FindFace, Lose Hope How legal is Russia's controversial new ‘friend-finding’ tool?

The online service “FindFace” is an efficient means of finding anyone registered on Russia's most popular social network, Vkontakte. It works like this: take a photograph of any passerby, and the service automatically matches the image to the publicly listed profiles of anyone on Vkontakte who has a similar face. But FindFace, whose creators describe it as a tool for meeting new people, has raised serious privacy concerns. Just last week, for example, Internet users utilized the service to deanonymize women who have appeared in pornography (finding their accounts and harassing their friends and families). And FindFace was also used to track down two young men who recently set fire to a building in St. Petersburg. Meduza asked Damir Gainutdinov, a legal analyst for the human rights group “Agora,” to explain how legal FindFace really is, and what you can do to protect yourself from it.

Damir Gainutdinov

Legal analyst

Strictly speaking, according to the laws of the Russian Federation, everything FindFace does is considered the processing of personal data. Such actions are regulated by Russia's Federal Law on Personal Data Protection. The state censor, Roskomnadzor, holds to the same position, that any information about a person is regarded as personal data. Remember when Roskomnadzor acted in defense of images of [musician] Valery Syutkin and went to court against the website Lurkmore [which published his photograph in an unflattering Internet meme]. This incident demonstrates clearly what position Russia's authorities take regarding the protection and definition of personal data.

Under Russian law, even foreign companies that process Russian citizens' personal data are required to inform Roskomnadzor about their activities. And the creator of FindFace, a company called N-Tech.Lab, doesn't appear to be Russian. [Editor's note: N-Tech.Lab is in fact a Russian company.] I checked them out on Roskomnadzor's website, but they're not listed there. I don't know how or if they're registered there, but it doesn't change anything for Internet users, in the end. It just offers Roskomnadzor grounds to fine them. 

What's important for ordinary people is that the user agreements on Vkontakte, Instagram, and Facebook mean that, once users register, they consent to all processing of their personal data and all publicly accessible images that they might at one time or another upload. For instance, Paragraph 5.8 in Vkontakte's user agreement says the website's administrators have the right to share such information with developers and third-party services and apps. 

Ultimately, FindFace doesn't differ fundamentally from image searches offered by Google, or word searches available on Yandex. 

For that reason, the only real way to protect yourself is to remember that everything you put online can become accessible to everyone. You can also turn to the law on personal data, which allows individuals to ask websites to report how exactly they manage their personal data. And you can also demand that they delete and cease processing this information. 

Otherwise, you can take the matter to court. And Article 15.5 of the Federal Law on Information allows Russians to appeal to Roskomnadzor with requests to block online services that ignore court orders. I don't know if Roskomnadzor has received such requests. (The agency doesn't seem to publish general reports.)

Adopted in 2006, Russia's Law on Personal Data fails to take into account all the new technologies now available. It is outdated, and it's hard to say how cases like FindFace can be resolved today. And clearly there will only be more and more issues like this one. Literally earlier today [April 27, 2016], there was a news story about the Chinese releasing a drone with a video camera that can identify a particular person and conduct surveillance. It costs $600 and it's tiny—it weighs just half a pound. In most countries, you don't even have to register a device like that. Such technologies open the door to serious invasions of privacy, and it's still unclear how Russia will resolve these issues.