Just over a year ago, on December 31, 2014, Russian President Vladimir Putin signed into law new personal data localization requirements, mandating that data operators collecting personal data about Russian citizens “record, systematize, accumulate, store, amend, update and retrieve” data using databases physically located in Russia. Among other things, passage of the new law generated immediate concerns regarding its scope, implementation, and implications. On August 3, 2015, less than a month before the new law was to take effect, the Russian Ministry of Communications and Mass Media published official “guidelines”, largely in the form of FAQs, in an attempt to “clarify” the law and address some of the questions and concerns it generated. http://www.minsvyaz.ru/ru/personaldata/ (in Russian). Nevertheless, one question that has remained unanswered since the law has gone into effect (September 1, 2015) is whether the law introduces trade restrictions that violate World Trade Organization regulations. Russia has been a WTO member since August 2012.
The short answer is that WTO regulations do not explicitly prohibit data localization laws. That said, there is an emerging body of scholarship – undertaken by various “think tanks”, governmental agencies, academics, and other interested parties – encouraging the WTO to expand its sphere of influence on the restrictions to trade that may result from data localization laws. For example, a November 2015 Congressional Research Service report stated that
[t]he 161 members of the WTO negotiated and have maintained a basic set of multilateral rules in the form of the ‘GATS’ (implemented in 1995). However, the GATS is largely viewed as limited in scope, pre-dating significant technological developments over the past two decades, and in need of expansion if it is to be an effective instrument of trade liberalization. At present, it seems as if the efforts of the WTO members to expand on these rules have stalled, with little prospect of success at least in the foreseeable future.
In a July 2015 article on behalf of the Council on Foreign Relations, David Fidler pointed out “[i]n a 1998 declaration, WTO members agreed not to impose customs duties on electronic transactions and recognized the need to address e-commerce directly. However, the WTO’s e-commerce work program has not progressed much because WTO members disagree on various issues.” See also https://www.wto.org/english/tratop_e/ecom_e/mindec1_e.htm.
Daniel Castro and Alan McQuinn, in an article entitled Cross-Border Data Flows Enable Growth in All Industries, have argued that barriers to cross-data flows may measurably harm international trade; yet the damage is difficult to measure because the WTO does not track statistics that would enable specific calculations. See also the Congressional Research Service Report. Both of the aforementioned publications cite data localization laws as barriers to cross-data flow and, consequently, to international trade.
Castro and McQuinn suggest several action options, one being an expansion to the WTO definitions of localization barriers to trade – a difficult task because all signatory nations would have to approve the change. Another approach may be to put into place a new agreement that would require signatories to hold each other more accountable for positive data-flow practices and considering and restricting trade-distorting practices, which would include data localization laws. To that point, WTO regulation enforcement occurs through signatory nations bringing complaints against other signatory nations. To date, however, there have been no complaints raised against data localization laws by any WTO member against any other WTO member; and there are no robust regulations under which such (presently-hypothetical) complaints might survive at this time.
As recently as October 2015, the Information Technology Industry Council (“ITI”) has advocated during G20, B20, and International Chamber of Commerce meetings that “the WTO can remain and become more relevant to the business community if it can begin meaningful work on promoting digital trade and address[] forced localization measures, including data localization requirements.” It appears that the Trans-Pacific Partnership (“TPP”), agreed-to in early October 2015 – perhaps a model for ITI’s recommendations for the WTO – will directly address data localization laws. That said, Russia is not a signatory to the TPP.
In summary, Russia’s data localization law does not directly violate WTO regulations, as they are currently written, though the recent calls to action may inspire – or perhaps require – the WTO to mobilize and strengthen its stance on this topic in the not-so-distant future.