Privacy and Personal Data Protection in Russia, Lithuania and Germany: Law, Legacy and Cyber Shift

By Monika Rogers

This article is a shortened version of the re:constitution working paper, which was originally published by the Forum Transregionale Studien in 2022 and can be read here.

The driving idea behind this paper was to study the perceptions on digital-space related privacy, control and security in three different countries / legal systems: Germany, Lithuania and Russia. The paper investigates whether the historical ideas and beliefs behind privacy laws and personal data protection are still shaping the experiences, perceptions and behaviours in the digital world in these countries, having been united by similar historical experiences. All three countries do have a legacy of their non-democratic past, defined first of all, by the state-socialist legal systems.

When one takes the historical perspective into consideration, it is obvious that Lithuania, as a part of the USSR, was put under a unified Soviet system of criminal prosecution, and the Lithuanian KGB[1] officers reported directly to Moscow. Therefore, looking from the historical perspective, the way Soviet Lithuania and Soviet Russia treated their residents in matters related to their privacy (and violation of that privacy) was more or less similar. Having said that, the case of unified Germany is different: being divided into Eastern and Western states meant also a division between a dictatorship and a democracy. It is well researched by historians today[2] that the activities of the Stasi[3], connected to personal privacy violations, intruded the Federal Republic of Germany and as such, the state-socialist heritage became a shared burden of the German population as a whole, after the reunification.[4]

However, investigating the historical definitions of the concepts of ‘privacy’ and ‘control’ is only a part of the research ideas discussed by this paper. The paper also asks the question on whether the Soviet and state-socialist perspectives on privacy rights still impact today’s national law, legal practices and the general understanding about the privacy rights issues in Russia, Germany and Lithuania. It is also important to investigate the vulnerabilities / difficulties that Eastern European societies might encounter or are already experiencing due to their communist pasts and because of their long experience of living under legal systems that rather imitated than implemented the basic democratic principles concerning the rule of law, legality and justice. Current concerns on privacy and personal data protection also provide the background for the relevance of the research, presented in this paper.

The Concept of Privacy in History and in the Law

As indicated above, Lithuania and Russia share the same historical legacy, when it comes to the law and ideology in general. These include definitions on and approaches towards the right to privacy and data security protection. First occupied and annexed by the Soviet Union in 1940, and reoccupied in 1944, Lithuania lost its sovereignty and as such the autonomy of its legal system. The whole field of criminal prosecution, constitutional and civil law was also transformed in line with the Soviet standards and eventually, they were integrated into the unified legal system of the Soviet Union.[5] As such, when talking about the Soviet period, the Soviet definition and perception on privacy are applicable for both Lithuania and Russia.  

It is important to stress that the Soviet legal system and society were more diverse and reflexive than Western interpretations of the Cold War era were attempting to depict.[6] However, the strong mechanisms of empire-building,  centralization and  lifestyle standardization[7] are also difficult to ignore. Therefore, both Soviet Russia and Soviet Lithuania followed (or, were forced to follow) the same definition and perception of privacy in Soviet law. According to Tetyana Lokot, “the notion of individual privacy has always been a political one throughout Russia’s Soviet and post-Soviet periods, connected as it was to the culture of pervasive state surveillance”, as the Soviet state was constantly attempting to gain control of both public and private lives of citizens.[8]

As Lokot claims, according to the views of the early Soviet Bolsheviks, “anything private was deprived of social meaning and thus politically dangerous”, and social duty – as a social principle, value and ideal – overruled privacy in the Soviet political and legal culture.[9] The German Democratic Republic (GDR) transferred this ideological understanding into practical implementation on another level. The extreme efficiency of the Stasi surveillance system was infamous for its technological progressiveness of equipment, for the notorious effectiveness of its secret informants (agents) and for its network of the involved individuals.[10] However, after the 1990s, the political trajectories of these countries slowly shifted from the previous Soviet/state-socialist model. While Germany started the process of unification, and Lithuania decided to apply for membership of the European Union, the Russian Federation, after a short window of democracy under president Boris Yeltsin, came back to authoritarianism.

