Data localisation - in Russia email addresses are not considered personal data

Due to a recent inquiry about the interpretation of the concept of "personal data" under Russian law, the Russian authorities have stated that email addresses are not considered personal data. It means that if a company is only in possession of a person's email address and no other information relating to a person (for example a name), the company may use the email address without having to observe Russian data protection law.

The Russian understanding of personal data may seem paradoxical, as an email address will often include information that may identify the owner of the email address, for example the name of the person in question, without the email address being comprised by data protection law.

The Russian authorities' clarification of the definition of personal data indicates that a company cannot take it for granted that there is a uniform cross-border view of what is considered personal data. Under European law, an email address will be considered personal data, in contrast to the Russian understanding of the concept of personal data.

The clarification of the concept of personal data is interesting for Danish and other companies outside Russia in view of the extensive localisation requirement in Russia. Under Russian law, personal data about Russian citizens are in general to be stored in data bases that are located in Russia. Due to the Russian authorities' understanding of personal data, email addresses are not comprised by the localisation requirement if no other information is available that makes it possible directly or indirectly to identify the individual.

It means that Danish companies and other companies outside Russia can process and use Russian citizens' email addresses without having to observe Russian data protection law and, accordingly, the localisation requirement.

The Russian authorities' statement shows that it is often necessary to consult local experts to understand data protection law, as there are big differences between local regulations. Plesner has a broad network of local experts who will be able to help your company when personal data is processed around the world.

Latest news on Data Protection Law

Data Protection Law