Business is not taken into circulation – Newspaper Kommersant No. 197 (7398) dated 10/24/2022

The Big Data Association (BDA), which unites Yandex, VK, Sberbank, Rostelecom and other IT companies, criticizes the initiative of the Ministry of Digital Development to create a financial compensation fund for citizens who have become victims of personal data database leaks. It can be financed from the turnover fines of companies that have leaked. Business believes that the fund will also require budgetary investments, and the amount of compensation will be insignificant. An alternative, according to lawyers, may be the recovery of compensation for moral damage, the amount of which will be established by the court: this encourages citizens to more actively use the institution of class actions.

“Kommersant” got acquainted with the position of the ABD on the creation in Russia of a fund for paying compensation to victims of personal data leaks, sent to the Ministry of Digital Development on October 21. Since the summer, the ministry has been discussing with business the possibility of creating a material compensation fund for citizens who have become victims of leaks in personal data bases. It should be replenished from the turnover fines of the company that allowed the incident – 1% of the annual turnover (see Kommersant of August 19).

The possible introduction of turnover fines became known in the spring, for the implementation of the mechanism it is proposed to amend the Code of Administrative Offenses. The Ministry of Digital Development proposes to impose a fine if a database with 10,000 records has entered the network, of which at least 1,000 people can be accurately identified. In cases where the database contains more than 100 thousand lines, the company’s management will be fined if 10 thousand people can be identified (see Kommersant of October 6).

The ABD believes that the creation of a compensation fund for victims of leaks is inappropriate, since “the activities of the administrative and managerial apparatus will require constant funding from the federal budget,” and the actual amounts of compensation “will be unpredictable.” The Association believes that it would be more expedient for companies to invest in audits of their information systems, rather than transfer funds to the fund.

A unified method for calculating compensation will not take into account the real degree of data protection and the guilt of the company, which “demotivates investing in cybersecurity,” follows from the position of the DBA. The ability to avoid a turnover fine in the event of a violation, on the contrary, will encourage data companies to conduct voluntary audits of security systems, said Anna Serebryanikova, president of the ADB. The Ministry of Digital Development did not answer “Kommersant”.

A specially created administrative apparatus will require constant budget funding and will strive to maximize the scope of offenses to collect fines to replenish the fund, Ozon agrees: “At the same time, compensation for victims in the event of massive leaks will be insignificant against the background of the damage caused.”

In 2022, personal data leaks in Russia have increased dramatically. According to InfoWatch, in the Russian Federation in the first half of the year 305 databases got into the network, which is 45.9% more than in the same period of 2021. The amount of stolen information increased by more than 16 times, amounting to 187.6 million records. Now the maximum fine for the leakage of personal data for organizations is limited to 100 thousand rubles.

The proposed scheme of the fund resembles the activities of accredited societies for the collective management of rights, for example, the Russian Authors’ Society (RAO), which collect money for the use of objects of copyright and related rights, and then independently distribute them among the copyright holders, says a member of the Commission for Legal Support of the Digital Economy of the Moscow Branch Russian Bar Association Vadim Perevalov. In 2021, RAO collected 3.8 billion rubles, but actually paid out only 2.5 billion rubles to the right holders, that is, approximately 65% ​​of the amount collected, while the costs of RAO itself amounted to approximately 35% of the funds raised, the expert notes.

In his opinion, an alternative could be the approach of recovering compensation for non-pecuniary damage within the range established by law, when the exact amount will be determined by the court, taking into account the circumstances of a particular case. In this case, citizens will be able to use the institution of class actions more actively and will be directly economically interested in protecting their rights as a result of leaks, Mr. Perevalov adds: “A similar mechanism for determining the size was provided for by intellectual property law and has shown high convenience and efficiency for right holders.”

Tatyana Isakova