00;00;06;22 - 00;00;44;21
Speaker 1
This is a data privacy detective. And today we're focused on data localization with Russia. It's the middle of August 2022. War is afoot or military operation, if you like, to use President Putin's words about what's going on with Ukraine. But it's not just Russia. It's countries around the world. Many are resorting to data localization. What is that? Well, this is an effort by nations to keep data about their people, their residents corralled within the country, almost as though information is like Chad.

00;00;45;02 - 00;01;15;21
Speaker 1
And, of course, data isn't countless, but there are ways that nation states erect fences or walls around their borders to keep data about their citizens localized, corralled within the country. And that's done for a combination of reasons. There are national security reasons for that. There are social control reasons for that. And there certainly are valid reasons to try to help protect the personal data of people who live in a country.

00;01;16;21 - 00;01;47;15
Speaker 1
Well, data localization deliberately aims to splinter the Internet and to give national governments control over what their residents know and restrict their ability to share their views across borders. And yet, the purposes of protecting citizens privacy and combating digital crime are obvious, positive objectives. And it's always the balance that's at stake. And today we're going to Spyglass to Russia.

00;01;48;14 - 00;02;23;22
Speaker 1
But before doing that, let's review a few things we've covered in prior episodes of the data privacy detective country by country that we see a rise of data localization, not a decline. China has added the Great Firewall to its historic stone wall. This has caused almost all major Western technology companies to abandon the Chinese market rather than turning over their secrets and pledging allegiance to Beijing's demands as a condition of gathering and processing the data of people who live in China.

00;02;24;27 - 00;03;01;22
Speaker 1
In late July 2020, two Indonesian residents awoke to find they could no longer access some of the world's largest websites, including Yahoo! Popular games like Steam and Epic Games and even their PayPal accounts, which had been suspended overnight. Why? Well, because the Indonesian government enforced new regulations that required websites to register with the Indonesian government and to agree that they would obey any request from the Indonesian government within as little as 4 hours on demand.

00;03;02;05 - 00;03;45;17
Speaker 1
If the government objects to any content on a Web site, well, this Indonesian regulation became effective on July 20, and it requires platforms that access Indonesia to turn over to government the personal information and identities of users. Whenever the government asks. Now we see this from a democratic country of 270 million people. India and other countries have been aggressive in claiming the data generated from their residents should be considered basically nationally owned data rather than information that individuals could decide whether to share with others around the world.

00;03;46;04 - 00;04;19;13
Speaker 1
A recent draft of the Modi government's law, which many were quite certain would become law soon and would have tightened government control of information flows from India and required data about Indian residents to be stored within India. But to the surprise of many people, that law was suddenly pulled back recently for reconsideration. Why? Because of pressure from India's important IT sector that processes huge amounts of data about other countries, residents and business activity.

00;04;20;02 - 00;04;48;01
Speaker 1
And because of concerns of people about whether India should withdraw from multinational business and information flows. And so we don't know what direction India will go in. You see, it's really a question of balance. On the one hand, we want our government to take our privacy seriously, to prevent and deter digital child abuse, doxing identity theft, ransomware and other malware attacks.

00;04;48;12 - 00;05;14;09
Speaker 1
But on the other hand, we don't want our country to become the big brother of Orwell's imagination. And to the extent we believe in the flow of information globally to improve the world and to bring people's closer instead of fragmenting instead of tribal enemies. We want an Internet, not a splinter net. So what happens when there is a war going on or a military operation?

00;05;14;09 - 00;05;28;11
Speaker 1
Whatever it is, it's pretty serious and bloody right now in Ukraine. So let's look at Russia with me as my colleague Ugo Nakashima. Ugo, thanks for joining us again on our tour of data motivation.

00;05;29;04 - 00;05;30;23
Speaker 2
Thank you so much. Happy to be here.

00;05;31;19 - 00;06;04;17
Speaker 1
Now you go. You're a member of the law firm Frost Brown, Tor's Data Services team, and you focus on international and domestic data privacy issues involving international data transfers, GDPR, compliance, U.S. regulations, California and other compliance issues for both domestic clients and international. Now, a year ago, I think it was about seven years ago, this was a year after Russia moved to annex Crimea, that Russia passed a law about data localization.

00;06;04;22 - 00;06;06;28
Speaker 1
Tell us briefly about that law.

00;06;07;21 - 00;06;29;23
Speaker 2
Sure. You know, this will be a review of our episode 75, but there was a data localization law passed in 2015 and this law required data operators, essentially controllers, to store Russian citizens personal information in a database within Russia.

00;06;30;07 - 00;06;35;27
Speaker 1
So you had to have a Russian server keep it there. You couldn't just send it off to Facebook or Google.

00;06;36;01 - 00;06;47;23
Speaker 2
As far as Facebook. And Google had a server outside Russia. Yep, they can they can move it. They had to have it in a Facebook or Google subsidiary holding the data in Russia.

