Russia Jurisdiction: Physical Location/Residency of Data Subject in Jurisdiction

The factor of Physical Location/Residency of the Data Subject is explicitly used in Russia's Federal Law on Personal Data (№ 152-FZ) to determine the law's applicability. The law extends to the processing of personal data belonging to Russian citizens, even when such processing is conducted by foreign entities outside of Russia, provided certain conditions are met.

Text of Relevant Provisions

№ 152 - FZ Art.1(1.1):

"The provisions of this Federal Law shall apply to the processing of personal data of citizens of the Russian Federation carried out by foreign legal entities or foreign individuals on the basis of an contract to which citizens of the Russian Federation are a party, other agreements between foreign legal entities, foreign individuals and citizens of the Russian Federation or on the basis of the consent of a citizen of the Russian Federation to the processing of his/her personal data.* (ed. Federal Law dated July 14, 2022 N 266-FZ)."*

Original (Russian):

"Положения настоящего Федерального закона применяются к обработке персональных данных граждан Российской Федерации, осуществляемой иностранными юридическими лицами или иностранными физическими лицами, на основании договора, стороной которого являются граждане Российской Федерации, иных соглашений между иностранными юридическими лицами, иностранными физическими лицами и гражданами Российской Федерации либо на основании согласия гражданина Российской Федерации на обработку его персональных данных. (часть 1.1 введена Федеральным законом от 14.07.2022 N 266-ФЗ)"

Analysis of Provisions

• Article 1(1.1) of the Federal Law № 152-FZ clearly stipulates that the law applies to the processing of personal data of Russian citizens by foreign entities. This applicability is triggered when the processing is conducted under a contract or agreement involving a Russian citizen, or based on the consent of the Russian citizen for such processing.
• The provision emphasizes the citizenship of the data subject as the critical factor for the law’s applicability, regardless of where the processing occurs. This means that even if a foreign company processes the data of a Russian citizen outside of Russia, the provisions of the Russian Federal Law on Personal Data would still apply.
• This factor was included in the law to ensure that Russian citizens' personal data remains protected under Russian law, even when it is processed by foreign entities. It reflects a policy to assert jurisdiction over personal data belonging to Russian citizens, regardless of the geographic location of the processing entity.
• The law’s scope is extended beyond Russia’s borders, creating an extraterritorial reach that binds foreign entities to Russian data protection regulations when they engage in processing activities involving Russian citizens.

Implications

• For businesses, particularly those operating internationally, this means that any processing of personal data involving Russian citizens could subject them to Russian data protection laws, even if the processing is conducted entirely outside of Russia. This can include global e-commerce platforms, foreign service providers, and any entities entering into contracts with Russian citizens.
• Companies must be aware of the need to obtain appropriate consent from Russian citizens when processing their data and ensure compliance with Russian data protection requirements. Failure to comply could result in legal and regulatory challenges from Russian authorities.
• An example would be a foreign-based online service provider that collects and processes personal data from Russian users. Even if the company has no physical presence in Russia, it must still adhere to Russian data protection laws due to the citizenship status of its users.