines for refusing to delete information that is considered prohibited in Russia. Starting in 2017, search engines must remove links to prohibited pages from the search results.
The company received the first fine of 500 thousand rubles at the end of 2018. Google did not agree to connect to the registry of banned information to filter search results. By February next year, the company paid the penalty, and, apparently, it began to partially filter traffic (the search engine deleted about 70 percent of the links from the registry of Roskomnadzor).
rambler without ads
Several postal services have already received such punishment, including ProtonMail, Startmail, Guerrillamail.com, Cock.li and Tutanota.com. All these foreign services were blocked in Russia, since in 2019, through them, attackers massively sent false messages about the mining of buildings in Russian cities. Roskomnadzor has repeatedly sent requests to companies for information, but representatives of most mail services refused to cooperate.
However, ProtonMail employees quickly solved the problem – two days after the start of the blocking, they deleted all accounts from which mining letters were sent. “Our investigation confirmed that the explosion threats were indeed sent from ProtonMail, and we received copies of emails sent from our systems from third-party sources. All accounts involved were identified and permanently disabled, ”the company confirmed.
ProtonMail retained all available information about subscribers and promised to transfer it to the Russian authorities if they file an official request with the Swiss federal police, where the company is based. After that, the supervisor unblocked the service in Russia.
Facebook and Twitter are one of the few foreign companies that still refuse to localize the personal data of Russians. Apple's “daughter”: (Apple Rus LLC) registered as a personal data operator in 2018, and then transferred the data of Russians to Russia. Another major US player, Microsoft, did the same two years earlier. EBay, PayPal, AliExpress and other major players moved their servers to Russia.
The argument of the authorities, indignant at the refusal of social networks to localize the data, is simple – these sites continue to earn on advertising, but evade the implementation of the law. In the Russian Bar Association, this attitude is called neglect of the execution of judicial acts.
“In my opinion, this is a kind of neglect, because Facebook, Twitter and other companies make a lot of money in Russia through intermediaries through advertising on their resources. But at the same time, they express such an attitude to the data of our users and the execution of judicial acts of Russian courts, ”said Alexander Zhuravlev, chairman of the commission for legal support of the digital economy of the Moscow branch of the association, in a conversation with Lenta.ru.
rambler without ads
Experts interviewed by Lentoi.ru explain that foreign companies justify their actions by the absence of an official representative office in the country.
A similar point of view is shared by the president of the analytical company Kribrum Igor Ashmanov. He sees in the actions of companies a manifestation of the American mentality. In his opinion, Americans (both the legal community and politicians) consider the whole world to be their jurisdiction. Even those US residents who work in Russia still prefer to listen to their legislation, he said.
Due to the lack of Russian representative offices, it is almost impossible to force social networks to pay fines, Zhuravlev explains. “For example, if we are talking about the enforcement of these fines (that is, using bailiffs to enforce a judicial act and recovering a fine directly), then in this case, IT companies must have a representative office, branch or subsidiary – a legal entity located in Russia. Facebook, Twitter and many other companies today do not have a legal presence in Russia, ”he explains.
Another reason foreign IT corporations are in no hurry to localize user data from Russia is potential political problems. Moving the servers of an American company will entail extremely serious risks in the homeland of the company, said Ghazaryan from RAEC. For example, she may be caught in collaboration with the Russian authorities. Therefore, the same Facebook and Twitter are in no hurry with such actions – the Russian market is not so important for them to endanger themselves, the RAEC chief analyst is sure.
This was announced in March 2019 by Facebook founder Mark Zuckerberg, whose company was seriously affected by a political scandal in the United States. The head of the social network said that Facebook will not transfer servers with personal data of users to countries where human rights or freedom of speech are regularly violated. It is one thing to provide services in the country, it is quite another to store the data of people in them, the entrepreneur explained. According to him, Facebook cannot risk the personal data of users in countries where, as the company believes, they face unauthorized access.
Ashmanov believes that American corporations do not want to obey the requirements of the Russian authorities, because after the first precedent they will have to fulfill all the instructions of Roskomnadzor without exception – there will be no turning back.
rambler without ads
“As soon as a giant company like Twitter, Facebook or Instagram bends for the first time and fulfills some requirements of our authorities, that's all. So, you will have to execute further. It’s much easier to evade for a while, get a penny, pay, but not take this key step, ”said the president of Cribrum.
Interviewed experts came to the conclusion that increasing fines is unlikely to seriously change the situation – for foreign corporations to comply with Russian laws, a whole range of measures will be needed. The Association of Russian Lawyers believes that it is necessary to work out measures that will, if necessary, "use the mechanism of enforcement" of judicial acts. “For this, it is necessary to improve administrative and civil legislation. It is very important to carefully study these issues so that our users do not suffer from their use. In addition, since such issues arise not only in Russia, the possibility of international cooperation with other countries regarding the mutual execution of administrative acts should be considered, ”concludes Alexander Zhuravlev.
He explains that the issue of data leakage from foreign companies is also an acute issue in Russia. In such a situation, a citizen should have adequate ways to protect his rights, but the rules on recovering losses or moral damage from the operator of personal data do not work in practice. “Since the state’s primary function is protective, it should be vested with the appropriate right to recover certain compensations for such violations of citizens and legal entities,” the analyst believes.
Penalties will have an effect only if their amount is so significant that even IT corporations with a billion turnover will be worried, Ashmanov said. He advocates a more radical solution to the issue.
“We have a second way, we can act by a hybrid method – fine for non-fulfillment, impose pennies, and if they don’t obey at all, then block. First, again in an educational way: for a day, a week, and so on. And if you don’t obey, it’s like with LinkedIn, ”concluded Ashmanov. Russian officials do not take such steps out of fear of being convicted of "undemocratic actions." The expert himself does not consider this practice reprehensible and thinks that officials simply “lack the will”.
The opposite opinion is held in RAEC. Karen Ghazaryan also suggests recalling the experience of LinkedIn, which has proven to be ineffective. “We have already blocked LinkedIn – so what? Is LinkedIn somehow blocked in a way that violates citizens ’rights? Probably, it has not changed in any way, ”summed up Ghazaryan.
rambler without ads
The Russian law regarding punishments for IT companies is not as severe as, for example, European one. World legislation is heterogeneous in its degree of severity, and foreign fines are many times higher than Russian ones. The maximum penalty for refusing to localize data in Russia is 18 million rubles – a relatively small amount compared to European fines. For a large IT company, these numbers are negligible, experts say.
“European fines (GDPR), unlike our current legislation, can be negotiable (a certain percentage of the company's turnover), and they can also be applied if certain criteria are met in case of an offense. In practice, they reach 21 million euros and higher. And when compared with our legislation, of course, these are disparate figures, ”says Alexander Zhuravlev.
Ashmanov calls the current fines for IT giants ridiculous. As an example, he cites penalties for Google, which "can pay 500 thousand rubles once a second or per minute." The company’s claims are of little concern, because Russia is a third-tier market for the search engine in size.
He considers it appropriate to “at least frighten” the corporation, even if in reality there is no way to recover a huge fine. The will of IT giants can be broken by raising fines and introducing temporary blockages, he is convinced.
In Europe, this practice is not applied. Ashmanov explains this by the lack of their own services. “They simply cannot stop the service in Europe – there is nothing to replace. And it’s quite possible with us, ”admits Ashmanov.
But it is important to understand that blocking services is the most extreme measure, which, moreover, is not an end in itself. It entails costs primarily for users. Therefore, the state is forced to think out other ways to enforce the law, which would not entail inconvenience for users.