These transformations, with no doubts, impacted perceptions about individual privacy and its protection. At the same time, all countries faced similar dilemmas concerning privacy and personal data protection, stemming from their non-democratic past. Several cases can be mentioned here,but for example, all  three countries had to decide on the destiny of huge inherited data archives of the former secret surveillance and state repressions-related authorities. Some cases were extremely sensitive in terms of personal data protection. Among the numerous Stasi documents and personal data records, there was a huge archive of information, connected to personal health information. As one of the foreign observers, Richard Sietmann, commented in the press in 1991:

“But among the old East German government’s files was one set of data that medical researchers now find themselves fighting to preserve: a huge array of epidemiological information, gathered since 1957, on more than 2 million cases of cancer – 95% of all the cases that occurred in East Germany. Researchers would dearly love to mine this lode to extract information on possible links between cancer and exposure to carcinogens, but they have hit a serious road-block. Under the Federal Data Security Act – now valid throughout Germany – the cancer register is illegal.”[11]

The mentioned case very well illustrates how the integration of the two systems, with the opposite approaches on personal data protection, created new tensions in privacy laws. Again, according to Sietmann, “the law, which reflects public fear of a return to the totalitarian past, allows medical records bearing individual names to be kept only for very specific purposes, narrowly defined in advance”.[12] Another questionthat all three countries faced in the 1990’s was whether the personal data of the former KGB or Stasi agents should be made publicly accessible.

While Germany chose a different path, the so-called law of lustration was adopted in Lithuania and a decision was made to create a state commission to which a former KGB informant could voluntarily confess his or her past activities. In exchange, the archived information about his or her involvement with the KGB would be closed for both academic researches and general public. The decision created a controversy and resulted in a big polarization of Lithuanian society that is still present. On one hand, the newly-democratic, now independent state chose to be cautious and caring about the personal data of the co-workers of the former repressive apparatus, if they decided to confess to Lithuanian authorities (interpreting this confession as  an act of loyalty). On the other hand, the victims of crimes against humanity, state violence, repressions and abuse committed by the former Soviet authorities including the KGB, interpreted the so-called ‘lustration law’ as an act of injustice. Former Lithuanian political prisoners or forcedly deported persons were claiming – and  still claim –  the right to access certain information on who was responsible for  crimes committed against them. The Soviet systems’ victims in Lithuania were comparing their situation with the situation of GDR victims. They were claiming for the similar right to get the information on their perpetrators, which in the Lithuanian case was not granted.[13]

Despite these issues, Lithuania and the former GDR transformed their legal systems on privacy laws and on data protection successfully. Today, both countries are following the European Union’s legal approach in this regard.

As for Germany, the Federal Data Protection Act of 30 June, 2017 should be mentioned.[14] According to Spindler: “Both the European DPD and the proposed GDPR, as well as the BDSG, are characterized by certain fundamental principles of data protection“, as “the objective of the directive is to protect the fundamental rights and freedoms of natural persons and, in particular, their right to privacy with respect to the processing of personal data, and to guarantee the free flow of personal data between member states.”[15] It is no surprise that in Germany, concerned with the personal data protection and privacy, this topic is common in the media and ranges within a broad array of topics: for instance, the role of tech companies in potential data protection risks[16], the options on  how to solve this problem, and proposing new, safer software ideas.[17]

In Lithuania, a Law on Legal Protection of Personal Data was adopted on 11 June, 1996. As the first article of the law claims that the purpose of the Law is to “safeguard of the inviolability of an individual’s private life in the course of processing personal data”. The law regulates “relations arising in the course of the processing of personal data by automatic means, and during the processing of personal data by other than automatic means in filing systems: lists, card indexes, files, codes, etc.”[18] It seems that the implementation of the law in Lithuania was not always a smooth process and despite having sufficient legislation, practical challenges have arisen. For instance, in 2014 the media discussed that “the National Audit Office conducted an audit in state institutions and has determined that there are flaws in the protection of personal data”[19]. The aim of this process was to check whether personal data that had been processed by algorithms was well protected. The follow-up report concluded, that “individual rights to personal privacy are insufficiently ensured in Lithuania” and that “not all legislation or personal data protection requirements are implemented in the public sector”. Also, it was stressed that “the regulation in this area is falling behind progress in information and communications technologies”[20]. Moreover, the report underlined:

“Even though the Law on Legal Protection of Personal Data and its implementing legislation was amended several times from 2008–2012, rapid progress in information and communications technologies raises new issues which are not addressed by today’s legal acts.”[21]

However, today in Lithuania and Germany,  being members of the EU – a new legal regime –the General Data Protection Regulation, or GDPR– has been implemented starting on 25 May, 2018. On its official website, the GDPR is characterized as “the toughest privacy and security law in the world”[22], and according to its official explanation, it “imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU”[23]. Finally, it is also underlined that it “will levy harsh fines against those who violate its privacy and security standards, with penalties reaching into the tens of millions of Euros.”[24]

According to the GDPR, “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”[25].

