Struggling to strike the right balance between interests at stake: The ‘Yarovaya’, ‘Fake news’ and ‘Disrespect’ laws as examples of ill-conceived legislation in the age of modern technology

(1)

Struggling to strike the right balance between interests at stake

Moyakine, Evgeni; Tabachnik, A.

Published in:

Computer Law & Security Review

DOI:

10.1016/j.clsr.2020.105512

IMPORTANT NOTE: You are advised to consult the publisher's version (publisher's PDF) if you wish to cite from

it. Please check the document version below.

Document Version

Publisher's PDF, also known as Version of record

Publication date:

2021

Link to publication in University of Groningen/UMCG research database

Citation for published version (APA):

Moyakine, E., & Tabachnik, A. (2021). Struggling to strike the right balance between interests at stake: The

‘Yarovaya’, ‘Fake news’ and ‘Disrespect’ laws as examples of ill-conceived legislation in the age of modern

technology. Computer Law & Security Review, 40, [105512]. https://doi.org/10.1016/j.clsr.2020.105512

Copyright

Other than for strictly personal use, it is not permitted to download or to forward/distribute the text or part of it without the consent of the author(s) and/or copyright holder(s), unless the work is under an open content license (like Creative Commons).

Take-down policy

If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim.

Downloaded from the University of Groningen/UMCG research database (Pure): http://www.rug.nl/research/portal. For technical reasons the number of authors shown on this cover page is limited to 10 maximum.

(2)

Availableonlineatwww.sciencedirect.com

journalhomepage:www.elsevier.com/locate/CLSR

Struggling

to

strike

the

right

balance

between

interests

at

stake:

The

‘Yarovaya’,

‘Fake

news’

and

‘Disrespect’

laws

as

examples

of

ill-conceived

legislation

in

the

age

of

modern

technology

E. Moyakine

a,b,∗

_,

_A.

_Tabachnik

b

a_University_of_Groningen_{– TLS,}_Groningen,_the_Netherlands b_University_of_Haifa_{– CCLP,}_Haifa,_Israel

a

r

t

i

c

l

e

i

n

f

o

Keywords:

Russianlegislation Yarovayalaw Fakenewslaw Disrespectlaw Humanrights Privacy Dataprotection Freedomofexpression Publicsafety Publicsecurity

a

b

s

t

r

a

c

t

Thearticledealswiththelegislativeamendmentsthathavebeenrecentlyadoptedinthe RussianFederation,theso-called‘Yarovaya’law,the‘fakenews’lawandthe‘disrespect’ law.Itexplainstheessenceandproblemsofimplementationoftheabove-mentionedlegal instrumentsandassessesthemfromthehumanrightsangle.Itisestablishedthattherather complexlawsunderanalysisposesignificantthreatstothehumanrightsandfundamental freedomsofindividuals,includingprivacy,dataprotectionandfreedomofexpression,and introduceotheradditionalnegativeeffectstotheRussiansocietyandeconomy.Whilein theadoptionofsuchlegislationitiscrucialtogivedueweighttotheinvolvedinterests,the usedexamplesindicatethattheState’sinterestsseemtoprevailatthecostoftherights andfreedomsofthosewhoneedtobeadequatelyprotected.

1. Introduction

Cyberspace hasbecomedeeplyintegrated inourlives:it is currentlyimpossible toimaginethe existenceofamodern individual without a variety of technical tools, including smartphones, tablets and computers, that are constantly connectedtotheworldwidewebandutilizedonadailybasis. Cyberspace notonlyoffers manynew opportunities inthe strugglefordemocracyandrespectofhumanrightsbutalso posesawiderangeofchallengesandcanbeusedandabused

∗_{Corresponding}_author_at:_University_of_Groningen_{– Faculty}_of_Law_{– TLS,}_Oude_Kijk_in_’t_Jatstraat_26,₉₇₁₂_EK_Groningen,_the

Nether-lands.

E-mailaddress:e.v.moyakine@step-rug.nl(E.Moyakine).

inthe domain ofnational security.It constitutes aunique battlefieldwheregovernments– oftenwith theassistance of variousprivateactors– fightnewtypesofwar,including strug-glesforthemindsofpeople,arealmwhichevermoredeeply influencesthedevelopmentofoureconomyandcivilsociety. Intherecentyears,informationwarfare(hereinafter:IW) incyberspacehasbecomeRussia’smajortoolinitsconflict withtheWest.ThroughIW,particularlypropagandaeffortsin cyberspace,Russiahasallegedlyrepeatedlyintervenedinthe electionprocessesand internalaffairs ofthe US,Germany, the United Kingdom, Ukraine and several other countries.

https://doi.org/10.1016/j.clsr.2020.105512

(3)

Additionally, through IW Russia has reportedly striven to challengethestabilityoftheleadingWesterncountries.1

Atthesametime,theRussianleadershipisconvincedthat Moscowisendangeredbyinternalandexternalfoesseeking tochallengeRussiannationalsecurity,includingthatofthe informationsector.FromMoscow’sperspective,theinternet, andthefreeflowofinformationgenerally,threatensRussian nationalsecurity.Thus,inordertopreventapossibleWestern (or/and pro-Western forces in Russia) effort to destabilize Russia(asitisperceivedinRussia)throughIWincyberspace, Moscowshouldtakethenecessaryprecautions.2

Moscow accordinglystrivesto keepinformation flow in Russiancyberspaceunderitsstrict control.Thus,itaimsto preventordeterasmuchaspossibledisseminationof infor-mation which may create anegativeimage ofthe country and itsleadership,or anyactivitywhichmay endangerthe regime’sstability.

Therefore,throughlegislationandregulationMoscowtries tostrengthencontrolovertheinformationflowinthe Rus-siansegmentofcyberspaceandaccordinglytopreservethe stabilityofthecurrentregime(asbelievedbytheauthorities inMoscow).Inthisregard,anumberoflaws/amendments ac-ceptedbytheRussianparliamentandsignedbythePresident inthelastyearsare particularlynoteworthy:the‘Yarovaya’ law,the‘fakenews’lawandthe‘disrespect’law,whichwill be discussed below.3 _To _the _general _public,_this _legislation ispresentedasanecessarymeasureforthepreservationof publicsafetyandasananti-terroristmeasure.

It isand remains aquestion however whether this leg-islation is a feasible and effective tool for ensuringpublic safety andwhich humanrights complicationsitmay have, morespecificallythoserelatedtoprivacyanddataprotection. Moreover,howwillthislegislationaffectotherfundamental rightssuchastherighttofreedomofexpression?

1_Keir_Giles,_Handbook_of_the_Russian_Information_Warfare

(Fellow-shipMonograph,NATODefenseCollege(ResearchDivision)2016); RaphaelSCohenandAndrewRadin,Russia’sHostileMeasuresin Europe:UnderstandingtheThreat(Report,RANDCorporation2019).

2_Valeriy_Gerasimov,_‘The _World_on_the_Edge_of_War:_It_is_not

EnoughtoTakeintoAccountToday’sChallenges,ItisNecessary toPredictFutureOnes’(inRussian)(Voyenno-promyshlennyiKuryer, 13March2017)<https://vpk-news.ru/articles/35591>accessed20 August2020; ‘PatrushevUrgedtoProtectYoung InternetUsers fromForeignIntelligenceServices’(inRussian)(Interfax,19July 2019) <https://www.interfax.ru/russia/669683>accessed20 Au-gust2020.

3_Federal_law_dated_as_of_06.07.2016_No._374-FZ_‘On_the

Adop-tionofAmendmentstotheFederalLaw“OnCountering Terror-ism” andSpecificLegislativeActsoftheRussianFederation Re-gardingtheEstablishmentofAdditionalCounter-terrorism Mea-suresandEnsuringPublicSecurity’(inRussian)(Kremlin.ru)<http: //kremlin.ru/acts/bank/41108/page/1>accessed25August2020;‘A LawHasBeenSignedEstablishingAdministrativeResponsibility fortheDissemination ofKnowinglyInaccurate Socially Signifi-cantInformation’(inRussian)(Kremlin.ru,18March2019)<http:// kremlin.ru/acts/news/60082>accessed25August2020;Mark Kru-tov,‘Youareviolatingthelaw,dear[Sir]!TheFirstDaywiththe “LawonDisrespectTowardsAuthorities” (inRussian)(Radio Lib-erty,29March2019)<https://www.svoboda.org/a/29849863.html>

accessed20August2020.

