Fines are getting thicker on biometrics – Kommersant

A draft law has been submitted to the State Duma, according to which fines for illegal processing of personal data of citizens, including biometric ones, increase several times. The bill establishes the maximum sanctions for legal entities: up to 700 thousand rubles. at the first violation and up to 1.5 million rubles. when repeated. Experts believe that, first of all, fines will negatively affect small and medium-sized enterprises that have just started using biometrics collection technologies, and these measures will not solve the problem of illegal use of data at the root.

On May 4, the State Duma Committee on State Construction and Legislation introduced a bill that would toughen penalties for the illegal collection and processing of biometric personal data of citizens. Among those who submitted the document are State Duma Chairman Vyacheslav Volodin, Irina Yarovaya, Vladimir Vasiliev, Gennady Zyuganov.

The bill supplements the list of violations by placing biometric personal data in the unified biometric system (UBS) without the consent of the citizen, which was not previously in the Code of Administrative Offenses. It also provides for an increase in fines for the collection and processing of biometrics without the consent of the subject himself: this will entail a fine on officials from 100 thousand to 300 thousand rubles, on legal entities – from 300 thousand to 700 thousand rubles. at the first violation. In the event of a repeated violation, fines for officials increase to 300-500 thousand rubles, for individual entrepreneurs – up to 1 million rubles, and for legal entities – up to 1.5 million rubles.

“The purpose of the bill is to protect the biometric personal data of citizens, as well as to prevent administrative offenses,” follows from the explanatory note to the draft. The Ministry of Digital Transformation called the document “warning”, explaining that it is aimed at “preventing possible offenses with biometric data.”

The technology is widely distributed in the commercial sector. For example, the demand for biometric customer identification in fitness clubs has grown significantly, and by the beginning of 2023, more than 50% of new large fitness facilities use biometric data. Interested in the introduction of biometrics are financial and insurance organizations, industry and the telecommunications sector, development (see “Kommersant” dated March 29).

Effective June 1st accepted at the end of 2022, the law “On a unified biometric system”, which obliges companies that store customer data to transfer them to the EBS, as well as receive accreditation for information processing. For example, one of the conditions for accreditation is an authorized capital of at least 500 million rubles. The collection of biometric data without the written consent of the citizen is prohibited.

Banks and a number of large IT companies are now connected to the EBS, so the planned changes will primarily affect their work, says Natalia Nazarova, director of the Institute for the Development of Entrepreneurship and Economics.

However, there is a risk that fines will increase for other companies involved in the collection and processing of personal data, including representatives of small and medium-sized businesses, the expert adds.

According to Ms. Nazarova, the tightening of the rules “may have a negative impact on companies that are just thinking about digital transformation, and the financial situation of those who already work with personal data.”

Kirill Lyakhmanov, general counsel for the intellectual property practice at EDB law firm, agrees that the proposed increase in fines will not seriously affect the work of large biometric data operators, such as banks, since “for them the proposed fine will be small”, but for smaller companies it “looks significant”.

Meanwhile, Roskomnadzor assured that “there are no grounds for increasing the number of business inspections yet.”

Tatyana Isakova