Analytics Legal analytics

22
November
2016

LinkedIn is blocked in Russia for violation of the data protection requirements

Alexandra Vasyukhnova, Partner, Head of Technology and Investment group

Dmitriy Borodin, Project manager of corporate direction

LinkedIn.JPGSpeed read

Russian courts ruled to block access to LinkedIn in Russia due to non-compliance with the requirements for  personal data localization and data protection. The courts declined LinkedIn's arguments that it had no legal presence in Russia and was not properly informed about the claim. This is the first case when a foreign web-service was blocked for non-compliance with the personal data localization / data protection requirements.

Legal background

According to the Personal Data Law[1] the personal data of Russian citizens might be processed only upon the informed and clear consent of the person or without such consent if explicitly allowed by the law. Besides, starting from September 2015 all operators[2] of Russian citizens' personal data must store the data on servers located in Russia[3]. Since then the Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass Communications (the Agency) is authorized to block the web-resource violating the requirements of the Personal Data Law under the court decision.

Facts of the case

LinkedIn provides the Russian-language version of the service but has no legal presence in Russia. During the systematic online monitoring the Agency discovered that LinkedIn violated the Personal Data Law and brought a law suit in order to block the web-resource within the territory of Russia.

The Agency claimed that LinkedIn processed personal data of Russian citizens who were not the registered users of the network and so had not given their consent to such processing. In the court hearings the Agency specified that by personal data it meant the IP addresses, device model numbers, and cookie files of unregistered users.

The Agency also claimed that LinkedIn did not comply with the localization requirement relying on the WHOIS information on the servers location.

LinkedIn did not appear before the Court of the first instance because, as it later explained, had not received the notification in time and thus had no possibility to participate.

On August 4, the Taganskiy District Court satisfied the claim. LinkedIn appealed to the Moscow City Court but without success. On November 10, the appellate court upheld the decision of the lower court. As of the date of this update, the web-page linkedin.com is not available in Russia.

Conclusions and recommendations

Requirements of the Personal Data Law are applied not only to Russian companies, but also to any foreign entity that processes the personal data of Russian citizens. So, any such online service, irrespective of whether it has legal presence in Russia, should make sure that it complies with the requirements of the Personal Data Law.

The ruling of the Court of first instance is quite general and the decision of the appellate court is not yet publicly available. Therefore, it is necessary to further monitor the issue, as the text of the appellate court decision may contain further interpretations of the law crucial for market players.


[1] The Federal Law dated 27.07.2006 No. 152-FZ "On Personal Data".

[2] By operator the Personal Data Law means any legal or natural person that organize and/or carry out processing of the personal data.

[3] According to The Federal Law dated 21.07.2014 No. 242-FZ "On Amendments to a Number of Legislative Acts of the Russian Federation in Connection with Clarification of the Procedure for Processing of Personal Data in Information and Telecommunications Networks".

Apply to participate

Agreement

Apply to participate

Оценка:

Agreement