2. Background

Balancingbetweennationalsecurityneedsanddataprivacy rightsremainsacoredilemmainthefieldofrule oflawin cyberspace.In this regard,‘data privacy rights represent a specialformof respectforthe humanright toprivacy.An individual’sright tohavehis orher personaldata– name, telephonenumber,address,health,physicallocation, finan-cialinformation,andothersuchidentifiers– protectedfrom usebyotherswithouthisorherconsentisderivedfromthe generalrightoftheindividualtoprivacy.Thisrighthasbeen codifiedattheinternationallevel,interalia,bytheUniversal DeclarationofHumanRights,theInternationalCovenanton CivilandPoliticalRights(ICCPR),theEuropeanConventionfor theProtectionofHumanRightsandFundamentalFreedoms, andseveralotherregionalhumanrightstreaties’.4

Also‘inthecyberspacecontext,theTallinnManual2.0on theInternationalLawApplicabletoCyberOperationsnotes thatinternationalhumanrightslawappliestocyber-related activitiesofastateasamatteroflexlata,andthatindividuals enjoythesameinternationalhumanrights(suchasprivacy) withrespect tocyber-related activitiesthat they otherwise enjoy’.5 _Overall, _the _ideas _regarding _a _level _of _control _of governmentalstructuresovercyberspacerangefrom digital libertarianism tocomplete digital sovereignty.Atthesame time,particularnationalandregionaljurisdictionsinterpret andapplydataprivacyrightsindifferentways.6

ThemajorityofEUMemberStatesseems(incomparison toother majorinternationalsgovernmentalplayers)totake themostbalancedpositioninprotectingprivacyrightsand freedomofexpressionandtakingintoaccounttheneedsof nationalsecurity,forexampletheEUGeneralDataProtection Regulation(hereinafter:GDPR),whichincludesexplicitdata protectionmechanisms and introducesavariety of obliga-tionsandrights.7_At_the_same_time,_considering_the_balancing act between digital libertarianism and digital sovereignty, the European regulation is rather closer to the libertarian approach than to digital sovereignty. That is, the GDPR

4 _Deborah _{Housen-Couriel,} _‘Balancing _National _Security

and Data Privacy: A Key Regulatory Challenge in Cyberspace’ (4 March 2018) < https://csrcl.huji.ac.il/people/balancing-national-security-and-data-privacy-key- regulatory-challenge-cyberspace>accessed25August2020.

5 _Michael_N_Schmitt_(ed),_Tallinn_Manual_2.0_on_the_{International} LawApplicabletoCyberOperations(CUP2017)(‘TallinnManual2.0’); DeborahHousen-Couriel,‘BalancingNationalSecurityandData Privacy:AKeyRegulatoryChallengeinCyberspace’(4March2018)

<https://csrcl.huji.ac.il/people/balancing-national-security- and-data-privacy-key-regulatory-challenge-cyberspace>accessed25 August2020.

6 _Jack_M_Balkin,_‘Digital_Speech_and_Democratic_Culture:_A

The-oryofFreedomofExpressionfortheInformationSociety’2004 79NewYorkUniversityLawReview,1-58;JamesBoyle,‘Foucault inCyberspace:Surveillance,Sovereignty,andHardwiredCensors’ 199766UniversityofCincinnatiLawReview177-205.

7 _Regulation_2016/679_of_the _European _Parliament_and _of_the

Council of27 April 2016on the protection of natural persons withregardtotheprocessingofpersonaldataandonthefree movementofsuchdata,andrepealingDirective95/46/EC[2016] OJL119/1(GeneralDataProtectionRegulation).

(4)

contains provisions that allow governmental structures to collect and process personal data that otherwise have a protected status. However, the GDPR incorporates a set of constraintswhichlimitsgovernment’scapabilitiestoaccess personal information and thus protects the fundamental rights of data privacy(inter alia, necessity, proportionality, transparencyandfairness).8

This corresponds to the criteria defined in the Report ofthe Officeofthe UnitedNationsHighCommissioner for HumanRightsontherighttoprivacyinthedigitalage.The reportrecognizesthattherighttodataprivacycanbesubject torestrictionsundercertainextraordinarycircumstances:for example,bymeans ofgovernmentalsurveillancemeasures directedatpreventionofterrorismorseriouscrime.However, thereisaneedforfurtherpracticalguidancewithregardto thisinterferencethatmustbe‘groundedininternational hu-manrightslaw,ontheprinciplesofnecessity,proportionality andlegitimacyinrelationtosurveillancepractices’.9_Also,_the European Data Protection Supervisor underlines relevance ofthefundamentalrightstoprivacyand dataprotectionin the current day and age, more specifically when it comes toonlinemanipulation,andamutualdependencybetween theserightsandfreedomofexpression.10

Therefore,‘inlinewiththeSpecialRapporteur’s view,an optimal regulatory balance between the protection of per-sonaldataandnationalsecurityconsiderations willpermit necessary and proportional exceptions to the protection regime.Criteriaforswayingthebalanceawayfromindividual privacyrightswillbeincludedinatransparentwaywithinthe statutoryregime,sothatjudicialreviewofnationalsecurity andotherexceptionsisfeasibleandavailabletodatasubjects whowanttocontestcarveouts’.11

However,complexitiesoftheapplicationofinternational lawincyberspacearerisingduetoarecenttrendonthe ad-vancementofdigitalsovereigntybyanumberofkeycountries intheinternationalsystem,foremostthePeople’sRepublicof ChinaandtheRussianFederation.Digitalsovereigntycanbe definedasanefforttocontrolandgovernaccess,information

8_Deborah _{Housen-Couriel,} _‘Balancing _National

Secu-rity and Data Privacy: A Key Regulatory Challenge in Cy-berspace’ (4 March 2018) <https://csrcl.huji.ac.il/people/ balancing-national-security-and-data-privacy-key- regulatory-challenge-cyberspace>accessed25August2020.

9_Annual _report _of _the _United _Nations _High _Commissioner

forHuman Rights and reports ofthe Officeof the High Com-missioner and the Secretary-General, ‘The right to privacy in the digital age: Report of the Office of the United Nations High CommissionerforHuman Rights’(U.N.Doc.A.HRC/27/37, p. 16,30 June 2014) <https://www.ohchr.org/EN/HRBodies/HRC/ RegularSessions/Session27/Documents/A.HRC.27.37_en.pdf> ac-cessed16July2020.

10_European _Data _Protection _Supervisor, _EDPS _Opinion _on On-line Manipulation and Personal Data, Opinion 3/2018 (19 March 2018) <https://edps.europa.eu/sites/edp/files/publication/ 18-03-19_online_manipulation_en.pdf> accessed 25 August 2020.

11_Deborah _{Housen-Couriel,} _‘Balancing _National

Secu-rity and Data Privacy: A Key Regulatory Challenge in Cy-berspace’ (4 March 2018) <https://csrcl.huji.ac.il/people/ balancing-national-security-and-data-privacy-key- regulatory-challenge-cyberspace>accessed25August2020.

flow and infrastructure in digital sphere by governments withintheirsovereignjurisdictions.12

China and Russia promote digital sovereignty in order toprotect their national security and regimes’ stability, as claimedbytherespectiveregimes.Bothcountriesstrivefor greatercontrolovertheirowncyberspaceandconsequently more control over information flow, disregarding data pri-vacy and freedom of expression.13 _Moreover, _these _efforts may encourageother countries suchas Iran,Turkey,Saudi Arabia, Egypt and many others to reinforce strict control overtheir‘parts’ofcyberspaceandtoinfringefundamental humanrightsincyberspace.14_{Consequently,}_the_last_efforts of‘sovereignization’ of cyberspace widen the gap between theWestern-liberaldemocracies(foremosttheEUandUS)on theonehandandthekeynon-democraticcountriessuchas thePRCandRussia ontheother handinthefield ofcyber regulationandparticularlydataprotectionand implementa-tionofbasichumanrightssuchasfreedomofexpressionin thedigitaldomain.

