Russia demands 13 IT giants to obey new onshoring law

On 22 November 2021, Russia registered 13 IT corporations, including Google, Apply, Zoom, Twitter and TikTok, which must open offices in Russia by 2022 and comply with the recently adopted onshoring law. Other internet businesses should stay on alert since the law may still apply to them.

Onshoring Law

According to article 5 of the Federal Law On Activities of Foreign Persons in the Information and Telecommunication Network Internet in the Territory of the Russian Federation (the Onshoring Law, Dated 1 July 2021 No. 236-ФЗ), foreign internet companies are allowed to act in Russia (ie, to perform services to Russia-based users) provided that they:

• open an office in that country (a limited liability company, a representative office or branch);
• place a feedback form in their mobile apps, on websites and other web resources so that Russian nationals and entities may submit enquiries, claims and other correspondence according to the requirements approved by the cybersecurity watchdog (the Roscomnadzor); and
• create an account on the Roscomnadzor's official website and use it to liaise with the authorities. The authorities will deem their official correspondence to have been received by an account owner on the day when they upload it to the account.

These steps should help the authorities to enforce content blockage and moderation rules, the personal data localisation requirement (ie, processing Russian nationals' data in certain ways within Russia), advertising laws and other national requirements against global online businesses.

Foreign internet companies

The Onshoring Law applies to four groups of entities and persons:

• foreign legal entities, other organisations, nationals and stateless persons that own a website and/or page on a website and/or software (eg, a mobile app) and/or IT system (each separately, a "Web Resource") that has more than 500,000 daily user visits from Russia and meets at least one of the following additional criteria (Article 4(1) of the Onshoring Law):
  • it contains information in Russian, in one of the regional languages of the Russian Federation or in another language of a Russian ethnic group;
  • it disseminates advertisements intended for Russia-based customers;
  • it processes data about users located in Russia; and
  • the owner of the Web Resource accepts money from Russian natural or legal persons;
• hosting providers or other persons that host web services used by Russians. Under the Decree of Government dated 27 October 2021 No. 1836, the Onshoring Law should apply if they:
  • process data about users residing in Russia;
  • receive monies from Russian natural persons and legal entities; and/or
  • put online "information resources, including information systems and/or software owned by Russia-based persons or entities and/or information resources, including information systems and/or software that are used by users who reside, among other locations, within the territory of the Russian Federation";
• advertising networks, such as non-Russian entities that maintain information systems and/or software intended and used for organising the online dissemination of advertisements aiming at attracting the attention of consumers residing, among other places, in Russia through third-party Web Resources (Article 4(2) of the Onshoring Law);
• organisers of data dissemination, such as entities that operate information systems and/or software intended and/or used for receiving, transmitting, delivering and/or processing electronic messages of web users including those residing in Russia. In simple words, if a website or app supports user accounts, posting and/or messaging, it may be regarded as the organiser of data dissemination.

The Onshoring Law applies to the entities in all groups above (except for the first) regardless of how many users they have daily. It means that the scope of application is not limited to IT giants and the vast majority of international online services should bear the Onshoring Law in mind while dealing with Russian users.

Identifying and registering foreign internet companies

Under article 8 of the Onshoring Law, the Roscomnadzor maintains a public register of foreign internet companies on its official website. The Roscomnadzor has the power to record such companies at its sole discretion, which is what happened with the 13 IT giants. These are Google LLC, Apple Distribution International Ltd, Meta Platforms Inc, Twitter Inc, TikTok Pte Ltd, Telegram Messenger Inc, Zoom Video Communications Inc, Likeme Pte Ltd, Viber Media Sàrl, Discord Inc, Pinterest Inc, Spotify AB and Twitch Interactive Inc.

However, the language of the Onshoring Law suggests that foreign companies are required to assess by themselves whether they fall under the Onshoring Law according to the criteria described above. If this is the case, they must create an account at the Roscomnadzor's website out of their own initiative and, after that, apply to the Roscomnadzor's register within 24 hours.

Coercive measures

Depending on which law or requirement is breached, the Roscomnadzor may apply the following coercive measures without recourse to the court (Article 9 of the Onshoring Law):

• partially or completely block access to a Web Resource within the territory of Russia;
• restrict money transfers to a foreign company from Russian individuals and legal entities;
• prohibit a foreign company from collecting Russian nationals' personal data and restrict cross-border transfers to the foreign company from Russia;
• restrict advertising or including a Web Resource into search engine results; and
• inform users that a Web Resource breaches Russian law by adding the relevant notice to search engine results.

The Roscomnadzor must cancel the applied measures when the breaches have been rectified.

Comment

International online businesses should carefully assess whether they fall under the applicability criteria described above. If they are not in the Roscomnadzor's register, but meet the criteria, this does not necessarily mean that they need not comply with the Onshoring Law. They should either voluntarily create an account at the Roscomnadzor's website or keep monitoring the situation and accept the risks of enforcing coercive measures. For instance, the establishment of an office may take several months, and, during this time, the Roscomnadzor may impede or suppress business operations in Russia.