- Cross-border data flows are an integral mechanism of today’s economy, impacting a country’s competitiveness and growth. All economic sectors rely on secure, cost-efficient and real-time access to data. A requirement that all data-related business processes must take place within a country does not only affect social networks and e-commerce, but any business directly or indirectly.
- The Russian privacy legislation (the “OPD Law”) has been amended by a new law (FZ-242) that includes a clear data localisation requirement. Article 18 §5 of the law requires data operators to ensure that any collection or use of personal data of Russian citizens is made using databases located inside Russia.
- Data localisation leads to productivity losses as firms may not be able to use services provided from abroad, or must set up their own domestic data centres inside Russia. Experience shows that the data-intensive service industry will pass on new costs from regulatory compliance to other sectors of the economy, and the productivity loss it generates leads to lower returns of investment.
- The losses are equivalent to -0.27% of gross domestic product (GDP), equivalent to a loss of 286 billion roubles (US$ 5.7 billion). Applied with 2015 IMF forecasts, the Russian economy would contract by -4.1% this year. Investments in the Russian economy would drop by -1.41% or 187 billion roubles, with considerable effects on employment. The manufacturing sectors are hardest hit, as they must absorb cost increases from their suppliers.
- These highly negative results have taken into account any possible positive effects (e.g. from Russian data processing firms replacing foreign ones). However, the losses are too large to be offset by new jobs created or government initiatives like subsidies and other incentives. Russia’s production structure would shift towards less innovative and volatile sectors such as agriculture, raw materials and energy.
- Yet the numerical results of this analysis do not fully capture the longer term adverse effects of regulations of data flows on technological progress, competitive behaviour and Russian firms’ innovative capacities. Since these factors are the main drivers of long-run economic output growth, our results are likely to significantly underestimate the economic losses arising from data localisation requirements.
Please Note: This paper is now available in Russian language version here.
Overview of Data Regulations in Russia
In Russia, data protection has been covered since 27 July 2006 by Federal Law FZ-152, also known as the OPD Law or the On Personal Data law. It contains similar provisions to those in the 1995 European Data Protection Directive and has been in force since 26 January 2007. The law contains a number of requirements for companies engaging in commercial activities in Russia by introducing administrative barriers. These barriers include a battery of requirements such as the consent requirement for data collection and transfer to third parties; that data is subject to the right to review or to be forgotten; an obligation for the data processor to notify both the data subject and the authorities in case of a data breach, and the obligation to appoint a data protection officer (DPO) when handling personal data. Russia also imposes financial penalties on non-compliance.
In July 2014, the Russian OPD Law was amended by a new law to include a clear data localisation requirement. The amendment, FZ-242, allows data to flow out from Russia. However, article 18 §5 requires data operators to ensure that the recording, systematisation, accumulation, storage, update/amendment and retrieval of personal data of Russian citizens is made using databases located inside Russia. This amendment has been passed by both the State Duma (Lower House of Parliament) and the Federation Council (Upper House of Parliament) and is scheduled to enter into force on 1 September 2015.
Data localisation requirements do not make Russia more resilient to security breaches, natural disasters and technical disruptions compared to storing data in multiple locations. But such a mandate disrupts data flows and economic production by forcing businesses to choose less efficient local suppliers to handle data within Russia. The increased costs result in either higher prices for consumers, or the decision by businesses to remove themselves from the Russian market altogether. Therefore, Russian businesses and consumers may not be able to afford or access all the technological advantages available globally. This is why, in the short run, data localisation requirements reduce both demand and supply, resulting in loss of productivity, competitiveness and economic activity. In the long run, such policies also make a country less attractive to investment and deprive an economy of its innovative and economic potential. Taken together, the policy weakens Russia’s position as an international actor and its ability to attract investments.