Business proposed an alternative mechanism for fines for personal data leakage

The business community sent a letter to Vice Speaker of the State Duma Vyacheslav Volodin, proposing to increase the turnover fine for each repeated leak of clients’ personal data. The letter was signed by representatives of Opora Russia, Business Russia, the Russian Union of Industrialists and Entrepreneurs, and the Chamber of Commerce and Industry. Its text is quoted by the state agency “RIA News”.

In July, it became known that the final version of the bill, which introduces fines for personal data leaks, was sent to the government. According to the head of the State Duma Committee on Information Policy, Alexander Khinshtein, the bill provides that the amount of the fine will be assigned depending on the scale of the leak.

“The bill does not make it possible to determine under what circumstances a particular amount of a turnover fine is applied… At the same time, we believe that the amount of the fine for a repeated violation for the leak of personal data of citizens must necessarily take into account both the quantitative indicator and the composition of the leaked personal data data,” says the document sent by businessmen to Vyacheslav Volodin.

As indicated in the letter, the bill in its current version ties the amount of the fine to a share of total annual revenue in the amount of 15 to 500 million rubles. The authors of the letter propose to calculate the turnover fine for repeated leakage differently. In their opinion, the size of the previous fine should be multiplied by the serial number of the offense.

For example, if a legal entity committed a leak for the third time, and the last fine amounted to 15 million rubles, then the new fine should be 45 million rubles. The authors of the letter want to introduce criminal liability for those who “endlessly violate” the requirements. It is also proposed to tie the amount of the fine to the company’s net profit for the calendar year, and not to the amount of all revenue for the same period. In the absence of profit, it is proposed to establish a fixed fine.

According to the authors of the letter, it is also necessary to develop support measures that would encourage companies to invest in information security, as well as develop mechanisms to mitigate liability, in which the operator can pay compensation to the victim without paying a fine.

The bill on turnover fines for companies for leaking personal data has been discussed since spring 2022. According to “Vedomosti”, its discussion is complicated by disagreements on the issue of introducing compensation for victims of leaks. In addition, the Big Data Association (BD, unites Yandex, VK, Rostelecom, MegaFon, etc.) is afraid of holding companies liable if compilations from data independently disclosed by their subjects appear in the public domain. Such compilations are already published under the guise of leaks.

According to June data Roskomnadzor, since the beginning of 2023, there have been about 75 leaks of personal data. In all of 2022, approximately 600 million personal data records were leaked.

Read more about the discussion of the bill on leaks in the material “The data went by itself”.

Anastasia Larina