All the superpower states, such as China, the US and Russia, have recently understood that in the internet era, personal data is the new oil, the defining natural resource that makes our lifestyle rise and fall. Consequently, these states have increased their interest in the personal data of their citizens and in the use of that data in business and commerce.
24.4.2015
Personal Data is the New Oil
Related services
The US is by far the leader in the competition to collect, use and control the use of personal data, mainly thanks to large American internet and social media companies and legislation that grants extensive information rights to the state. However, China is not far behind.
Recently Russia has also taken some major steps in the field by enacting new legislative amendments restricting companies’ use of Russian citizens’ data.
Restrictions to Processing Data of Russian Citizens Abroad
In Russia, a set of new legislative amendments will come into force on 1 September 2015. The amendments are primarily aimed at restricting the processing of Russian citizens’ personal data on servers located outside of Russia. They also develop state supervision procedures and empower the Russian Data Protection Authority (Roscomnadzor), under certain conditions, to block access to websites where personal data violations take place.
From the perspective of data operators, it will be illegal to collect personal data of Russian citizens and directly send it to servers located outside of Russia without processing the data ‘with the use of’ a database installed on a Russia-based server or computer.
However, the amendments contain several exceptions. One of them could be interpreted as being applicable to Russian employees of international companies. The obligation to process data in Russian databases may not be applicable if personal data is processed either for purposes stipulated by an international agreement of the Russian Federation, for purposes set out in law or for exercising the powers or performing the functions and obligations of data operators under Russian law. The purposes for which employers process the data of their employees are in fact defined by law and, thus, may fall into the second category.
Websites Containing Illegally Processed Personal Data May Be Shut Down
Under the amendments, Roscomnadzor will be given powers to block access to websites containing illegally processed personal data in Russian territory. For this purpose, Roscomnadzor will enter the banned domain names, network addresses and other details in a special state register.
A website can be blocked only on the grounds of a court act. The website owner will be informed of the violation of personal data laws and asked to rectify the violation voluntarily prior to the website being blocked. If the violation is not rectified, the website will be blocked not later than in three days.
The website owner will have the right to apply for the removal of its website from the state register after all personal data violations have been rectified or if a court reverses the act blocking of the website. These rules can be construed as being applicable only to websites containing illegally processed personal data, including social networks, public databases, address books and blogs. On the other hand, Roscomnadzor may interpret the new rules broadly and try to apply them to all websites used in any way that violates any of the Russian legal requirements concerning personal data.
Practical Solutions to Legal Challenges
How, then, should one react to these new regulations and prevent localisation politics for affecting business? From a formal point of view, it will be necessary to relocate databases containing information about Russian clients, partners and, arguably, employees to Russia. If a company ignores data privacy requirements, it may be subject to several fines for various violations.
However, the legislative changes do not apply to cross-border data transfers. This fact provides certain loopholes for reorganisation of global ICT systems used by international companies. There will be no need to completely disconnect Russian offices or websites from the corporate networks. Keeping in mind that the amendments enter into legal force in less than five months, it is a good time to start assessing possible ways of modifying the ICT systems.
The strategic importance of oil has not prevented it from being an important commodity in international trade. Similarly, increased state interest in personal data is in no way an obstacle to continuing business. The importance of personal data for commercial actors is, indeed, one of the main factors that also make it interesting for any state.
In order to not let variable legislation affect your business in Russia, it’s better to consider possible options for complying with the new amendments and start preparations now.
Latest insights
Article published 10.10.2024 – Data & Technology
New act on dual-use items entered into force in September – what companies need to know
Article published 5.9.2024 – Data & Technology
Technology acquisitions can boost companies’ growth – or cause them to fail
Article published 6.5.2024 – Employment
Outsourcing company functions – four key points for success
Article published 7.12.2023 – Data & Technology
Agreements define data sharing and re-use
Kim Parviainen & Lauri Laatunen
Topi Lusenius, Anders Forss & Kim Parviainen
Tomi Kemppainen, Kim Parviainen & Eija Warma-Lehtinen
Latest references
Lantmännen – Acquisition of Leipurin from Aspo
We advised Lantmännen ek för in its contemplated acquisition of Leipurin from Aspo Plc. Lantmännen is an agricultural cooperative and Northern Europe’s leader in agriculture, machinery, bioenergy and food products. Lantmännen is owned by 17,000 Swedish farmers and has 12,000 employees in over 20 countries. Leipurin is a leading Nordic supplier of bakery ingredients, equipment, and expert services to professional bakeries, confectioneries, and food manufacturers. The company operates across Finland, Sweden, and the Baltic countries with subsidiaries located in the aforementioned countries, providing comprehensive solutions to the baking industry. The closing of the transaction remains subject to regulatory approvals.
