Russia Passes More Privacy Legislation – This Time a Strict “Right to be Forgotten”

Published On June 17, 2015 | By Melissa Maalouf | International, Privacy

Over the past year, Russia has exerted increasing control over companies that do business on the Internet in Russia by passing into law a number of strict privacy bills, including a requirement for bloggers to register with authorities and a requirement that Internet companies store Russians’ personal information within Russia.

In Russia’s latest attempt to influence control over Internet companies, a newly proposed bill would allow citizens to force search engines to delete their online personal data upon request. The bill would also impose fines on search engines that do not remove false or outdated information.
While similar to the European Union’s “Right to be Forgotten”, search engines would face even steeper compliance hurdles under the Russian Right to be Forgotten bill for a couple of notable reasons.

  1. Unlike the EU law, the Russian law would not require consumers to identify the specific links they want the search engine to delete. In the EU, consumers must identify the links they want removed, and provide an explanation as to why those links are inadequate or irrelevant. Under the Russian law, consumers would simply need to state what information they wanted deleted (e.g., information related to a drunk driving incident), and it would be up to the search engine receiving the request to find applicable links and then determine whether the information contained in those links is no longer adequate or relevant. Under the bill, information could be considered irrelevant after three years.
  2. Also the Russian law would expressly require worldwide compliance, meaning that a search engine would be required to search for and remove applicable links anywhere they appear throughout their worldwide domains, not just on their Russian domains. In the EU, the jurisdictional limits of the Right to be Forgotten are still being considered by the EU courts and have been heavily debated between Google and EU regulators.

If a search engine decided to deny a consumer’s request under the Russian bill, the consumer could appeal the decision in court. A search engine’s failure to comply with a final court ruling could result in a fine of up to 3 million rubles (~$55,000).

While the Russian bill was passed almost unanimously in the Russian lower house, it still requires further legislative approval and then the signature of the Russian president. If it passes, the bill is expected to take effect on January 1, 2016.

About The Author

Melissa Maalouf’s practice focuses on advising a broad range of clients, from start-ups to established companies, on both U.S. and international data privacy and security issues. Melissa assists clients in drafting appropriate website disclosures, implementing legally-compliant e-commerce flows, responding to FTC Section 5 and state AG enforcement actions, analyzing advertising claims, and children’s online privacy and safety issues. She also regularly helps clients obtain certification under the EU-US Safe Harbor and navigate compliance with divergent international privacy laws.

Comments