Header graphic for print
HL Chronicle of Data Protection Privacy & Information Security News & Trends
Posted in International/EU Privacy

Russia Introduces a Right to be Forgotten

Russian FlagWith the aim of keeping pace alongside European practice, on July 13th 2015, the Russian President signed into law a bill amending the Federal Law “On Information, information technologies and on protection of information” No. 149-FZ of 27 July 2006. This law (the “Law”) introduces in Russia the so-called “right to be forgotten” or “right to oblivion” and will take effect on January 1st 2016.

Under the Law, upon receiving a request from an individual, search engines must cease listing links to Internet pages with information on the individual where such information is:

  • unlawfully disseminated;
  • untrustworthy;
  • outdated; or
  • irrelevant (i.e. it has lost its importance to the individual due to subsequent events or actions of the individual).

The Law includes exemptions that search engines can rely on when the information is about events reporting a crime and where the limitation period for criminal liability has not expired; as well as for crimes committed by an individual where their conviction record has not been erased.

The Law also covers search engines which display Internet advertisements directed at consumers located in Russia. Therefore, it is likely that the Law applies to foreign search engines displaying Internet pages directed or targeted at a Russian audience.

An individual’s request must contain information about the individual, about the websites which they request are delisted from search results on their name with the reason(s) for the removal, as well as providing consent to the search engine to  use his/her personal data submitted through the request form.  The search engine is prohibited from revealing that it has received a request from an individual.

The search engine has 10 business days to consider the individual’s request and decide whether (i) to ask for details missing from the request, (ii) to cease showing the relevant links in search results, or (iii) to send a refusal to the individual explaining why the search engine will not comply with the individual’s request. Where additional details are requested from the individual by the search engine, the individual has 10 business days to provide clarifications and missing information. Having received the clarifications and any missing information, the search engine has 10 business days to cease showing the relevant links in the search results. Otherwise it must provide the individual with reasons justifying its refusal to do so.

If the individual considers the refusal is unjustified, he/she may appeal to the courts. The Law provides an exception from the general rule in Russia that the claimant must bring a claim in the regional court where the defendant is located. Instead it allows individuals to file a claim in their own local court. This flexibility for claimants will cause additional expense for search engines as they could potentially be required to defend themselves before courts all over Russia.

It is too early to predict the impact of the Law. However, major Russian search engines have already criticized the Law. They complain that the Law will be burdensome for search engines for several reasons. One of the reasons is that there is only a relatively short time for search engines to consider individuals’ requests (only 10 business days). However, the most important reason is the absence of clear criteria for determining the accuracy, relevance and lawfulness of the dissemination of the information in question, as this makes it difficult for search engines to assess whether a  request is well-founded or not.

The Law itself, as well as general Russian legislation currently in force, does not provide for specific liability for non-compliance. However, a separate bill (the “Bill“) introducing liability for non-compliance with law is currently being considered by the Russian State Duma (the lower chamber of the Russian Parliament). According to the Bill, an unjustified refusal to comply with an individual’s request could result in the imposition of an administrative fine of up to RUR 100,000 (approx. EUR 1,600, USD 1,550). Moreover, a failure to comply with a respective court decision within 5 days could result in a fine of up to RUR 3,000,000 (approx. EUR 50,000, USD 47,000).

This Bill still needs to be adopted by the Russian State Duma, approved by the Federation Council (the upper chamber of the Russian Parliament) and signed by the Russian President. Therefore, it is possible that the Bill will be further amended.

We will carefully monitor the progress of the Bill, as well as enforcement of the Law and we will post updates on the Chronicle of Data Protection.

If you have any questions, feel free to reach out to Timothy Tobin (Partner, Washington DC), Natalia Gulyaeva (Partner, Moscow) or Maria Sedykh (Associate, Moscow).