Case published 25.8.2025
Oomi – Expansion into mobile telecommunications
We assisted Oomi Oy in its expansion into the mobile telecommunications market with the launch of Oomi Mobiili, a new MVNO brand. Our work covered the preceding due diligence process as well as structuring and negotiating key partner agreements, laying a solid foundation for Oomi’s entry into the new market. Oomi Mobiili will operate as a virtual mobile network operator, offering customers the option to purchase a mobile subscription together with their electricity contract. The phased launch is set to begin in autumn 2025, with nationwide availability targeted for early 2026.
Case published 15.8.2025
Nevel – Acquisition of Labio’s business
We advised Nevel Oy in its acquisition of the business of Labio Oy. Lahti Aqua Oy and Salpakierto Oy sold their entire shareholdings in Labio to Nevel, expanding Nevel’s already significant biogas portfolio. The transaction will have no impact on Lahti Aqua’s water utility operations or Salpakierto’s municipal waste management responsibilities. Labio’s operations and customer relationships will continue as before. ‘This partnership is a natural next step for us as we continue investing in sustainable material efficiency and renewable energy solutions. By integrating Labio’s comprehensive offerings and expertise, we can provide customers with a strong platform for material circularity. We are also strengthening our market position as one of Finland’s leading material efficiency solution providers,’ says Ville Koikkalainen, Director of Industrial and Biogas Business at Nevel. Nevel is an energy infrastructure company offering advanced, climate-positive solutions for industry and real estate. It operates more than 130 energy production plants and manages over 40 district heating networks. Nevel’s annual turnover is EUR 150 million, and it employs 190 experts in Finland, Sweden and Estonia.
Case published 16.7.2025
Finnish Motor Insurers’ Centre – Precedent concerning patient data processing and repeal of administrative fine
The Supreme Administrative Court (SAC) issued a significant precedent (decision KHO:2025:23) in a case in which it found that the Finnish Motor Insurers’ Centre (Liikennevakuutuskeskus, LVK) processed patient data in accordance with the requirements concerning fairness, data minimisation, and privacy by design and by default when deciding on compensation claims. We represented LVK in this case in which the SAC upheld the Administrative Court’s decision to repeal the EUR 52,000 administrative fine imposed on LVK by the Sanctions Board of the Office of the Data Protection Ombudsman. The SAC also confirmed the Administrative Court’s decision, which, as far as we know, was the first of its kind in Finland, ordering the Office of the Data Protection Ombudsman to reimburse some of our client’s legal costs. The decision bears great significance for the insurance industry as a whole. The crux of the matter were LVK’s information requests under the Motor Liability Insurance Act for patient data that were essential in determining insurance or compensation claims. In certain cases, making a decision may require extensive patient data. The Office of the Data Protection Ombudsman had found that LVK had systematically made overly broad information requests infringing Articles 5 and 25 of the GDPR and that the information should have been provided in the form of separate medical opinions. The Administrative Court repealed the Data Protection Ombudsman’s decision and found that patient records from medical appointments are, as a general rule, essential in establishing causality in compensation matters. It also stated that the tasks related to the consideration of compensation matters are specifically the core tasks of the insurance company and not of the controller of patient data. Furthermore, the Administrative Court found no evidence indicating that LVK would have systematically made overly broad information requests. ‘Once again, our collaboration with C&S was seamless throughout this extensive process, and we could trust that our case was in expert hands’, says Visa Kronbäck, Chief Legal Officer of the Insurance Centre. The full decision is available on the SAC website (in Finnish): KHO:2025:23.
Case published 18.6.2025