August 26, 2015, 11:24 pm / Opinions

How to close Facebook in Russia

The authorities want to control Runet, but are afraid to close it

For the second time in a row, Roskomnadzor finds itself in a very strange situation. First, an unsuccessful attempt to block Wikipedia (for more details, see the column on page 07), then Facebook responded to the department’s request to transfer user data to Russia. The regulator is placed in an awkward position. Following a bad law written to control popular Internet resources, he will clearly have to close them for insubordination. But closure was not the goal, and the effect is difficult to predict.

The requirements of the Personal Data Law regarding the transfer of data to Russia come into force on September 1. The main problem is the extremely general nature of the legislative wording, says Pavel Savitsky from the law firm Borenius. For more than a year after the relevant amendments were made to the law, Roskomnadzor refused to specify the requirements for Internet services, and officials were confused in their testimony, disorienting businesses. Are we talking about localizing only databases or also software that can use constant information exchange with foreign servers? Does the requirement for “processing” of data on the territory of Russia include its storage and other types of work with information? When agreeing to store data in Russia, is the company obliged to present it to government authorities and how exactly? Does this apply only to Russian companies or companies that have representative offices in Russia - or those that do not? There are only non-official explanations about all this from the Ministry of Telecom and Mass Communications.

The law is extremely vague about what exactly is meant by personal data.

The phrase “any information relating directly or indirectly to an identified or identifiable natural person” is subject to extremely broad interpretation, and such information often does not identify a specific individual (for example, when it comes to common or fictitious names). Facebook's refusal on the grounds that account data is not personal data is logical. It confronts Roskomnadzor with the need to clearly formulate what exactly is proposed to be understood by personal data.

One can imagine an option in which Roskomnadzor will do this and market participants will comply with the law based on clear instructions. And Facebook will retain its reputation as a company that cares about the safety of user data and does not want to pass on the pointless costs of moving servers. But this particular option seems fantastic in today’s Russia. Rather, Roskomnadzor will wait for clear political orders. According to Savitsky, instead of protecting personal data, the new law, focusing on prohibiting cross-border transfers, solves the problem of controlling it. Services like Facebook already comply with the data protection requirements specified in the law, which require the conclusion of an agreement between the transferring and receiving parties - when creating an account, the user accepts the user agreement, which is actually such an agreement.