What happened?

On Tuesday, the 14th of November, Russia imposed significant fines on Google for failing to comply with Russian law, which requires databases to store the personal data of Russian individuals on servers located within Russia. The court ordered Google to pay a fine of 15 million Rubles (164,000 USD).

This is the third time they have been fined for the same offense after previously being charged with identical infringements in 2021 and 2022. Only 3 months before this ruling, a Russian court issued a fine in response to Google’s refusal to remove what it deemed as false news about the war in Ukraine. However, on that particular occasion, the fine was substantially lower.
At the moment, there are no servers located in Russia, the closest one being in Hamina, Finland. There are five more data centers scattered throughout Europe, which are server storage locations. In total, there are twenty-four data centers, with the majority of them located within the United States.

Russia will face difficulties during the process of collecting the $164,000 fine from Google, as Russian authorities have already seized Google Russia’s bank account, forcing them to declare bankruptcy. This means that they have not been able to pay their employees, or vendors, up until this point. Nevertheless, the fine still imposes an obligation upon Google Russia, which will be nearly impossible to fulfill.

After Russia escalated its invasion in February 2022, many social media platforms have been banned by Russia. However, a complete ban on Google is still missing, as some features, such as their search engine or YouTube, are still permissible.

Rules in the GDPR

The EU has similar rules concerning the transfer of personal data to countries outside of the EU that aim to protect the rights of the data subjects.

According to EU law, the personal data of EU residents must be stored and processed within the EEA, unless a specific exemption applies. These exemptions may be granted either in the form of an adequacy decision, or appropriate safeguards.
An adequacy decision is issued by the European Commission, which ensures that the third country where the data of EU residents will be stored and processed has sufficient levels of protection afforded.

In the absence of an adequacy decision, the transferor of the personal data must ensure that there are appropriate safeguards in relation to the transferee. Such safeguards may be a contract between the undertakings that meet minimum data protection standards, subject to review by an official authority. Another way is receiving a certification from the European Data Protection Board.

The penalties imposed through EU law, however, are much higher compared to the fines that Russia imposed upon Google. If Google had committed the same infringement under EU law, they would have to pay a fine of 4% of their total worldwide annual turnover in the preceding financial year, which totals 11.2 billion USD.

Opinion

As observed from the severe penalties that the GDPR imposes on illegal data transfers outside of EEA countries, much concern is directed towards this subject. Therefore, it is only reasonable for Russia to put in place similar restrictions on companies and organizations processing the data of their individuals.

However, if Russia is concerned about the personal data of their citizens being stored in other countries, they should create a more suitable environment for organizations to be willing to set up their servers within Russia. This means that they should incentivize and accept foreign workers, as well as promote competition. Most importantly, Russia should foster a safe environment so that companies have the legal certainty necessary to invest long-term.

These ideals, however, are not fulfilled. Russia has a widespread negative immigration sentiment. Although they do offer immigration opportunities for foreigners, especially for former Soviet Union citizens, these are becoming more unpopular due to the negative acceptance among the Russian people. Furthermore, foreigners are less likely to want to immigrate to the Russian Federation. Even before February 2022, there have been significant restrictions on human rights, but with a further escalatory crackdown on the freedom of expression of any kind, most individuals are even more scared to live in Russia for an extended period. Moreover, with Russia’s severe corruption crisis, foreign companies have incredible difficulties establishing themselves. For online companies, this means that they are willing to offer their services in Russia, however, they are hesitant to build an extensive network of infrastructure, and workers.

Russia, just like the rest of the world, has the right to request that the personal data of Russian citizens remain within Russian territory. On the other hand, companies at the same time must make decisions that are the most financially suitable. If they are afraid of how Russia’s policies will impact them, they must decide on how to proceed. Either they can accept and repeatedly pay the fines, or remove their services altogether and avoid prosecution. Neither of these scenarios will satisfy Google or the Russian State. As evident, Russia has no intention of encouraging Google and similar companies to exit from the Russian market. Instead, they are attempting to persuade companies to follow their guidelines and principles. Therefore, they should not bring these laws into effect which punish the companies and organizations, which will only discourage them from entering the market. Instead, they should create the necessary incentives to attract foreign firms to set up their infrastructure in Russian territory.