Compensation is not included in fines

The State Duma on Tuesday adopted in the first reading two bills on strengthening administrative and criminal liability for leaking personal data. These amendments were the subject of a lively discussion even at the preparation stage, but parliamentarians did not have any serious complaints about them, although many questions arose – for example, whether the law could also provide for compensation for injured citizens. In response, the authors promised to study all options and “polish” the projects for the second reading.

Bills tightening the procedure for working with personal data of Russians were prepared by a group of senators and deputies led by the head of the Duma Committee on Information Policy, Alexander Khinshtein (United Russia). The first introduces amendments to the Code of Administrative Offenses and establishes fines for the leakage of personal data, the second introduces criminal liability for the illegal storage and distribution of personal data.

The package of bills was introduced on December 4, 2023, and since then alone, Roskomnadzor has recorded 18 cases of leakage of personal data containing over 517 million records about Russians, Mr. Khinshtein said, presenting the initiative (for more information about the claims of ordinary Russians to such leaks, see. page 10). In total, last year there were 168 leaks, but the total amount of fines collected from the perpetrators amounted to only 5 million rubles, and this, according to the deputy, proves the absence of real mechanisms to combat this evil. Only the ruble can today force businesses to invest in information security, the co-author of the bills argued, so the proposed sanctions are “quite serious” (the amount of turnover fines can reach 0.5 billion rubles). Criminal liability is introduced for the theft and processing of stolen personal data (up to ten years in prison).

At the same time, Alexander Khinshtein admitted, deputies receive appeals from business associations and industry structures that complain about the excessive, in their opinion, harshness of the measures being introduced. But it is impossible to fight evil any other way, he assured. First Deputy Chairman of the Committee on Legislation Irina Pankina (ER) supported her colleague and called on those present to approve the bills, given their high social significance.

Apparently, the deputies took this factor into account, so they practically did not enter into the discussion, but they literally bombarded the speaker with questions. With the help of artificial intelligence technologies, fraudsters are now able to fake a voice and even an image, noted Oleg Smolin (Communist Party of the Russian Federation) and asked whether it is possible to introduce liability for their use by the second reading. The problem of so-called deepfakes is really acute, Mr. Khinshtein confirmed: work in this direction is already underway, but amendments will be made to the basic law on personal data.

Multimillion-dollar fines could be ruinous for a business, and besides, the money will be received by the state, not the victims, Anna Skroznikova (“New People”) was perplexed. The maximum fine is set at 3% of turnover, and millions will be paid by those with the appropriate turnover – they will not go bankrupt, Deputy Khinshtein assured his colleague. And he immediately added that the topic “the state will benefit” is primarily lobbied by business. The authors of the bill are not against providing for a mechanism of liability, including through compensation for damage, but from a technical point of view this is extremely difficult: we are talking about millions of records, and damage is extremely difficult to calculate. “But the main thesis of our bill is that people are more important than business,” assured Alexander Khinshtein.

Communist Alexei Kurinny was interested in whether a data leak that occurred during the collection of signatures in support of some initiative would be punished. He stated that in the Ulyanovsk region, during one of the election campaigns when issuing pensions, they campaigned for a certain party and at the same time offered to fill out a form to vote at home. When signatures are collected, consent to provide personal data is required, explained Deputy Khinshtein. But if the collected database is sold by the administrator to someone, then liability will arise to the fullest extent of the law. As for the case in the Ulyanovsk region, it is strange to hear such things about what is happening in the region, which is led by a communist governor, the United Russia member added.

Is there any responsibility for officials, Alexander Demin (“New People”) asked, in turn: on the Internet you can find data from the Federal Tax Service database or about traffic police fines. These are old leaks, there haven’t been any new ones for a long time, Mr. Khinshtein reassured his colleague. According to him, liability for negligence is still provided for officials, and turnover fines, of course, will not apply to government agencies.

Alexander Aksenenko (SRZP) was haunted by the question of compensation for damage to victims. Such a mechanism could prove to be an effective preventive measure, the deputy insisted. But at the same time, it is necessary that the payment of compensation be clearly administered, retorted Alexander Khinshtein. Businesses, he said, are generally inclined not to pay compensation, preferring, for example, to give affected consumers a discount, although this is by no means equivalent to compensation.

During speeches from factions, LDPR vice-speaker Boris Chernyshov said that his party itself had raised the issue of tightening liability for personal data leaks, and therefore would unconditionally support the initiative. Deputy Chairman of the Committee on Legislation Yuri Sinelshchikov (Communist Party of the Russian Federation) agreed that the problem needs to be solved, so his faction will support changes to the Administrative Code, but there are still many questions about the amendments to the Criminal Code. In response, Alexander Khinshtein assured that the authors of the bills will still “polish” them for the second reading and will definitely take into account all sound proposals. As a result, 397 deputies voted for amendments to the Code of Administrative Offenses, and 353 voted for amendments to the Criminal Code (in both cases, with one abstention). There were no votes against.

Anastasia Kornya