These developments shape a new momentum in the sphere ofprivacy, data protection (retention) and freedom ofexpressionincyberspaceandshiftthebalanceinfavorof Stateactorsattheexpenseofrespectforandprotectionof fundamentalhumanrightsandfreedomssuchastherightsto privacyanddataprotectionandfreedomofexpression. More-over,differencesbetweenapproachestowardsupholdingthe abovementionedhumanrightsandfreedomsandprotecting nationalsecurityinvariouscountriesleadtonewquestions regardingtheprotectionofpersonaldataintheglobalcontext, especially considering trans-jurisdictional flow of personal information.15 _In_particular,_it_becomes_pertinent_to_answer thequestionhowtheEUshoulddealwiththelatestchanges intheRussianlegislationandregulationinthefieldofdata

12_Stephane_Couture_and_Sophie_Toupin,_‘What_Does_the_Notion

of“Sovereignty” MeanWhenReferringtotheDigital?’(2019)21(10)

NewMedia&Society,2305;AbidAAdonis,‘InternationalLawon CyberSecurityintheAgeofDigitalSovereignty’(E-International Relations, 14 March 2020) <https://www.e-ir.info/2020/03/14/ international-law-on-cyber-security-in-the-age-of- digital-sovereignty/>accessed21August2020.

13_Stanislav _Budnitsky _and _Lianrui _Jia, _‘Branding _Internet

sovereignty: Digital media and the Chinese–Russian cyberal-liance’201821(5)EuropeanJournalofCulturalStudies,594-613.

14_UN_Human_Rights_Council,_‘The_actions_of_the_Russian

Federa-tionarejeopardisingonlinefreedomseverywhere’Item4General Debate - Oral Statement, (27 June 2018) <https://rsf.org/sites/ default/files/unhrc_item_4_statement_on_russia_-270618_en. pdf>accessed19August2020.

15_UN_Human_Rights_Council,_‘The_actions_of_the_Russian

Federa-tionarejeopardisingonlinefreedomseverywhere’Item4General Debate - Oral Statement, (27 June 2018) <https://rsf.org/sites/ default/files/unhrc_item_4_statement_on_russia_-270618_en. pdf>accessed19August2020;KarinaBarbesino,‘Treatmentand EvolutionofDigitalRights:AComparativeAnalysisofChina, Rus-sia,theUnitedStates,andGermany’2019RollinsCollege:Honors ProgramTheses.97.<https://scholarship.rollins.edu/honors/97>

accessed 16 July 2020; Hao Yeli, ‘A Three-Perspective The-ory of Cyber Sovereignty’ 2017 7(2) Prism, 109-115. <https: //ndupress.ndu.edu/Media/News/News-Article-View/Article/ 1983767/a-three-perspective-theory-of-cyber-sovereignty/>

(5)

protectionandfreedomofexpressionincyberspace(thatcan befoundinthe‘Yarovaya’,‘fakenews’and‘disrespect’laws). Apparently,theRussianvision ofappropriate policyand lawenforcementmethodstowardscyberspacereflect funda-mentallydifferentconceptsincomparisontothoseprevalent in the EU, particularly regarding the crucial balancing act betweentheinterests ofnationalsecurityontheonehand andprotectionofpersonaldataandfreedomofexpressionon theotherhand.ItisobviousthattheRussianpolicyexplicitly leans towardstheadoption ofasovereigntyapproach. Pre-sumably,theRussianlegislationlacksspecificandtransparent criteriadeterminingthelimitsofgovernmentalintervention into private affairs of Russian citizens and their personal data,i.e.Russianlegislationandregulationcanbesaidtolack necessity,proportionality,transparencyandfairness.16

Overall, the Russian legislation adopted in the field of personal data protectionand freedom ofexpressionin cy-berspaceisperceivedasunder-researched,similarlyto com-parativeresearch ofthatregulationand the rulesand pro-ceduresestablishedintheEU.Notmuchattentionhasbeen devotedbylegalexpertstothethreeabove-mentioned Rus-sianlegislativeactsthathavenotbeenextensivelyanalyzed. Intheirpublication,MikhailZhuravlevandTatianaBrazhnik focusedonthedataretentionrequirementsintroducedbythe ‘Yarovaya’lawbutdidnotdiscusstheothertwolawsthatare assessedinthecurrentcontribution.17_Moreover,_it_is neces-sarytoinvestigatethecomplianceofthenewRussian legisla-tiveframeworkwiththeEuropeanhumanrightsstandards.In addition,thislegislativeframeworkshouldbeheldagainstthe dataprotectionrequirementsintroducedintheGeneralData ProtectionRegulationthatnumerousorganizations process-ingpersonaldatawouldnotbeabletocomplywith.Ingeneral, thereisthusaneedtoconductdeeperresearchofthethree Russian legislativeacts and tocompare theircompatibility withtheEuropeanstandardsondataprotectionandfreedom ofexpression.Whatistheessenceoftherecentlyintroduced changesintheRussianlegislationanddotheselawsclearly define conditions allowing for the restriction of individu-als’humanrightsand freedomsunderexceptional circum-stances?Whatmaybetheimpactofthesepiecesof legisla-tiononaglobalscaleandhowcanitinfluencetheinteraction incyberspace betweencountrieswithdifferent approaches towards theprotectionofthe respectivehumanrights and freedomsandsafeguardingtheinterestsofnationalsecurity? What arepossibleproceduralsafeguards toensurethatthe

16_OHCHR,_‘Mandates_of_the_Special_Rapporteur_on_the

Promo-tionandProtectionoftheRighttoFreedomofOpinionand Ex-pression; the Special Rapporteur on the Rights to Freedom of PeacefulAssemblyandofAssociation;andtheSpecialRapporteur onFreedomofReligionorBelief,CommunicationtotheRussian Federation’(Communication,28July2016),2<https://www.ohchr. org/Documents/Issues/Opinion/Legislation/RUS_7_2016.pdf> ac-cessed 27 August 2020; UN Human Rights Council, ‘The ac-tions of the Russian Federation are jeopardising online free-doms everywhere’ Item 4 General Debate - Oral Statement, (27 June 2018) <https://rsf.org/sites/default/files/unhrc_item_4_ statement_on_russia_-270618_en.pdf>accessed19August2020.

17_Mikhail_S_Zhuravlev_and_Tatiana_A_Brazhnik,_‘Russian_Data

Re-tentionRequirements:ObligationtoStoretheContentof Commu-nications’(2018)34(3)CLSR496.

‘Yarovaya’law,the‘fakenews’lawandthe‘disrespect’laware compatiblewiththeEuropeanhumanrightsstandards?

3. The

new

Russian

legislation

and

its

complexity

3.1. The‘Yarovaya’law

Intherecentyears,Russianauthoritieshavepassedaseriesof lawsandamendmentswhichdemonstratetheir determina-tiontosignificantlyreinforcecontroloverinformationflows intheRussiansectoroftheinternet.Theseeffortsaremostly justifiedonthegroundsofcounteringterrorismand promot-ingpublicsafety.Anillustrativeexampleofsuchlegislationis theFederallawof6July2016No.374-F318_(also_known_as_the ’Yarovaya’ law19₎_introducing _amendments _into _the_Federal lawregulatingcounter-terrorismandpublicsafetymeasures. Specifically, Article 15 of this law incorporates changes in the Federallaw of27 July2006 No.149-F3 ‘Concerning in-formation, information technologies and the protection of information’,morespecificallyitsArticle10.1.Article10.1of theamendedlawNo.149-F3requiresdistributorsof informa-tion,suchasinternet andtelecomcompanies,messengers, email services, forums and other platforms that allow the exchangeinformationontheinternet,tostoreintheterritory oftheRussianFederationthefollowinginformation20_:

• Informationonthefactsofreception,transmission, deliv-eryand/orprocessingofvoiceinformation,writtentext, images, sounds, video or other electronic messages of internetusersandinformationabouttheseusersforone yearaftertheendofsuchactions;

• Text messagesof internet users,voice information, im-ages, sounds, video and other electronic messages of internet users up to six monthsfrom the end of their reception,transmission,deliveryand/orprocessing. Additionally,

• distributorsofinformationontheinternetareobligedto providetheinformationspecifiedearliertoanauthorized executiveauthority(suchastheFederalSecurityService

Adop-tionofAmendmentstotheFederalLaw“OnCountering Terror-ism” andSpecificLegislativeActsoftheRussianFederation Re-gardingtheEstablishmentofAdditionalCounter-terrorism Mea-suresandEnsuringPublicSecurity’(inRussian)(Kremlin.ru)<http: //kremlin.ru/acts/bank/41108/page/1>accessed25August2020.

