On June 26, 2018, the government of the Russian Federation published
Resolution No. 728 , which clarifies the norms of the “Spring Package” regarding Internet sites, instant messengers and other services. The document states that all organizers of the dissemination of information are obliged to keep the traffic of users for six months. We are talking about voice information, images, sounds, videos and electronic messages of Internet users.
This is a serious tightening of the “Yarovoi package” taking into account the fact that Internet service providers are only required to keep the users traffic for 1 month.
But if you use a foreign VPN, then the rules may not apply to you. In this case, sites and instant messengers are
not required to store your messages.
Decree No. 728 has a rather long title “On Approval of the Rules of Storage by the organizer of information dissemination in the information and telecommunications network" Internet "of text messages of users of the information and telecommunications network" Internet "of voice information, images, sounds, video and other electronic messages of users of information and telecommunications network "Internet".
But its essence is formulated quite succinctly.
The first paragraph lists the information to which the decision applies. It is also listed in the title of the bylaw: it is voice information, images, sounds, video, and other electronic messages of users.
The second paragraph states that the organizer of information dissemination (ORI) is obliged to store this information in Russia "and provide electronic messages in the prescribed manner to the authorized state bodies conducting operational investigative activities or ensuring the security of the Russian Federation."
The second paragraph explains to whom these rules apply (in short, only to Russians):
- On users registered using network addresses determined by the information dissemination organizer as used in the territory of the Russian Federation.
- On users authorized by using network addresses determined by the information dissemination organizer as used in the territory of the Russian Federation.
- The users who indicated when registering or using the functions of a communication Internet service an identity document issued by a state authority of the Russian Federation (the main document or other identity document).
- For users who use devices and / or computer programs to access a communication Internet service, transmitting geographic data (metadata) indicating that they are in the territory of the Russian Federation.
- To users, about whom the ORI is informed by authorized state agencies carrying out operational investigative activities or ensuring the security of the Russian Federation, that the users are located in the territory of the Russian Federation.
Finally, the third paragraph indicates the storage period:
6 months from the end of the reception, transmission, delivery and (or) processing of electronic messages.
Obviously, messages on forums and social networks, including private messages, comments on articles, messages in instant messengers and so on, fall under the definition of “other electronic messages”. The hardest thing is for the owners of instant messengers who support the transfer of video and audio messages (Skype, Hangout). Because they will have to either open their own data centers in Russia, or negotiate with the owners of the existing ones, and then store here quite substantial volumes of traffic. Of course, you need to allocate special personnel who will monitor compliance with the rules, that is, the correct data storage. In this sense, the norms of the Russian legislation resemble a European GDPR, with one difference: European legislation is aimed at protecting the personal information of citizens and provides for several procedures, in accordance with which the user may require deletion of their data. Moreover, the operator is
obliged to delete personal data of users after a certain period of time. Russian legislation approaches the question from the other side. Yes, here the operator is also obliged to store data in local jurisdiction, but not at all to protect the user's personal data, but to simplify operational search activities. Russian legislation does not require the
mandatory deletion of data after a certain period; it establishes only the minimum, but not the maximum storage period.
The decree comes into force on July 1, 2018.
A warning at the request of the site administration: “When commenting on this material, please follow the rules. Please refrain from insults and toxic behavior. The postmoderation works in the comments. ”