FOCUS: Less exposed to data storage laws Russian Web firms want clearer view

By Yekaterina Yezhova

MOSCOW, Jul 18 (PRIME) -- The impact of new Russian controversial laws on data storage looks milder for Internet companies, doomed to keep records of metadata for a year, than to telecom operators with three years. Internet giants, however, do not clearly understand the regulation, which is yet to be streamlined by the government, and analysts hope tough measures to be amended soon.

“It’s still quite difficult to predict the impact of the newly adopted laws on quotes of Internet companies because it’s unclear what decisions the government will make,” Finam financial analyst Timur Nigmatullin told PRIME.

In its current reading, the laws, signed by President Vladimir Putin on July 7, force Internet companies to store connections metadata, or information on users’ activities, for one year starting from July 20 compared to one–two months at present for their own marketing purposes, and store content for up to six months from July 1, 2018.

The country’s biggest public Internet companies Yandex and Mail.Ru Group are currently traded broadly flat taking advantage of the news on possible adjustment of the regulations during the autumn session of the State Duma, the parliament’s lower house, Nigmatullin said.

Yandex’s common shares are traded on the Moscow Exchange and American depositary receipts on the NASDAQ floor. Mail.Ru Group has global depositary receipts on the London Stock Exchange.

The market will see a well-shaped trend in the Internet companies’ shares only after the government has released subordinate acts, Nigmatullin said.

“According to my estimates, if the authorities don’t soften the laws, one-time capital expenditures of Yandex and Mail.Ru Group would amount to U.S. $1 billion–$2 billion for each, which is two–three times higher than their annual revenue. My figures are slightly less than the companies’ own estimates, which were recently reported by mass media,” he said.

Sberbank CIB “thinks telecom operators will be impacted by the law more than Internet operators given the volumes of data required to be stored and the technological limitations on downscaling this data.”

Yandex’s spokeswoman Asya Melkumova said it is difficult to assess the extent to which the requirements are realistic, or how they will help achieve its goals.

“The legislative package introduces new obligations for Internet companies: to store all correspondence between users for up to six months; and, in cases where encoding has been used, to provide law enforcement bodies with the information needed to decode the electronic correspondence,” Melkumova said.

“However, the following two points remain unclear. First, the procedure for storing users’ correspondence and in what volume the users’ correspondence must be stored. This is to be established by separate government regulations.

“Second, what the legislator means by ‘encoding’. Any information transmitted over the Internet is encoded, including with use of standard Internet protocols. For example, when a user opens an e-mail, a mail client decodes attached photographs or documents using the MIME standard. What would be legally required in such a case? What would the procedure be for supplying such data? The legislative package does not explain this.”

Yandex is certain about one thing: expenditures of Internet companies will grow. Companies will be forced to increase the number of servers and think about reorganizing internal infrastructure.

“Business is hit with new obligations and additional costs, yet in its current version the legislative package is excessive; it introduces undue restrictions on the rights of business and users alike. But in the end, will these limitations achieve the legislators’ goals? The authors of the laws speak of tougher regulation for the sake of security. Monitoring procedures should apply equal conditions to all. In the current version of the laws, either there are no equal conditions, or enforcing them will cause some players to leave Russia, which would be negative for the whole industry,” Melkumova said.

The analysts still hope the government would meet the industry half-way. “Actual expenses will depend on the terms and conditions for data storage, which the government has yet to determine. Therefore, a reduction of terms and optimization of data storage volumes is still possible,” Gazprombank said in a research note.

“Notably, domestic production of data storage facilities is insufficient to meet these legislative requirements. As a result, implementation of the law could be rolled back by several years. Problems could also arise when it comes to receiving data encryption keys from foreign Internet companies and services. In our opinion, the above legislative requirements will be eased to a reasonable extent before it takes effect in 2018 and the timeframe for its enactment will be postponed.”

Sberbank CIB expects Internet stocks to feel pressure in the interim, at least until discussions of softening amendments.

Russia has not been the first to put forward such strict measures for operators and Internet companies. Following terrorist acts in Madrid and London, the E.U. adopted the Data Retention Directive, known as 2006/24/EU.

Member states had to store citizens’ telecommunications data for at least six months and maximum of 24 months. The police and security agencies could request access to details such as IP address and the time of use of every e-mail, phone call and text message sent or received. Permission to access the information was granted only by court.

The E.U. Court of Justice declared the directive invalid in 2014, as the initiative entailed, among others, serious interference with the rights to privacy and personal data protection of individuals guaranteed by the Charter of Fundamental Rights.

End