19_‘In _Russia, _the _“Yarovaya _{Law” entered} _into _force’ _(in

Rus-sian)(NovayaGazeta,1July2018)<https://www.novayagazeta.ru/ news/2018/07/01/142944-v-rossii-vstupil-v-silu-zakon-yarovoy>

Adop-tionofAmendmentstotheFederalLaw“OnCountering Terror-ism” andSpecificLegislativeActsoftheRussianFederation Re-gardingtheEstablishmentofAdditionalCounter-terrorism Mea-suresandEnsuringPublicSecurity’(inRussian)(Kremlin.ru)<http: //kremlin.ru/acts/bank/41108/page/1>accessed25August2020.

(6)

(hereinafter: FSB)) that conduct operational investiga-tive activities or safeguard the security of the Russian Federationinthecasesdefinedbythefederallaws. • Distributorsof informationon theinternet network are

obliged,when using additional encryption ofelectronic messages to receive, send, deliver and/or process elec-tronicmessagesofinternetusers,andtoprovideinternet userswithadditionalencryptionofelectronicmessages, todelivertothefederalexecutiveauthorityinthefieldof security(suchasthe FSB)informationnecessary for de-codingreceived,transmitted,delivered and/orprocessed electronicmessages.

Accordingtothelaw,fornon-performanceofanyofthese obligations,theoperators(distributorsofinformation)maybe blockedinRussia.Notethatincomparisonwiththecommon Westernpracticeoflawenforcement,theRussianlawgrants the special services muchwider powers.21 _For _example,_to gain accesstotheusers’personaldata,ingeneralWestern intelligence agenciesneed toprovide a courtwarrant toa telecom or internet operator. Uponreceiving such a docu-ment,the operator isobliged independently toconvey the requiredinformationtothelawenforcementagencies. How-ever, the Russian special services operate differently.Each telecomorinternetoperatorisobligedbylawtoinstallspecial softwareandhardware,calledSORMorSystemforOperative InvestigativeActivities,whichallowstheFSBtogainaccessto users’personaldata.Inthiscase,informationisaccessedby specialserviceswithouttheknowledgeoftelecomorinternet companies. The FSB officer simply enters the command through the SORM control panel,22 _which _is _connected _to the operator’sservers. Asaresult,onlytheFSB officerand hissuperiorsseethewarrantissuedbythecourtpermitting access to information.Considering the poorrecord ofrule oflaw23 _in_Russia,24 _and_the _de _facto _subordinate_position ofcourts25_to_the_executive_authorities,_the_special_services, suchastheFSB,enjoyabsolutefreedomofactionandabsence ofoversight.Thissituationismadeevenworsebythelackof publicorparliamentarycontrolovertheworkofthespecial services.

21_Irina_Filatova,_‘How_the_Big_Brother_is_Following_Us:_Experts

Ex-plainedtheMethodsUsedbyIntelligenceServices’(inRussian) (DeutscheWelle,30October2013)<https://p.dw.com/p/1A7ij> ac-cessed21August2020.

22_Ibid.

23_Luke _Harding, _‘WikiLeaks _Cables _Condemn

Rus-sia as “Mafia State’ (The Guardian, 1 December 2010)

<https://www.theguardian.com/world/2010/dec/01/

wikileaks-cables-russia-mafia-kleptocracy> accessed 23 Au-gust2020.

24_Paul _Radu, _‘Russia: _The _Cellist _and _the _Lawyer’ ₍ OC-CPR (Organized Crime And Corruption Reporting Project), 26 April 2016) <https://www.occrp.org/en/panamapapers/ russia-the-cellist-and-the-lawyer/>accessed21August2020.

25_Mikhail _{Khodorkovsky,} _{‘Russia’s} _Courts _of _Injustice: _Why

Only Protesters Pose a Threat to Putin’s Rule’ (TIME, 14 May 2012) <http://content.time.com/time/magazine/article/ 0,9171,2113854,00.html>accessed21August2020.

3.2. The‘fakenews’and‘disrespect’laws

Furthermore,on 18 March2019PresidentPutin signedtwo additionalamendmentsto theFederalLawwhichenhance governmentalcontrolovertheRussiancyberspace.InArticle 15oftheFederalLawof27July2006№149-F326_{‘Concerning} information, information technologies and the protection ofinformation’, some changes have been incorporated.To the existing legislation, an amendment has been added stressing that distribution of unreliable socially significant informationdistributedundertheguiseofreliablemessages thatcreatesathreatofharmtolifeand healthofcitizens, property,thethreatofmassdisturbanceofpublicorderand publicsafety,orthe threatofinterferinginthe functioning orstoppingoffunctioningoflifesupportobjects,transport orsocialinfrastructure,creditorganizations,energy,industry orcommunications-isdefinedasthe offenceaccordingto the law.Thislaw isalsocalledthe ‘fakenews’ law.Online newsoutletsandusersthatspread‘fakenews’willfacefines ofupto1.5millionrubles(approximately$20.300according tothe exchangerate ofAugust2020).27 _Moreover,_it _allows Roskomnadzor(theFederalServiceforSupervisionof Com-munications,InformationTechnologyandMassMedia– the regulator)toblockmediapublicationsinthepretrialorder.

The second amendment which regulates‘disrespect’ of theauthorities(orinternetinsults)saysthatdistributionof informationintelecommunicationnetworks,includinginthe internet,informationexpressinginanindecentformthat of-fendshumandignityandpublicmorality,obviousdisrespect of society, the State, official State symbols of the Russian Federation, the Constitution of the Russian Federation or StateauthoritiespowerintheRussianFederation– setsfines ofupto100.000rubles(theequivalentofapproximately1.350 US dollars according tothe exchange rate ofAugust 2020) and200.000–300.000rubles(theequivalentofapproximately 2.700–4.050USdollarsaccordingtotheexchangerateof Au-gust2020)or15daysinjailforrepeatoffenses.28_However,_in thiscasethelawisrelevantexclusivelytothedissemination of information through informational-telecommunication networks.Printed resourcesarenotaffectedbythis legisla-tion.

Itmust bestated that the discussed amendments raise the questions regardingtheir efficacy and feasibilityand a collateraldamagewhichtheymaycausetothedevelopment of the Russian society and economy. We suppose that in

26_‘A_Law_Has_Been_Signed_Establishing_{Administrative}

Respon-sibilityforthe Disseminationof KnowinglyInaccurateSocially SignificantInformation’(inRussian)(Kremlin.ru,18March2019)

<http://kremlin.ru/acts/news/60082>accessed21August2020.

27_‘Putin _Signs _“Fake _News”, _“Internet _{Insults” Bills} _Into

Law’ (in Russian) (The Moscow Times, 18 March 2019)

< https://www.themoscowtimes.com/2019/03/18/putin-signs-fake-news-internet-insults-bills-into-law-a64850> accessed 20 August2020.

28_Varvara _Percova _and _Aleksey _Sivashenkov, _‘With _All _Due

Respect. What Will the Law on Insulting Authorities Bring to Runet?’ (in Russian) (Forbes, 18 March 2019) <https:// www.forbes.ru/obshchestvo/373297-so-vsem- uvazheniem-chem-obernetsya-dlya-runeta-zakon-ob-oskorblenii-vlasti>

(7)

the mediumandlong term,theseamendmentsmay cause more harm to public safety and Russian socio-economic developmentthanachievethegoalofsafeguardingthem.