00;06;48;09 - 00;07;11;13
Speaker 1
Those would happen for Russia to say not just to Facebook and Google, but to any any company anywhere in the world. If you want access to the Russian market, you have to actually register a business there and you have to follow Russian law and keep our residents, Russian residents information the way we want it kept and to share with the Russian government as it as it wants it kept is at the essence of it.

00;07;12;06 - 00;07;22;15
Speaker 2
Right. So the part of registering, you know, having a local office was more to the social media companies, their separate law on that. But that would be essentially the point.

00;07;23;11 - 00;07;34;09
Speaker 1
This is what we were seeing and for a number of years before the most recent Ukrainian situation in the year 2022, we saw fines. Pretty modest, weren't they?

00;07;34;19 - 00;07;41;19
Speaker 2
Yeah, we've seen fines of, you know, 1 million rubles, which was around $30,000.

00;07;42;07 - 00;08;08;12
Speaker 1
It goes up and down. It's about six or eight rubles to a dollar. And we saw Russian courts fining us and other companies, companies including Google and Twitch, a video streaming service, Pinterest, Airbnb, United Parcel Service, this sort of thing. That's what we saw. But did you see an extraordinary uproar from these companies that, oh, we better leave Russia?

00;08;08;13 - 00;08;10;12
Speaker 1
I don't think so. But what did you see?

00;08;11;00 - 00;08;37;13
Speaker 2
Right. So in the past episode, we talked about LinkedIn and LinkedIn basically decided to leave and other companies have state. Right. So as you mentioned, you know, recently it's WhatsApp. You know, Snapchat, there's also been Match Group and Spotify that's been fined. So you're seeing a little bit of a shift of the companies that are getting fined or, you know, that are said to not have followed the rules.

00;08;37;13 - 00;08;59;06
Speaker 2
Right. Originally, it was the bigger Google companies. Now you're seeing companies, specifically WhatsApp and Snapchat in matches. It's a community. It's a social media network company, Spotify, you know, a little bit different music company. But there is that aspect of you can still communicate. So there there is a shift of the companies that are getting fines.

00;09;00;14 - 00;09;23;08
Speaker 1
Okay. And then February, March 2022, you have the Russian invasion. We will get into those details. But everybody on the podcast knows what's going on there in a general way. And I hope that a lot of people in Russia tune into this and get some information about it. We'll call it a military operation for those, you know, to make sure we don't run afoul of what President Putin would call.

00;09;23;15 - 00;09;30;09
Speaker 1
But regardless of that, now we've seen some extraordinary news, haven't we? What happened to Google recently?

00;09;30;15 - 00;09;37;17
Speaker 2
Google's Russian subsidiaries account was seized by, I think, the courts or the government that there.

00;09;37;17 - 00;09;51;29
Speaker 1
Seized the bank of Google's Russian subsidiary that was Google had signed up. Okay, we've got a Russian subsidiary. We'll keep your information and Russia will do what the law requires in Google's might and break their bank account. Get seized.

00;09;53;00 - 00;09;53;08
Speaker 2
Right.

00;09;54;03 - 00;10;06;10
Speaker 1
Well, that's pretty serious. That and what else have we been seeing in the last six months? An uptick in other US companies becoming targets rates.

00;10;06;23 - 00;10;30;10
Speaker 2
So there's been more companies. As we mentioned, the latest was a group of US tech companies from WhatsApp, which is owned by Facebook, Snapchat, also US company Match, Spotify basically being being sued by the regulator on this data localization law. That's correct.

00;10;30;24 - 00;10;45;12
Speaker 1
And it's not just for fine. I assume the whole point of that fine is wait a minute, you can't registering you aren't sharing information, you aren't doing things the law requires. So what how were these U.S. companies respond? Not one by one, but what is what do you see?

00;10;45;26 - 00;10;52;16
Speaker 2
So what we're seeing is more companies just simply closing down in or suspending operations in Russia.

00;10;52;27 - 00;10;55;22
Speaker 1
And some are staying or have stayed.

00;10;56;01 - 00;11;20;24
Speaker 2
So I would say, you know, these companies have been fine, but we have seen as we talked in the last episode, there are companies like IBM who are following the rules. So it's not there. There's no clear all U.S. companies are leaving. It's much more of a fine line where certain companies decide to stay. Certain companies have already complied and other companies say we're not complying.

00;11;21;10 - 00;11;34;10
Speaker 1
Not comply. And now we get into the crystal ball. What do we expect in the future? Understand something is happening in regard to Apple. What what do we know right now?

00;11;35;12 - 00;11;57;13
Speaker 2
So it's not clear, but there's been announcements by the regulator that it would open up an investigation and against Apple. And again, Apple, a big U.S. tech company, you know, there's no confirmation that, you know how deep the investigation will be or, you know, what kind of fines are they going to seize accounts? We don't know the details, but there's there's been discussions about that.

