On 31 July 2023, laws amending the Law on Information and the Law on Communications were published[1]. The amendments mainly concern the new duties of hosting providers, as well as the duties of owners of websites and mobile apps.
Obligations of owners of websites and mobile apps that use recommendation technologies
The new duties have been in effect as of 1 October 2023.
The obligations of persons who use recommendation technologies that collect information about user preferences (so-called “wizards”) on their resources are as follows:
- To prevent the use of technologies that violate the law;
- To inform users about the use of recommendation technologies. It is necessary to place on the information resource a document that establishes the rules for the application of such technologies;
- To place on the website contact details of the resource’s owner so that he can have legally significant messages sent to him.
If the resource owner does not eliminate violations of the new requirements in response to a notification from the regulator Roscomnadzor, the resource will be blocked.
Submission of a notification that a hosting provider’s activity is commencing
The amendment comes into force starting from 1 December 2023.
A hosting provider should notify Roscomnadzor that the provider’s activity is commencing, and Roscomnadzor will record the provider in the register of hosting providers based on the data received in the notification.
According to the draft Government Regulation[2], the notification process will be organized as follows:
- The provider will need to prepare a notification that its activity is commencing. The notification should contain the following information that allows the provider to be identified:
- the name of the organization or the name of the individual,
- information about network addresses,
- information on the location of computing facilities;
- information on the contract for an Internet connection;
- information on traffic exchange points to which the infrastructure of the hosting provider is connected;
- contact information.
- The notification will then be submitted via a personal account on Roscomnadzor’s website. The notification must be submitted no later than 10 working days before the provider’s activities start. If, at the time the Regulation enters into force, an organization is already carrying out the activities of a hosting provider, the notification to Roscomnadzor must be submitted no later than 15 December 2023.
- Roscomnadzor records data about the provider in the register of hosting providers.
Use of technical means necessary for the work of operational and investigative bodies
The amendment comes into effect from 1 December 2023.
The hosting provider is obliged to implement the requirements established in coordination with the bodies carrying out operational and investigative activities (these are the Federal Security Service and the Ministry of Internal Affairs, as well as customs authorities). According to the draft Regulation of the Government[3], not later than 45 days from the date when the activity commences, the hosting provider shall submit an application for cooperation to the relevant FSS body. No deadline is specified for persons who are already carrying out the activities of a hosting provider to apply to the FSS. Then, the authorized unit of the FSS together with the provider will determine a plan for the installation and connection of technical means that will allow the FSS bodies and other bodies to obtain access to information from the hosting provider’s system. In accordance with this plan, the provider will have to install the technical means.
Identification of persons applying for services
From 1 December 2023, the hosting provider will be entitled to provide services only to persons who have been identified in accordance with a procedure to be established by a Government Decree. Identification will be carried out based on a telephone number, Gosuslugi account or information from the Unified Biometric System.
All in all, hosting providers should notify Roscomnadzor that their activities are commencing, carry out the identification of users, and use technical means that transmit information about the provider’s clients to the Federal Security Service and the Ministry of Internal Affairs. If the statutory requirements are violated and there is a failure to eliminate the violations within the period established by Roscomnadzor, the provider will be excluded from the register of hosting providers and will not be able to provide relevant services.
[1] Federal Law No. 406-FZ dated 31.07.2023 “On Amending the Federal Law “On Information, Information Technologies and the Protection of Information” and Federal Law “On Communications”;
Federal Law No. 408-FZ dated 31.07.2023 “On Amending the Federal Law “On Information, Information Technologies and the Protection of Information”.
[2] The Draft Regulation of the Government of the Russian Federation “On Approving the Rules for the Submission by a Hosting Provider of a Notification that it is Commencing Activities involving the Provision of Computing Power for Information to be Placed in an Information System Permanently Connected to the Internet” (prepared by the Ministry of Finance of the Russian Federation on 13.09.2023).
[3] The Draft Regulation of the Government of the Russian Federation “On Approving the Rules for Hosting Providers to Interact with Authorized State Bodies Performing Operative Investigative Activities or Ensuring the Security of the Russian Federation” (prepared by the Ministry of Finance of the Russian Federation on 14.09.2023).