4. Privacy

and

data

protection

concerns

of

the

‘Yarovaya’

law

4.1. CouncilofEurope

Notably,thefactofexistenceofsurveillanceregimesinitself doesnotconstituteaviolationofhumanrights,more specifi-callytherightslaiddowninArticles8and10oftheEuropean ConventionofHumanRights(hereinafter:ECHR).Theseare therightstorespectforprivateandfamilylife,homeand cor-respondenceandtofreedomofexpression.Anyinterference withthesaidrightsthatarenotberegardedasabsolutecanbe justifiedwhenitisinaccordancewiththelaw,seekstopursue certainlegitimateaimssummedupinthesecondparagraph oftheseprovisionsandisnecessaryinademocraticsociety forprotectinganyofthelistedinterests.Surveillanceregimes can beusedtoachieve the legitimateaimsofthe Member StatesoftheECHR,forinstanceinthesphereofcombating terrorismandseriouscrime.Thisconclusioncanbederived from the position taken bythe EuropeanCourt of Human Rights(hereinafter:ECtHR)inthelongawaitedandrecently issuedBigBrotherWatchdecisionfromSeptember2018.29_The Russiansystemofsurveillancethatwasunderinvestigationof theCourtwas,however,deemedtobeinviolationoftheright toprivatelifeofArticle8ECHR.IntheZakharovjudgment,the ECtHRconcludedthatthelegislationoftheRussian Federa-tionformonitoringcommunicationsofitscitizenswasnotin linewiththerequirementof‘qualityoflaw’imposedbythe Europeanhumanrightslawandtheinterferencewasnotkept towhatisnecessaryinademocraticsociety.30_It_seems_that unfortunately notmany valuable lessons havebeen drawn from this judgment by the national legislator and human rightsarefurtherinfringedbytheadoptedlegalinstruments. The decisionin the Zakharovcase was without doubta remarkableonegiventhattheapplicantcouldnotprovethe factofsurveillanceandofbeingpersonallyaffectedbyitand thattheCourtwentasfarastoexaminetherelevantRussian domesticlawsinabstracto.Although,theRussiansurveillance system,morespecificallySORM,wasconcludedbytheCourt toviolateArticle8oftheConvention,Zakharovwasnotable toeffectuatetheECtHR’sjudgementinRussia.Shortlyafter this judgment was issued, in Russia an amendment was introducedtotheFederalConstitutionalLawthatwasbased onthedecisionoftheRussianConstitutionalCourtfromJuly 2015 allowingthe country toabstain from implementation of judgments of international humanrights courts if they are considered ascontradicting the RussianConstitution.31

29_Big _Brother _Watch _and _Others _v. _the _United _Kingdom _App _no

58170/13,62322/14and24960/15(ECtHR,13September2018),para 386.

30_Zakharov_v._Russia_App_no_47143/06_(ECtHR,₄_December_2015),

paras302-305.

31_Federal_Law_of₁₄_December₂₀₁₅_on_Amendments_to_the

Fed-eralConstitutionalLaw‘OntheConstitutionalCourtofthe

Rus-This lawconfers the power to the Constitutional Court to reviewanyinternationalhumanrightsjudgmentsandinfact invalidate thembydeclaring these decisionsasimpossible toexecute.Asamatteroffact,thecourthasalreadymade useofthisreviewpower onseveraloccasions,forinstance, inrelationtotheECtHR’sjudgmentinthecaseofAnchugov andGladkovagainstRussia.32

WhilethereisanationallegislationinRussiathatallows theabove-mentionedsurveillancemeasurestobetakenfor achievingthelegitimate aimsoffightingserious crimeand terrorismandprotectingpublicsecurity,itistobestressed thattheRussiandataretentionlegislationfailstomeetthe qualityoflawrequirementreconsideredbytheECtHRinthe

Zakharovcase.33_Although_it_is_true_that_the_national author-itieshaveacertainmarginofappreciationwhentheydecide onthemeansforattainingthelegitimateaimsoutlinedabove, thismarginofappreciationissubjectedtoEuropean supervi-siondeterminingwhetherthereareguaranteesagainst pos-sibleabuse.34_This_abuse_of_power_can_be_prevented_if_a_set_of minimumrequirementsisintroducedinthelaw:‘thenature ofoffenceswhichmay giverise toaninterceptionorder; a definitionofthecategoriesofpeopleliabletohavetheir tele-phonestapped;alimitonthedurationoftelephonetapping; theproceduretobefollowedforexamining,usingandstoring thedataobtained;theprecautionstobetakenwhen commu-nicatingthedatatootherparties;andthecircumstancesin whichrecordingsmayormustbeerasedordestroyed’.35_The qualityoflawrequirementmeansthatthelawmustnotonly beaccessible to individuals who should beable toforesee howitwouldapplyinpracticebutalsoensurethatmeasures ofsecretsurveillanceareonlyusedwhenitisnecessaryina democraticsocietyandestablishsafeguardsandguarantees againstabusethatarebothadequateandeffective.36_In_the Russianlegislation,itisnotspecifiedwhatthenatureofthe offencesisthatgiverisetotheapplicationofthedata reten-tionrules.Theprocedureforexamining,storingand process-ingpersonaldataisfarfromclear,itisnotdefinedwhothe authoritiesarethatareauthorizedtogetaccesstothe infor-mationinquestionandwhichbodiessupervisetheexercise ofthesepowers.Thereshouldalsobenationalremedies pro-videdforbythelawagainsttheuseofthesaidmeasuresthat areopentoindividualssubjectedtothisformofsurveillance. The‘Yarovayalaw’cannotbesaidtomeettherequirementof qualityoflawanddoesnotmanagetolimittheinterference strictlytowhatisnecessary inademocraticsociety. Intro-ducingthedataretentionobligationsandallowingaccessof nationalauthoritiestothisdatadonotconstitutearestriction ofthehumanrighttoprivacyanddataprotectionlaiddown inArticle8ECHRandmaybesaidtoviolatethisprovision. sianFederation’(inRussian)(RG.ru,16 December2015)<https: //rg.ru/2015/12/15/ks-site-dok.html>accessed20August2020.

32_Anchugov_and_Gladkov_v._Russia_App_no_11157/04_and_15162/05

(ECtHR,4 July2013);ConstitutionalCourtoftheRussian Feder-ation16April2016<https://rg.ru/2016/05/05/sud-dok.html> ac-cessed20August2020.

33_Zakharov_v._Russia_App_no_47143/06_(ECtHR,₄_December_2015),

para231.

34_Ibid.,_para_232. 35_Ibid.,_para_231. 36_Ibid.,_para_236.

(8)

4.2. EUandDataRetentionDirective

OneshouldobservethatthenewRussianlegislationisalso clearlyatvariancewiththeEUlegalregimeonprivacyand data protection,morespecificallyrules on the retention of data.Dataretentionisassociatedwiththeprocessofstoring and holdingcommunication data for certain purposes, in-cludingthoseoflawenforcement.37 _In_the_EU,_the_Court_of JusticeoftheEuropeanUnion(hereinafter:CJEU)hastakena firmstanceagainstthedataretentionpracticesoftheUnion basedontheDirective2006/24ortheDataRetentionDirective from2006.38_Article₃_Paragraph₁_of_this_Directive_required EUMemberStatestointroduceintheirnationaljurisdiction an obligationaimedatproviders ofpublicly available elec-tronic communications services or public communications networkstoretaindataregardingtheirusersorsubscribers that are generated or processed by these providers. The retainedinformationincludedtrafficandlocation dataand other data that are necessary to identify subscribers and registered users.Thecontent ofelectroniccommunications washowevernotretained.

Byusingthestoreddata,itwaspossibletoestablishand identifyasource,destination,date,time,durationandtypeof acommunication.39_In_addition,_the_retention_of_data_allowed identification of the equipment used and the location of mobiledevices.40_In_accordance_with_Article₆_of_the_Directive, allthisdatacouldlawfullyberetainedfortheperiodof6–24 months counting from the date of the communication. In itspreliminaryrulingDigitalRightsIreland,theCJEUdeclared the Directive invalid on 8 April 2014.41 _The _Court _found that the spectrum ofdata retained by providers of public communications networksandpublicly availableelectronic communicationsserviceswassignificantlywideandallowed for drawing very preciseconclusions regarding the private lifeoftheindividualsconcerned.42_Among_other_things,_one couldlearnagreatdealabouttheirhabits,placesofresidence and social relationships.43 _Although, _the _content _of com-municationswas notretained,theretention ofdatafalling underthescopeoftheDirectivehadanimpactontheuseof the meansofcommunicationbypersonsand couldhavea negativeeffectontheexerciseoftheirfreedomofexpression

37_Ian_Lloyd,_‘Data_Retention’₍₂₀₁₈₎₃₄₍₂₎_CLSR_405,_407.