00;11;59;05 - 00;12;24;28
Speaker 1
Right. And, of course, from the Russian government's point of view, it's saying, wait a minute, in Europe, the United States imposes enormous sanctions. It's our banking systems. So on. But we're not taking a position in this podcast who's right or wrong? We just think this is the economic combat going on between the two countries. Maybe we should see this in part as a reaction to that.

00;12;25;00 - 00;12;44;01
Speaker 1
In your view? For the whole point of our focus on data localization, I mean, is the Internet going to turn into what we used to call trade blocks? Maybe we still do in the customs area. Is this what's happening to information? What are your thoughts?

00;12;45;06 - 00;12;58;16
Speaker 2
So a trade blocks is again, you know it's it's more complicated in that because you know data is easier to flow between it's not like physical items. It flows much easier across borders.

00;12;58;19 - 00;13;03;23
Speaker 1
You didn't like my cattle example data is not my cows. Okay, I buy.

00;13;04;03 - 00;13;32;11
Speaker 2
Right. And one of the things that I think we're seeing is, again, you know, from the GDPR where it's like you have to have basic protection of, you know, a certain standard, but you can have the data flow across countries. There's another way of thinking, as we're seeing by certain governments in that it's data about our citizen citizens are essentially, you know, you know, it's proprietary type of way of thinking, right.

00;13;32;25 - 00;14;06;01
Speaker 2
You know, it needs to be kept within a country. We've seen that with episode I think 76 where we talked about India, where, you know, they feel that data is a source of, you know, very strong economic incentives. You know, there's one way of thinking of that. You know, another way to think about data is this political aspect of it, which is having, you know, data flow into another country, might give up certain national security issues, but again, everyone is on a spectrum of, you know, let's not let data go anywhere versus let's have a free flow of data between any countries.

00;14;06;01 - 00;14;40;12
Speaker 2
And let's, you know, let's all get the benefit of economic activity again, splintering. It may happen, but I think there are enough different schools of thought, different governments that take different positions where splintering it most likely will not happen. And I hope to have a future where there is no splintering. As you know, things settle down. But we are seeing certain countries taking a position that our citizens information's, you know, very important issue, not leave the country ever and we're just seeing the enforcement of that in Russia.

00;14;40;23 - 00;14;54;15
Speaker 2
We're not at the end of this debate about data and free flow of information or the not, you know, or the mission of that. So it's hard to tell who's right or who's wrong, but Russia is certainly taking a position that we should localize information.

00;14;54;27 - 00;15;29;26
Speaker 1
Right. No question about that. And of course, the military matter is will predominate certain for some time. But we'll see eventually what happens with with Russia, not because it's ultimately isn't just about who gets to process, what information or whether a company is allowed into a particular market. You know, it's about far more than that. It's about all of our personal information or our ability to talk to people across borders and communicate with them and for them to access us.

00;15;30;02 - 00;15;51;10
Speaker 1
So there's a lot at stake here, not just for world peace, but for or and unfortunately, at least with goods, we have the World Trade Organization, right. Crippled, perhaps, as it is. But there are rules that countries have agreed. And we don't have a world data organization last time I.

00;15;51;10 - 00;15;53;15
Speaker 2
Look and that may be an interesting thought.

00;15;54;07 - 00;16;00;21
Speaker 1
Maybe it's time when peace breaks out that we think about that. Any concluding thoughts about Russia? You know.

00;16;01;20 - 00;16;25;28
Speaker 2
Yes. So as you mention data and the flow of data definitely touches upon issues of human rights. As you know, Europe started the whole concept of GDPR from the from the position that, you know, certain data, knowing your data or having access to the correct data and having to correct data being transferred is the basis for human rights.

00;16;25;28 - 00;16;27;02
Speaker 2
So and it's.

00;16;27;04 - 00;16;29;29
Speaker 1
Individual human rights, right. Country. Right.

00;16;30;16 - 00;16;52;19
Speaker 2
Right. So there is that. Yeah, right. There's definitely aspects of that. And, and as we've went through the countries, there's, there's this school of thought that also talks about well if all the information is taken by, you know, an economic powerhouse. Right. And their companies get to process it and their governments get to see it, you know, there's an issue with that.

00;16;52;19 - 00;17;23;28
Speaker 2
And we're seeing that even with Europe. Right. We're seeing that US is not adequate because of certain, you know, laws that have to do with espionage. Right. So everything is still in flux and it hasn't been resolved. I hope from my perspective that one day that information can flow freely at the same time have the protection for every citizen to the down to the individual, and we can actually live the principles out like the GDPR is trying to push out.

00;17;24;20 - 00;17;46;28
Speaker 1
Well, we're right back to Star Wars. Let's find the balance right. May the force be with us. Special hope so. Well, I'll wind up there. And as always, and I to remind our listeners, protecting your personal data begins with you.