On July 6, 2016, Russian President Vladimir Putin signed Federal Law No 374-FZ. This law is also known as the “Yarovaya” law (named after a Russian senator who was the main driving force for the law to come into existence).
The Yarovaya law introduces amendments to certain Russian federal laws. The majority of the amendments came into effect on July 20, 2016, however, some of the requirements relating to storage of metadata, as described below, will only come into force starting from July 1, 2018. A draft law which aims to postpone the effective date of such requirements due to their technical complexity from July 1, 2018 to July 1, 2023 is currently being considered by the Russian State Duma.
The Yarovaya law, which is political and primarily aimed at combating terrorism, contains new rules on data retention which need to be taken into account by telecom companies and other persons operating or assisting in the operation of communications services.

Impact on telecom providers and arrangers of information distribution by means of the Internet
In particular, there are provisions which (i) provide information access rights to the Russian investigation and prosecution authorities and which (ii) impose on (A) telecom providers and (B) “arrangers of information distribution by means of Internet,” e.g. those offering or assisting in the offering of communications services via the Internet (the Internet arrangers), certain obligations.
These obligations include the following:
  • to cease the provision of communication services to a user in the event that such user fails to respond to a request by the investigation and prosecution authorities to confirm the user’s identity
  • to store in Russia:
    • for a period of 3 years (with respect to telecom providers) or 1 year (with respect to Internet arrangers): information confirming the fact of receipt, transmission, delivery and/or processing of voice data, text messages, pictures, sounds, video or other communications (i.e., metadata reflecting these communications)
    • for a period of 6 months: the contents of communications, including voice data, text messages, pictures, sounds, video or other communications (this requirement will come into force starting from July 1, 2018 (or, if the draft law referred to above is adopted, July 1, 2023))
  • to supply to the investigation and prosecution authorities the information about the users andany other information “which is necessary for these authorities to achieve their statutory goals”
  • to provide to the investigation and prosecution authorities any information and codes necessary to decode the information.
Failure to comply with the obligations set out in the Yarovaya law may result in an administrative fine of up to RUB1 million (currently, appr. US$15,000). In practice, failure to store should be considered one violation, however, failure to supply information or codes to the Russian investigation and prosecution authorities could be subject to a fine on a case-by-case basis. Given that the new rules have not yet been applied in practice, the above assessment is based on court and administrative practice relating to liability for similar violations.
The term telecom provider is defined in  the Federal Law No. 126-FZ “On Communications” dated July7, 2003 as a legal entity or a sole proprietor providing communication services on the basis of a Russian license. Receiving, processing, storing, transferring or delivering any physical or electronic communications would qualify as communication services. The provision of most types of communication services to Russian users requires a license under Russian law (listed in Governmental Decree No. 87-FZ dated February 18, 2005 “On Approval of a List of Communication Services Subject to a License and Rules and Procedures for Receipt of License”). Foreign persons would also be required to obtain the relevant licenses as long as they provide services, that are part of the licensable activities, to Russian users in Russia.
Furthermore, the term Internet arranger is defined in Federal Law No. 149-FZ On Information, Information Technology and Data Protection dated July 27, 2006 as a person ensuring the functioning of information systems and/or software used to receive, transmit, deliver and/or process electronic messages of Internet users (basically social networks, social media having webpages, etc., would fall under this definition). The Internet arranger needs to notify the Russian authorities of such activity in accordance with a government regulation, which lists specific information that a foreign Internet arranger needs to submit, such as documents confirming its registration number, address and jurisdiction (and is, therefore, supposedly applicable to foreign persons).
The data retention requirements of the Yarovaya law would extend to all data operators participating in a certain communication and ensuring receipt, transmission, delivery and/or processing thereof. Given that some such data operators may be located abroad, retaining the contents of a call between users could put the data operator in breach of foreign privacy laws.
Although the current register listing the arrangers (and compiled on the basis of the filed notifications) does not contain foreign entities, it seems that foreign entities could be considered arrangers and could be obliged to fulfill the Yarovaya law requirements. According to Izvestia, a Russian newspaper, certain global Internet companies have allegedly already received warning letters from the Russian Federal Agency for Supervision over Communications, Information Technology and Mass Media (Roscomnadzor) requiring them to fulfill this notification requirement given their role as Internet arrangers.
The business community believes that the Yarovaya law is unprecedented and is currently trying to assess whether the implementation of the new requirements is technically, commercially and legally feasible.
The requirement to provide the information necessary to decode communications is perceived as potentially not viable in case of use of end to end technology (utilized, for example, by global interactive service providers).
Several telecom and Internet services providers have also voiced concerns over the costs of such implementation and the relevant increase in the price for their services. According to Russian newspapers Russian operators estimate the relevant costs at over RUB2.2 trillion.
A major international VPN provider announced its decision to remove their Russian presence because of privacy concerns due to this law and its enforcement regime.
The full scope and implications (legal, commercial and technical) of this law are yet to be assessed on the basis of court and administrative practice. However, it is obvious that the adoption of this law would lead to substantial overhaul of electronic communications service providers’ business practices in Russia and would significantly increase the scope of data Russian authorities can access.