38_Directive_2006/24/EC_of_the_European _Parliament_and_of_the

Councilof15March2006ontheretentionofdatageneratedor pro-cessedinconnectionwiththeprovisionofpubliclyavailable elec-troniccommunicationsservicesorofpubliccommunications net-worksandamendingDirective2002/58/EC[2006]OJL105/54(Data RetentionDirective).

39_Article_5(1)(a),_5(1)(b),_5(1)(c)_and_5(1)(d)_Data_Retention

Direc-tive.

40_Article_5(1)(e)_and_5(1)(f)_Data_Retention_Directive.

41_Joined_Cases_C-293/12_and_C-594/12_Digital_Rights_Ireland_v. Min-ister forCommunications,MarineandNatural ResourcesandOthers

[2014]ECLI:EU:C:2014:238,para71.

42_Ibid.,_paras_26-27. 43_Ibid.,_para_27.

foundinArticle11oftheEUCharterofFundamentalRights (hereinafter:theCharter).44

Under the reach of the Data Retention Directive, the datainquestion could be collected andprocessedwithout notifyingtheconcernedusersandsubscribersmeaningthat theylivedwithaconstantfeelingofbeingsecretlysurveilled and monitored.45 _In _addition, _the _far-going _data _retention practicesrequiredbytheDirectiveseriouslyinterferedwith therightstoprivacyanddataprotectionlaiddowninArticles 7and8oftheCharter.46 _This_interference_was_not_deemed tobeinlinewiththeprincipleofproportionality,asstressed bythe Court.47 _The_Data _Retention _Directive_concerned _all persons,allpossiblemeansofcommunicationandalltraffic data and interfered with fundamental rights of almost all European citizens.48 _{Additionally,} _no _relationship _between theretaineddataandthreatstopublicsecuritywasrequired, the scope of application of the Directive was not limited, therewerenoobjectivecriteriaforestablishingthelimitsof theaccessofnationalauthoritiestothecollecteddataandits processingandnosubstantiveandproceduralconditionsfor grantingthisaccessandfurtheruse.49_Also,_the_data_could_be retainedforatleast6monthswithoutanydistinctionmade betweendifferentcategoriesofdataand thedetermination ofthisretentionperiodwasnotbasedonobjectivecriteria.50 Therewerenosafeguardsregardingsecurityandprotection of data, it did not have to be deleted after the retention periodand therewas norequirement forretaining datain theEU.51

WhiletheRussianFederationisofcoursenotanEU Mem-berStateand theEU’s legal regimedoes notimposedirect legalobligationsonRussia,itcanbearguedthatevenunder theStrasbourghumanrightsframeworktherewouldbean incompatibilityoftheRussiansurveillancesystemwiththe ECHR’sstandards.Drawinginspirationfromtheworkofthe CJEU,theECtHRhasreferredseveraltimestotheDigitalRights Irelanddecisionwhenitanalyzedsurveillancemeasurestaken insomeMemberStatesoftheCouncilofEurope(hereinafter: CoE).52_Similarly_to_the_Russian_laws,_the_invalidated_Directive hadanobjective ofcontributingtothefightagainstserious crimeand terrorismandprotectingpublicsecurity.53 _While intheEU,thedataretentionobligationwasapplicabletothe providersofpubliclyavailableelectroniccommunications ser-vicesorpubliccommunicationsnetworks,inRussiaitsscope isbroadenedtoincludeallpossibledistributorsofinformation

44_Joined_Cases_C-293/12_and_C-594/12_Digital_Rights_Ireland_v. Min-isterforCommunications,MarineandNaturalResourcesandOthers

[2014]ECLI:EU:C:2014:238,para28. 45_Ibid.,_para_37. 46_Ibid. 47_Ibid.,_para_69. 48_Ibid.,_paras_56-57. 49_Ibid.,_paras_59-61. 50_Ibid.,_paras_63-64. 51_Ibid.,_paras_66-68.

52_{Szabó and}_Vissy_v._Hongary_App_no_37138/14_(ECtHR,₁₂_January

2016);Zakharovv.Russia.47143/06(ECtHR,4December2015).

53_Joined_Cases_C-293/12_and_C-594/12_Digital_Rights_Ireland_v. Min-isterforCommunications,MarineandNaturalResourcesandOthers

(9)

includingcommunicationservicesprovidedovertheinternet, such as Skype. Another notable difference of the Russian surveillance system with the European regimes that were basedontheDirectiveisthefactthatinRussianotonly meta-databutalsothecontentofcommunicationsisbeingstored in anindiscriminate mannerand subsequently monitored, whichisanuncommonpracticeinEurope.Theauthoritiesof theRussianFederationthatgetaccesstoallcommunications ofinternetuserscancollectsignificantamountsof informa-tionregardingtheirprivatelife.Itisnotrequiredtoindicate a linkbetweenthe retained dataand the threatsposed to nationalsecurity.Metadataisstoredforaperiodof12months whilethecontentisheldforaperiodofupto6months:both typesofdatamustberetainedontheterritoryoftheRussian Federation.Thelawdoesintroducemeasuresforachieving anappropriatelevelofsecurityofcommunicationdataheld bytherespectiveentitiesandthereisnoclearlyoutlined obli-gationtodeletethisinformationaftertheretentionperiod.

The considerations made above lead to the conclusion thatthe Russianlegalframeworkisclearlynotinlinewith the Directive that was declared to be invalid and would certainlynotbecompatiblewiththeEUlegalregime.Under theCoE’shumanrightsframework,thiswouldalsobeseen asaninterferencethatisincompatiblewiththeconventional humanrightsstandards.

Atthesametime,lowefficacyandfeasibilityofthe legis-lationhavebeendemonstratedbythemostlyfailedeffortsof Roskomnadzortoenforcethe ‘Yarovaya’Law.Thisscenario playedoutinthecaseofthe‘TelegramMessengerLLP’ com-pany, whichrejected implementation ofthe ‘Yarovaya’ law (10.1No.149-F3withamendmentsaccordingtoNo.374-F3).54 Namely, Telegram rejected the requirement of the FSB to transfer keystodecryptusers’messages,becausethe com-pany considers it its duty tokeep users’correspondence55 secret.Asaresult,basedonArticle15.4 oftheFederalLaw ‘OnInformation,InformationTechnologiesandInformation Protection’,on6April2018Roskomnadzorfiledalawsuit de-mandingthataccesstotheinformationresourcesofTelegram MessengerLLPbelimited(i.e.blocked)inRussia.However,for technicalreasonstheregulator’sefforts56_to_block_Telegram have succeeded only partially,57 _while _causing _significant collateral damage. Instead of preventing the operation of Telegram, the Russian authorities blocked users’ access to unrelatedonlineservices.Atthesametime,defacto,Telegram

54_‘A _Few _Steps _from _Blocking: _Roskomnadzor _Filed _a

Law-suit against Telegram’ (in Russian) (RBC, 6 April 2018)

<https://www.rbc.ru/technology_and_media/06/04/2018/ 5ac726039a794701e9f0c01c>accessed27August2020.

55_{‘Roskomnadzor}_Gave _Telegram₁₅ _Days_to_Transfer

Encryp-tionKeystotheFSB’(inRussian)(RBC,20 March2018) <https: //www.rbc.ru/rbcfreenews/5ab0e3b99a79477cf2540d32>accessed 27August2020.

56_Nikita_Batalov,_‘Opposite_Effect:_Why_Has_the_Blocking_of

Tele-gram Failed?’ (inRussian)(DeutscheWelle,21July 2018) <https: //p.dw.com/p/31qEi>accessed26August2020.

