Russian Roskomnadzor published draft order regulating implementation of law on VPN services in Russia

In accordance with Russian law on VPN services adopted in Russia, VPN services, operating in Russia, and search engines, facilitating access to VPN services, are obliged to be connected to Russian federal information system, listing informational resources and info-telecommunication networks the access in Russia has been restricted thereto.

When the person receives request under the new law, it must apply for connection to Roskomnador’s data base and provide the supervising authority with necessary information. For natural persons, citizens of Russia, required information includes name, surname, father’s name (if any), social security number and residential address. For legal entities, incorporated in Russia, required information includes full and short name, legal form, and address of presence, incorporation number and name, surname of CEO or other contact person.

For Russian individual entrepreneurs required information includes personal name, surname and father’s name (if any), residential address, individual taxpayer number and registered number for individual entrepreneur. For foreign legal entity required information includes full and short (if any) business name, the country of incorporation, registered tax number and/or ID in trade registry of country where the entity is incorporated, residential address. For foreign natural persons and persons without citizenship required information includes name, surname, middle name (if any), the type, number of ID and the country where ID has been issued, residential address.

Roskomnadzor also requires all subjects, covered by regulation, to provide postal address, email address of person who owns facilities providing services under regulation. Domain name and network address using to provide functioning of facilities are also required. Email of hosting provider is also necessary. Apart from contact and personal details, allowing to identify subjects of regulation, the draft order also requires to provide description of service provided in Russia. Logs and passwords, providing stable exploitation of facilities for the purposes of control under Russian law, are also required.

What concerns search engines. What they are obliged to provide Roskomnadzor with? In relation to information, identifying subjects of regulation, it is almost similar with information required from VPN services (e.g. Russian natural persons, legal entities incorporated in Russia and outside Russia, individual entrepreneurs, foreign natural persons and persons without citizenship). Postal and electronic addresses, domain name, network address and static network address are required to be provided. No requirement to provide logs and passwords.

Application to connect to Roskomnadzor’s data base is to be considered within 7 working days following the receiving of application. If the applicant did not provide information, required under the regulation, such applicant is to be refused to be connected. If the information, provided to Roskomnadzor by applicant, is correct and truly, the applicant receives login and password necessary for connection with Roskomnadzor’s data base. In a case of any change in information, required by regulation and provided by subjects of this regulation, the updated information must be provided within 30 days following such change.

What kind of information the subjects of regulation receive from Roskomnadzor’s data base? It is domain name and/or web-page referral and/or network address allowing identifying web-resource the access thereto has been restricted in Russia. Information also includes the details of decision, order or any other written instrument serving a reason of blocking. Information in Roskomnadzor’s data base is to be updated minimum twice a day. The information, obtained from Roskomnadzor’s data base, is not be transferred or communicated to third persons without prior written consent from Roskomnadzor.