Russia exempts airline ticketing systems from new data-localization law

Russian officials have excused online air-travel reservation systems from the country's new data-localization law, which requires companies to store user data about Russian citizens on servers located inside Russia.

According to the newspaper Kommersant, the Communications Ministry has determined that air-travel online reservation systems operate on behalf of airline companies, which the government has excluded from the requirements of the new law.

In March 2015, airlines working with global distribution systems (GDS) like Sabre, Amadeus, Apollo, Galileo, Horizon, and SITA (which enable automated transactions between third parties and booking agents, in order to provide travel-related services) warned Russian officials that certain services might be interrupted, if the data-localization law is applied to their industry. The Association of Air Transport Operators, for instance, announced that it would not be able to relocate its databases to Russia by September 1, when law takes effect.

According to Kommersant, at least one major airline says it isn't prepared to change the IT infrastructure of its GDS to accommodate Russia's new data-localization law. The newspaper's source in the industry claims it is simpler for airlines to cut off GDS service to local airlines in Russia.

Before coming to its decision, officials from the Ministry of Transportation and Roskomnadzor, the Kremlin's media watchdog agency, held a series of meetings last spring with representatives from the major airlines. Earlier this summer, Communications Minister Nikolai Nikiforov addressed a letter to the Transportation Ministry, declaring that airlines do not fall under the requirements of Russia's data-localization law, though it remained unclear what the status of ticketing global distribution systems would be.

Kommersant says Russian technology and defense industry conglomerate Rostec might oppose the decision to exempt foreign ticketing systems from the data-localization law. Rostec has already invested resources in building a Russian alternative, and the government's decision now jeopardizes that project. The company has yet to comment on the issue publicly.

Russia's data-localization law is set to take effect on September 1, 2015. Alexander Zharov, the head of Roskomnadzor, said in mid-July that officials won't begin fining or prosecuting violations of the law until the end of the year. According to Roskomnadzor, several companies have already begun relocating user data to servers in Russia. The list of these companies includes Samsung, Lenovo, Aliexpress, Ebay, PayPal, Uber, Booking.com, and others. Google, Facebook, and Apple have reportedly yet to move any user data.

According to the newspaper Vedomosti, Facebook has no immediate plans to relocate its user data to servers inside Russia. According to a source close to Roskomnadzor, Facebook says it doesn't consider the information its collects from its users to qualify as "personal data." According to another of Vedomosti's sources, Facebook says the costs of relocating data storage to Russia are prohibitively expensive. Roskomnadzor has denied these reports.