57_‘The_Blocking_Has_Failed:_Why_Telegram_Still_Works’_(in

Rus-sian)(Gazeta.ru,15May2018)<https://www.gazeta.ru/tech/2018/ 05/15/11751535/telega.shtml>accessed26August2020.

continues tocarry out its activities onthe territoryof the RussianFederation.58

Eventually,in June 2020,the Roskomnadzor announced thatitwouldliftthebanonTelegram’soperationsinRussia. Thisistogreater extentduetotheRoskomnadzor’s failure toblockTelegraminRussia.59_Pavel_Durov,_the_founder_of_the Telegrammentionedthat:

‘In April2018,Russia’s telecomregulator Roskomnadzor blockedTelegram on the country’sterritory.Weknewit wascoming,sobythetimethe blockwentlive,wehad alreadyupgradedtheTelegramappswithsupportfor ro-tatingproxy servers,waystohidetrafficandother anti-censorshiptools.WewerejoinedbythousandsofRussian engineersthatsetuptheirownproxiesforTelegramusers, forming a decentralised movement called Digital Resis-tance.Asaresult,Telegram’suserbaseinRussiahasn’t de-creased– infact,ithasdoubledsince2018.InMay2020,out of400millionmonthlyactiveusersofTelegram,atleast30 millionwerefromRussia.Itmeansthatourgrowthin Rus-siahasbeeninlinewithourgrowthinothercountries.To putitsimply,thebandidn’twork… wehavedecidedto di-rectouranti-censorshipresourcesintootherplaceswhere Telegramisstillbannedbygovernments– placeslikeIran andChina.’60

Furthermore,theRussianauthoritiesalsodemonstrate in-abilitytoenforcethenationallawsasapplicabletothemajor WesterncompaniessuchasGoogle,61 _Facebook_or_Twitter62 (forexample)thatarerequiredtofulfillthe‘Yarovaya’law’s requirementsregardingthedatabaseslocalizationinRussia. ThisentailsthelocalizationofpersonaldataofRussianusers on the territory of the Russian Federation. Russian courts issuedanumber ofresolutionsagainstsuch companiesas mentionedaboveaccordingtothe ‘Yarovaya’law,whilethe companies were fined for being non-compliant with the Russianlegalinstruments.Upuntilnow,thecompanieshave failedtocomplywiththerulesimposedontheminRussia.

ItisobviousthattheRussianauthoritiesdemonstratean uncompromisingwill toestablish controlover information flowsinthe Russiansection ofthe internet,despite signif-icant economic and reputational costs and technological

58_Matt _Burgess, _‘This _is _Why _Russia’s _Attempts _to _Block

Telegram Have Failed’ (Wired, 28 April 2018) <https://www. wired.co.uk/article/telegram-in-russia-blocked-web-app- ban-facebook-twitter-google>accessed26August2020.

59_‘Russia _lifts _ban _on _Telegram _messaging _app _after _failing

to block it’ (Reuters, 18 June 2020) <https://www.reuters.com/ article/us-russia-telegram-ban/russia-lifts-ban-on- telegram-messaging-app-after-failing-to-block-it-idUSKBN23P2FT> ac-cessed2August2020.

60_Pavel_Durov,_‘Durov’s_Channel’₍_Telegram_,₂₂_June₂₀₂₀₎_<_https:

//t.me/durov/117>accessed26August2020.

61_‘Company_Google _Received_a _Fine _Worth _700.000_Rubles_for

Non-compliancewiththeRussianLaw’(inRussian)( Roskomnad-zor,18July2019)<https://rkn.gov.ru/news/rsoc/news68466.htm>

62_Mark _Bennetts, _‘Facebook _and _Twitter _Could _Be _Blocked

in Russia in Data Storage Row’ (The Guardian, 17 April 2019)

< https://www.theguardian.com/world/2019/apr/17/facebook-and-twitter-face-russian-sanctions-in-data-storage-row> ac-cessed26August2020.

(10)

problemsofimplementingthenewlegislation.63_According_to variousassessmentsandestimates,suchasthoseconcerning equipment and operational costs, even implementation of the‘Yarovaya’lawbythedistributorsofinformationmaycost 2–10trillionrubles64 _in_the_coming_years_(27–135_billion_US dollarsaccordingtotheexchangerateofAugust2020).

Moreover,thesaidlegislationcreatesthepossibilityforthe Russianspecialservicestohavealmostunrestrictedaccessto asignificantportionofprivateandcommercialinformation whichcirculatesintheRussiansegmentofcyberspace. Con-sideringtheopacity65_and_corruption66_of_the_Russian govern-mentalstructures,67 _including_the_security_services,68 _many of those who operate in Russian cyberspace should worry about how thecollected informationwillbe used.Another issue isthe safetyofthe collected andstored information. Willtelecomandinternetcompaniesbeabletoprovidethe necessary level of data security and prevent the theft of valuableinformationbyhackersorothermaliciousactors?

For example,inthe endofthe 2018,forasmall sumof money a journalist bought69 _from _a _Russian _official infor-mationfromaclassifiedRussiandatabaseregardingthereal identitiesofthetwoRussianGRUofficerswhopoisonedthe Skripals inSalisburyUK.70 _Thus,_it _can_be_assumed _that_if theRussianauthoritiesareunabletokeepsecretly informa-tion abouttheirintelligenceofficers,the mentionedkindof collectedinformationisalsonotstoredsecurelyandcanin theorybeobtainedbyothers.

ActingaccordingtotheRussianlaws,allentitiesthatcan bequalifiedas‘distributorsofinformation’willfailtomeet

Re-tentionRequirements:ObligationtoStoretheContentof Commu-nications’(2018)34(3)CLSR496,497

64_{‘Rostec” Calculated} _the _Cost _of _Equipment _for

Implement-ingthe“YarovayaLaw’(inRussian)(Lenta.ru,5September2016)

<https://lenta.ru/news/2016/09/05/rostech/>accessed26August 2020.

65_‘Putin_and_the_Proxies’₍_OCCRP_,₂₄_October₂₀₁₇₎_<_https://www.

occrp.org/en/putinandtheproxies/#infographic>accessed26 Au-gust2020.

66_Transparency _{International,} _{‘Corruption} _Perceptions _Index

2017’(Survey,21February2018)<https://www.transparency.org/ news/feature/corruption_perceptions_index_2017> accessed 26 August2020.

67_‘Putin’s _Bodyguards _Rewarded _with _Land _and _Power’

(OCCRP, 19 November 2018) < https://www.occrp.org/en/28- ccwatch/cc-watch-indepth/8922-putin-s-bodyguards-rewarded-with-land-and-power>accessed25August2020.

68_Roman_Anin,_‘Palaces_under_Guard’_(in_Russian)₍_Novaya_Gazeta_,

19November2018)<https://www.novayagazeta.ru/articles/2018/ 11/19/78623-dvortsy-pod-ohranoy>accessed26August2020;Pol Rodin, ‘Corruption inthe Central Apparatus ofthe FSB ofthe RussianFederation.WhatWasIt?’(inRussian),(Regnum,19July 2017) <https://regnum.ru/news/2302756.html>accessed 26 Au-gust2020.

69_‘The_Insider_Learned_the_Real_Name_of_the_GRU_Colonel,

Act-ingUndertheNameofRuslanBoshirov’(inRussian)(NEWSru.com,

26September2018)<https://www.newsru.com/russia/26sep2018/ boshirovchepiga.html>accessed27August2020.

70_{‘Solberetsky,}_Part_Three._{“Boshirov” Turned}_Out_to_Be_“the_Hero

ofRussia”,GRUColonelAnatolyChepiga’(inRussian)(TheInsider, 26September2018)<https://theins.ru/politika/118927>accessed 27August2020.

therequirementsfordataretentionpracticesclarifiedbythe CJEUandtheECtHR.Asstatedabove,theamendedlawisnot uptothequalitystandardthatalegalmeasureconstituting aninterferencewiththeright toprivacyexArticle8ECHR issupposedtosatisfy.Thisstandardcannotbemetwithout adequatesafeguardsand guaranteesagainstpossibleabuse ofthepowersoftheauthoritiesthataccesscommunications ofRussianusers.Thelawinquestiondoesnotconstitutea necessarymeasurethatmustbetakeninademocraticsociety inordertoachievethelegitimateaimsofprotectingthe inter-estsofnationalsecurityand,incontrasttotheEU,inRussia the balance between the protection of human rights and nationalsecurityinterestsseemstobeshiftedtothelatter.71 4.3. EUandGeneralDataProtectionRegulation

