LinkedIn blocked in Russia: A welcome warning for global players?

Earlier this month, Russian telecom regulator Roskomnadzor blocked access to LinkedIn for non-compliance with recent legislation on personal data storage. Adopted in 2014, and applicable since September 2015, the law requires companies operating in Russia to store Russian users’ or clients’ personal data on servers physically located in the country. Many foreign and domestic players are concerned, including global players who store their users’ data in borderless clouds (see white paper).

This legislation has triggered considerable criticism inside and outside Russia, with some foreign players seeing the new rules as the beginning of the end of their digital business in Russia.

Western media, on their side, have generally highlighted the move against LinkedIn in the political or even geopolitical context — as part of a series of attempts to control internet communications in Russia.

It is undeniable that the Russian government has taken an increasingly authoritarian view of digital media over the past several years. However, the recent decision to block LinkedIn has little to do with ideology; in fact, Russia’s new legislation may not only be perceived as a costly embarrassment to global businesses, but also as a chance to prepare themselves for the new realities of tomorrow.

What the law says

The main requirements for dealing with personal data in Russia may be summarized as follows:

• Personal data may be collected, stored, and used only with user consent, preferably in written form.
• Personal data (or at least an electronic copy of it) must be stored in databases that are physically located on Russian territory.
• Data operators storing personal data are liable for keeping such data confidential and are not permitted to transfer, share, or disclose such data without user consent. Full protection of data is provided through a range of sometimes demanding organizational and technical measures.

These rules apply specifically to personal data — which should not be confused with any other user-related data. According to Russian law, the primary characteristic of “personal data” is the ability to identify among many persons a specific, unique individual. Thus, most social network content, for example, does not fall within the purview of the law.

At the same time, several issues concerning the law are still ambiguous. In particular, it is not entirely clear whether or not it is possible to transfer the personal data of Russian citizens abroad — and if so, where.

How the law has been applied so far

The law does indeed require international as well as Russian companies to store the data on Russian territory — with considerable differences, however, depending on the type of business and database architecture.

Notwithstanding several other cases of site-blocking for non-compliance (such as the phone number database Abonenty-chast2.pw and the car-driver database Autonum.info), Roskomnadzor has generally displayed a rather mild attitude towards international players, offering them extra time to comply with the law.

Thus many businesses — including Alibaba, Apple, Booking.com, eBay, Google, and Uber — have managed to transfer user data from foreign data centers to Russia or announced ongoing projects to do so. In some cases, the process was helped by numerous consultations with the regulator’s representatives.

Facebook and Twitter have not fully complied to date, as reported, but they meet regularly with Roskomnadzor, and the measures they have undertaken are regarded as satisfactory.

It appears that LinkedIn was blocked only after failing to provide satisfactory answers to repeated Roskomnadzor inquiries. Access to the site was denied, moreover, only after two court rulings — an initial hearing and an appeal — earlier this year.

Also worth noting is the fact that the U.S. company, while not complying with Russian law, reportedly did accede to local legislation when it entered the Chinese market two years ago, storing personal data in local servers.

A useful warning

Russia is far from being the only state to have introduced restrictions on the storage and international use of personal data. Other countries — including Australia, Hungary, Indonesia, Panama, and others — have also adopted specific measures against the illegal storage of personal data. Russia’s legislation, however, is arguably the most radical of all, in that non-complying websites can simply be blocked.

Such moves may well illustrate the resurgence of national sovereignties in the digital sphere. It should come as no surprise that many governments, both authoritarian and democratic ones, are aiming to put an end to the current borderless forms of the web. This is especially true after Edward Snowden and others revealed that this absence of borders means tight control by a handful of powerful states and corporations.

Tomorrow’s internet is likely to be far more fragmented than yesterday’s. For all the complexities implied by this evolution, Russia’s moves to control personal data flows should be regarded as a useful warning for global businesses to adapt to these new realities.

This post first appeared on East-West Digital News, an international resource about innovation in Eastern Europe.