In Russia, the situation is different. First of all, one may look at the law in force. The Russian Federal Law on Personal Data (No. 152-FZ) was adopted by the State Duma on 8 July, 2006 and, approved by the Federation Council on 14 July, 2006. This law constitutes the core of Russian privacy laws. It requires protecting personal data against any unlawful or accidental access.[26] However, the practical implementation of this law seems to be limited or even problematic. As Lokot claims, in the digital era “privacy has become an even more contested concept in Russia, given the citizens’ embrace of digital technologies and the state’s preoccupation with control over data and information flows as part of the national security and sovereignty project.”[27]

Lotok agrees with other scholars, for example Greene and MacKinnon, calling  Russia’s political system today a “networked authoritarianism.”[28] The concept is understood as “a regime in which the state prioritises developing networked infrastructure and digital connectivity, while seeking to control all spheres of the datafied social life.”[29]

The very concept of privacy in Russia is rather problematic: The term ‘privacy’ itself [приватность] in Russian, is according to Lotok,  a term clearly borrowed from other languages. However, “privacy in the modern sense, including the privacy of personally identifying information, individual communications, behaviour, and digital data traces” is, according to her, “entering the mainstream legal, political, and social discourse”[30].  Russian law not only defines the citizen’s rights towards the personal data protection, but allows the state and law enforcement entities the access to user data and metadata in order to protect the national security.[31]

By measuring different approaches towards privacy and security in Russia, Germany and Lithuania, we can clearly raise the hypothesis that past legal regimes and past definitions of privacy still impact today’s societies.

Click here to read the full working paper.

---

References

[1] The KGB, the Committee for State Security (Russian: Комитет государственной безопасности, КГБ) was the main security and state surveillance agency in the Soviet Union. KGB was attached to the Council of Ministers of the USSR. It existed from 1954 to 1991. The central KGB of the USSR had branches in the other Soviet republics. KGB was successor of preceding agencies such as the Cheka, GPU, OGPU, NKGB, NKVD and MGB. See more in: Aaron Bateman, “The KGB and Its Enduring Legacy”, The Journal of Slavic Military Studies, 29/1, 2016, 23-47.

[2] See, for instance: John Christian Schmeidel, Stasi. Shield and Sword of the Party, Routledge: London and New York, 2008, 5.

[3] The Ministry for State Security (German: Ministerium für Staatssicherheit, MfS), commonly known as the Stasi, was the state security service of the German Democratic Republic. The Stasi motto was Schild und Schwert der Partei (eng. Shield and Sword of the Party), referring to the ruling Socialist Unity Party of Germany (Sozialistische Einheitspartei Deutschlands, SED). The KGB was the Soviet counterpart and close partner of the Stasi. The Stasi had headquarteres in East Berlin. One of the Stasi’s main tasks was spying on the population through a vast network of citizens-turned-informants. It arrested 250,000 people as political prisoners. See more in: The Stasi at Home and Abroad: Domestic Order and Foreign Intelligence, Bulletin of the German Historical Institute, No 52 Supplement 9, Washington DC, USA, 2014.

[4] See, for instance: Konrad Jarausch, “Between Myth and Reality: The Stasi Legacy in German History”, in: The Stasi at Home and Abroad: Domestic Order and Foreign Intelligence, Bulletin of the German Historical Institute, 52 Supplement 9, Washington DC, USA, 2014, 73-83.

[5] See more in: Monika Kareniauskaite, “The Criminal Justice System in Soviet Russia and the USSR (1917–1953): Emergence, Development and Transfer to the Lithuanian SSR”, Lithuanian Historical Studies, 20/1, 2016, 151-182. 

[6] See, for instance: Sheila Fitzpatrick, “Revisionism in Soviet History”, History and Theory, 46/4, 2007, 77–91.

[7] Mark R. Beissinger, “Soviet Empire as ‘Family Resemblance’”, Slavic Review, 65/2, 2006, 294–303.

[8] Tetyana Lokot, “Data Subjects vs. People’s Data: Competing Discourses of Privacy and Power in Modern Russia”, Media and Communication, 2020, 8/2, 315; Lokot, “Be safe or be seen? How Russian activists negotiate visibility and security in online resistance practices”, Surveillance & Society, 16/3, 2018, 332–346.

[9] Lokot, “Data Subjects vs. People’s Data: Competing Discourses of Privacy and Power in Modern Russia”, 315.

[10] Helmut Müller-Enbergs, Inoffizielle Mitarbeiter des Ministeriums für Staatssicherheit. Teil 3: Statistiken, Berlin: Christoph Links Verlag, 2008.

[11] Richard Sietmann, “East German Cancer Data: A Benefit of Big Brother? A detailed database put together by totalitarian East Germany may tempt the new Germany to relax privacy laws”, Science, New Series, 252/5008, 1991, 915, accessible online: https://www.jstor.org/stable/2875334 [last visited 30-07-2021].