Inthemodern globalizedworld,corporations offerservices over the worldwide web reachingtheir customers located farbeyondthenationalterritorialboundaries.Manyofsuch companies have an establishment in the EU and have to comply– amongotherthings– withtherequirementssetby theGeneral Data ProtectionRegulation.If thesecompanies acting as data controllers and determining the purposes andmeans oftheprocessingofpersonaldataor operating asdataprocessorsandhandling personaldataonbehalfof controllersdealwithpersonalinformationrelatingtoRussian users,theywillhavetoactinaccordance withtheRussian amendedlawNo.149-F3.Essentially,theywould beobliged toestablish databases containing personaldata ofRussian nationals on the territory of the Russian Federation and disregardtheirGDPRobligationsinrelationtoRussianand EUusers,forinstance,thoserelatingtotheexerciseofcertain datasubjects’rights,suchastherighttobeforgotten.72

Thewordingofthenewlegislativeactimpliestheinability of data controllers to comply with their data protection obligationsunderthe GDPR.HowcanEU datasubjects,for instance,makeuseoftheessentialrighttobeforgottenifthe companiesareobligedtostoretheirpersonaldatainRussia andarenotallowedtodeleteit?Thiswouldbecomea prob-lematicissuethatneedstobedealtwith.Similarly,Russian companies,whichareinvolvedintheprocessingofpersonal dataof personslocated inthe EU,willhave touse double standardsforthetwogroupsofusers:individualsfromtheEU andRussia.Insteadoffollowingthepracticeofsafeguarding humanrightsand fundamental freedoms promotedbythe EU,suchcorporationsestablishedinRussiawillbeobligedto grantGDPRrightstopersonsthatareintheUnionandtreat RussiannationalsdifferentlyinaccordancewiththeRussian domestic legislation. Finally, the obligation of cooperating withtheRussianauthoritiesondecryptingcommunications of internet users may lead the introduction of backdoors in the platforms of information distributors allowing gov-ernmental agencies to access these communications. This couldentailnotonlyviolationofGDPRrightsofdatasubjects butalsomoregenerallytheirrightstoprivacyand freedom

Re-tentionRequirements:ObligationtoStoretheContentof Commu-nications’(2018)34(3)CLSR496,506.

(11)

of expression.The Russian specialservices will be able to accessawidespectrumofinformationregardingnaturaland legalpersons,includingsensitivepersonaldataandfinancial information,andprocess itfortheirownpurposeswithout having obtained consent from the persons concerned or havinganotherlegalgroundforsuchprocessing.Inaddition, thispracticecouldcreateapossibilityforvariousthird par-tiestoexploitbackdoorsandotherintentionallyintroduced vulnerabilities and get unauthorized access tostored data meaning thatinternet users would notbe ableto securely engage incommunications online, as indicated bythe UN Special Rapporteurs.73 _This _is _something _Western _internet users, businesses and respective governments should be awareofandconsiderintheirdatasharingpractices.

Finally,oneshouldnotethatthereareadequacydecisions takenbytheEuropeanCommissiononthebasisofArticle45 GDPRwithregardtoanumberofthirdcountriesallowing per-sonaldatatobesharedwiththosecountrieswithoutany addi-tionalrequirementstobemet.Whilethereareadequacy deci-sionsforIsrael,theUnitedStatesofAmerica,Japanandafew othercountries,Russiacannotbefoundinthislist.74_After_the adoptionofthe‘Yarovaya’lawamendments,naturalandlegal personsestablishedintheEUthattransferpersonaldatato Russiashouldnowbemorecarefulwithprocessingthisdata insuchamanner.If thisinformationfallsunderthescope ofthe newRussian legislationobligingtheirdistributors to store,processandshareitwiththeauthorities,thiswillmake compliancewithdataprotectionobligationsofthosepersons andentitieshandlingpersonaldataimpossibleandprobably infringerightsandfreedomsofconcerneddatasubjects.

5. Freedom

of

expression

and

other

complications

of

the

‘fake

news’

and

‘disrespect’

laws

The‘fake news’ and‘disrespect’ (‘internet insults’) amend-mentsshouldbesaidtoberatherdirectedattheprevention of criticism towards the Russian government than at the protection of public order and public well-being. These amendmentscanbeusedtointimidatethedissentand sup-pressthefreedomofspeechsincethe‘fakenews’lawoutlaws thedisseminationofwhatthegovernmentdeemstobe‘fake news’– i.e.anyinformationundesirablebythegovernment canpotentiallybedeemedassuch.Inthesamewayjustified andfaircriticismoftheauthoritiescanbedefinedasaninsult accordingtothelaw.

73_OHCHR,_‘Mandates_of_the_Special_Rapporteur_on_the

Promo-tionandProtectionoftheRighttoFreedomofOpinionand Ex-pression; the Special Rapporteur on the Rights to Freedom of PeacefulAssemblyandofAssociation;andtheSpecialRapporteur onFreedomofReligionorBelief,CommunicationtotheRussian Federation’(Communication,28July2016),2<https://www.ohchr. org/Documents/Issues/Opinion/Legislation/RUS_7_2016.pdf> ac-cessed27August2020.

74_European _Commission, _‘Adequacy _Decisions’ _<_https:

//ec.europa.eu/info/law/law-topic/data-protection/

international-dimension-data-protection/adequacy-decisions_ en>accessed27August2020.

Duetotheirvagueness,biasoftheRussianjudicialsystem anditsdependenceontheexecutiveauthority,these amend-ments increase the risk of selective and arbitrary justice. For instance, how is onesupposed to establish that disre-spect towards authorities foundits expression inindecent formand whatisthestandardformeasuringthis indecent form? Such vague definitions used in the law could lead to erratic and arbitrary implementation and enforcement thatshouldideallybeprevented.Thisisahighlyevaluative concept,whichmakesobjectiveenforcementofthelawquite difficult. Therefore, these laws help cultivating some kind of self-censorship among the citizens because any article, postorpictureonsocialmediaplatformsorinternetmedia canbedefinedasviolatingthelaw.Thus,afearofselective andarbitraryviolencereinforcesafeelingofinsecuritythat ultimatelyleadspeopletryingtoavoidanyexpressionoftheir opinionandconsequentlyconfrontationwiththeauthorities. ThedevelopmentsinRussia clearly contradictthe prin-ciplesoftheJointDeclarationonFreedomofExpressionand ‘FakeNews’,DisinformationandPropagandaadoptedbythe UnitedNations Human RightsOffice ofthe High Commis-sioner,OSCEandseveraladditionalorganizationsinVienna on3March2017.75 _Paragraph_1(a) _of_the _General_Principles revealsthatStatesareallowedtointroducerestrictionsonthe righttofreedomofexpressiononlyinaccordance withthe testusedforimposingsuchrestrictionsunderinternational law.Theymustbeintroducedinanationallaw,seektoachieve oneormorelegitimateintereststhatmaybepursuedunder internationallawandneedtobenecessaryandproportionate intheprotectionofthoseinterests.Furthermore,Paragraph 1(b)specifies thatrestrictionsofthefreedom ofexpression mayalsobeusedtoprohibitadvocacyofhatred,which con-stitutesincitementtoviolence,discriminationorhostilityin linewithArticle20(2)oftheInternationalCovenantonCivil andPoliticalRights.

Moreover,theuseofthelawon‘fakenews’willincrease pressureonthosemediaoutlets76_that_have_remained inde-pendentandimpartialandaretryingtoparticipateinsome competitionwiththemajorpro-Kremlinmassmediainthe field ofdistributionofinformation.Thesestillindependent massmediaoutletsaremostlysmallones,suchasdifferent onlinemediaandTelegramchannels.Also,inthisregard,the policyoftheRussiangovernmentcontradictstheprinciples oftheJointDeclaration,morespecificallyitsParagraphs3(a) and3(b).ThesestressthatStatesareunderapositive obliga-tiontoensurepromotionof‘afree,independentanddiverse communications environment, including media diversity’ andarerequiredtocreate‘aclearregulatoryframeworkfor broadcasterswhichisoverseenbyabodywhichisprotected againstpoliticalandcommercialinterferenceorpressureand whichpromotesafree,independentanddiversebroadcasting

75_OSCE,_Joint_Declaration_on_Freedom_of_Expression_and_‘Fake

News’, Disinformation and Propaganda (OSCE, 3 March 2017)

<https://www.osce.org/fom/302796>accessed27August2020.

76_These_media_outlets_basically_operate_only_in_cyberspace_(most

oftheindependentTVchannelswereeliminatedbythe authori-tiesinthe2000s).