Responsibility is loaded into personal data – Newspaper Kommersant No. 45 (7490) of 03/17/2023

Two draft laws of the Ministry of Digital Development, which have been developed since the beginning of 2022, have been submitted to the relevant committee of the State Duma: on strengthening the administrative responsibility of companies for leaks of personal data and introducing criminal liability for the theft and sale of such information. The discussed norms will lead to an increase in prices for the services of telecom operators, online services and other companies whose work is related to data processing, experts say. The introduction of criminal liability, market participants say, may provoke an increase in prices, including for insider information that is distributed on the darknet.

The Ministry of Digital Transformation submitted two bills to the State Duma Committee on Information Policy, IT and Communications that tighten the procedure for working with personal data of Russians, interlocutors in the government told Kommersant. The first document introduces turnover penalties for companies that have leaked information. The second amends the Criminal Code of the Russian Federation and applies to citizens who have committed unlawful acts using personal data: theft, sale, as well as the creation of shadow forums where personal data of citizens are illegally distributed.

The fact that the bill on strengthening administrative responsibility for data leaks should be submitted to the State Duma in April was announced by the head of the Ministry of Digital Development Maksut Shadayev on March 15: “.

The document stipulates liability for database leaks, a fixed fine for a primary incident and a turnover fine for a repeated one, mitigating and aggravating circumstances, the ministry said. The bill should provide for a turnover fine for companies in the amount of 5–500 million rubles, while the company will receive the maximum fine if it has leaked data again since the law came into force (see Kommersant dated December 26, 2022).

In April, the State Duma will also consider a bill on “criminal liability for the theft of personal data and the creation of websites and other channels for their distribution,” follows from the presentation to the minister’s speech. According to Kommersant’s interlocutor in the government, we are talking about amending articles 272, 273 and 274 of the Criminal Code of the Russian Federation, which relate to illegal access to computer information, the spread of malicious programs and violations of the rules for operating means of storing, processing or transmitting computer information.

As RIA Novosti reported in December, the punishment will be calculated for individuals and is currently provided for in the amount of 300 thousand rubles. up to 2 million rubles, also considered punishment in the form of imprisonment, depending on the severity of the crime, up to six years, under aggravating circumstances – up to ten years.

It is necessary to share responsibility for the fact of the leak and the fact of the sale of stolen data, emphasizes Ashot Hovhannisyan, founder of the data leakage intelligence and darknet monitoring service DLBI: “Criminal liability is unlikely to affect merchants on the darknet – shadow forums ensure the anonymity of all participants.” Strengthening criminal liability for the theft of data will affect the actions of insiders, who basically “get caught in the networks of law enforcement agencies,” the expert believes. “After the appearance of the first sentences under the new norm, the cost of insider data will certainly increase,” Mr. Hovhannisyan explains.

The introduction of turnover fines will require large personal data operators (882,000 such structures are currently registered in the Roskomnadzor register) not only to modernize the infrastructure and processing processes, but also to increase the budget to pay possible fines, says the chief legal adviser of the intellectual property practice of the EBR law firm » Kirill Lyakhmanov: «That is, we can expect an increase in prices for the services of telecom operators and, potentially, changes in the rates of financial institutions. Changes in the economic model may also affect classifiers and other online projects focused on working with data.”

Tatiana Isakova, Nikita Korolev