[12] Ibid.

[13] Jarausch, Between Myth and Reality: The Stasi Legacy in German History, 76–81; Dėl sąmoningo liustracijos vilkinimo, XXI amžius, 84/1581, 14 November 2007, accessible online: http://www.xxiamzius.lt/numeriai/2007/11/14/nuom_02.html [last visited 30-07-2021] ; Julija Ravaitytė, “Evaluation of The Lustration Policy in Lithuania”, Politologija, 77/1, 2015, 49–100.

[14] The Federal Data Protection Act of 30 June 2017 (Federal Law Gazette I p. 2097), as last amended by Article 12 of the Act of 20 November 2019 (Federal Law Gazette I, p. 1626), accessible online:

https://www.gesetze-im-internet.de/englisch_bdsg/englisch_bdsg.html#p0012 [last visited 30-08-2021].

[15] Spindler, “Consumer Data Protection in Germany”, 91.

[16] See, for instance: “Vertrauen und Misstrauen: 20 Jahre Google Deutschland”, Donaukurier, 4 October 2021, accessible online: https://www.donaukurier.de/nachrichten/digital/netzundtechnik/Internet-Datenschutz-Geschichte-Unternehmen-Deutschland-USA-Vertrauen-und-Misstrauen-20-Jahre-Google-Deutschland;art251974,4817277 [last visited 30-08-2021].

[17] See, for instance: „TeamViewer will ‚erste datenschutzkonforme‘ Unterrichtssoftware anbieten“, 28 September 2021, Spiegel Netzwelt, accessible online: https://www.spiegel.de/netzwelt/web/teamviewer-will-erste-datenschutzkonforme-unterrichts-software-anbieten-a-87a2ed5d-c4d0-41f9-8335-02a72be19890 [last visited 03-08-2021].

[18] Republic of Lithuania Law on Legal Protection of Personal Data, 11 June 1996 No I-1374 (As last amended on 3 November 2016 – No XII-2709), accessible online: https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/ef70b5d2f14811e78f3dc265493430ae [last visited 30-08-2021].

[19] “Online Data at Risk to Hackers”, The Baltic Times, 842, January, 2014, 5.

[20] Ibid.

[21] Ibid.

[22] “What is GDPR, the EU’s new data protection law?”, GDPR.eu, Accessible online: https://gdpr.eu/what-is-gdpr/ [last visited 30-08-2021].

[23] Ibid.

[24] Ibid.

[25] The General Data Protection Regulation, Article 4-1, accessible online: https://gdpr.eu/article-4-definitions/.

[26] Federal Law of 27 July 2006 N 152-FZ on personal data, accessible online: https://pd.rkn.gov.ru/authority/p146/p164/ [last visited 30-08-2021].

[27] Lokot, “Data Subjects vs. People’s Data: Competing Discourses of Privacy and Power in Modern Russia”, 315.

[28] Ibid.

[29] Ibid, 315; S. Greene, How much can Russia really change? The durability of networked authoritarianism, Washington, DC: PONARS Eurasia, 2012; R. MacKinnon, “Liberation technology: China’s ’networked authoritarianism’”, Journal of Democracy, 22/2, 2011, 32–46.

[30] Lokot, “Data Subjects vs. People’s Data: Competing Discourses of Privacy and Power in Modern Russia”, 316.

[31] Ibid, 315-316.

---

About the Author

Monika Rogers (former Kareniauskaitė) is a Research Fellow at the Lithuanian Institute of History. Her work is on criminal law and criminal prosecution in Soviet and post-Soviet Lithuania and USSR, anti-Soviet resistance, Soviet political trials and deportations, the dissident movement, historical memory in the former Eastern Bloc and USSR. Her newest research interests include memory laws, sexual and gender-based violence, privacy law.

In 2017 she received a PhD in History from Vilnius University. She has been a Research Fellow at the University of St. Gallen in Switzerland (2013-2014), a Project Coordinator and Research Assistant at the Berlin-Hohenschönhausen Memorial (2015-2016). In 2019 she was a Postdoctoral Associate at Yale University, and in 2022 she worked at the Davis Center for Russian and Eurasian Studies at Harvard University. Monika Rogers was a 2020/21 re:constitution Fellow.

---

Citation: Monika Rogers, Privacy and Personal Data Protection in Russia, Lithuania and Germany: Law, Legacy and Cyber Shift, in: TRAFO – Blog for Transregional Research, 29.08.2023, https://trafo.hypotheses.org/48549

---

---