Social media giants have heretofore ignored Russia’s data localization demands
Originally published on Global Voices
A Moscow district court has hit social media giants with significant new fines for violating Russia’s data localization requirements. The latest penalties add up to 36 million rubles, or over $485,000.
Facebook has been fined 15-million ruble ($202,000), while Twitter has been fined 17 million rubles ($229,000). WhatsApp, a messaging app owned by Facebook, received a separate fine of 4 million rubles ($54,000), according to a statement from Russian internet regulator Roskomnadzor.
The data localization law, adopted in 2015, requires all internet companies processing Russian users’ data to store such data on servers physically located inside Russia. The policy is aimed at giving the Russian state greater control over online content and communications. It also opens doors for extrajudicial access to user information, which is harder to achieve when personal data is sent or stored using services based outside of the country. While most social media companies still require court orders to support government requests for user data, it is significantly easier for state authorities to gain access to data that is stored locally, either by using surveillance technology or through direct access to company servers in their jurisdiction.
Some technology companies, such as Booking.com, Apple and Samsung, have reportedly complied with the legislation: according to Roskomnadzor, around 600 foreign technology companies with offices in Russia have already localized Russian users’ personal data. But Western social media companies have steadfastly ignored the Kremlin’s demands, and it is unclear how they might react to the new fines.
Russian internet regulator Roskomnadzor has long threatened fines and even blocking for non-compliance, but so far only a few companies have faced palpable sanctions. In 2016, LinkedIn, a social network for professionals now owned by Microsoft, was blocked in Russia for refusing to comply with the data localization rules.
In February 2020, Facebook and Twitter were issued with a 4-million rouble fine each ($54,000), which they failed to pay, with Twitter appealing the fine in court. Commentators at the time noted that since neither company had a legal entity in Russia, it would be difficult to mandate they pay the fines. Google received a similar fine (3 million rubles or $41,000) in July 2021.
Russian data localization rules are hardly unique: countries from Germany and Canada to Vietnam and Indonesia have adopted their versions of rules for national data storage.
In March 2019, Facebook’s Mark Zuckerberg announced that the platform and its other services, Instagram and WhatsApp, would not store “sensitive” user information in countries with a “weak record” on human rights, though did not say which countries made this list.
In the past year, Russia has put new pressures on social media companies.
In the spring of 2021, Russian authorities cracked down on online networks for failing to remove protest-related content during mass pro-opposition rallies around the country. They also began throttling Twitter’s loading speeds to punish the microblogging platform for failing to delete content deemed illegal by Russian censors.
In July 2021, President Vladimir Putin signed a new law that obliges foreign social media companies with over 500,000 daily views to open branch offices in Russia and register local legal entities. Non-compliant platforms could face advertising restrictions or blocking.