The State Duma received projects with fines of up to 500 million rubles for data leakage

The Ministry of Digital Transformation submitted to the State Duma Committee on Information Policy, IT and Communications two bills that toughen administrative liability for the leakage of personal data and introduce criminal penalties for the theft and sale of such information. About it informs Kommersant, citing sources in the government.

The first draft law strengthens administrative liability for data leakage and introduces turnover fines for companies ranging from 5 to 500 million rubles. The company can receive the maximum fine in case of a repeated incident from the moment the law comes into force.

At a meeting of the profile committee of the State Duma on March 15, Maksut Shadayev, head of the Ministry of Digital Development, announced that a draft toughening administrative responsibility would be submitted to the State Duma in April. In the same month, the lower chamber will consider a draft that introduces criminal liability for the theft and sale of personal data, Kommersant notes, referring to the presentation to the minister’s speech.

The interlocutor in the government clarified that amendments are planned to be made to articles 272 (illegal access to information), 273 (distribution of malicious programs) and 274 of the Criminal Code of the Russian Federation (violation of the rules for operating means of storing, processing or transmitting information). In December 2022, a RIA Novosti source in the Ministry of Digital Development reported that the punishment was designed for individuals. At that time, it was proposed to establish it in the amount of 300,000 to 2 million rubles, and a punishment of up to 10 years in prison was also considered.

The draft law on turnover fines for the leakage of personal data has been discussed since the spring of 2022. In December last year, Shadayev informedthat the Ministry of Digital Development has prepared a draft law on turnover fines for the leakage of personal data up to 3% of the organization’s turnover.

According to the amendments to the law “On Personal Data”, which came into force on September 1, 2022, in the event of a data leak, the operator is obliged to notify Roskomnadzor within 24 hours, and within 72 hours to provide the department with the results of an internal investigation indicating the reason and those responsible. persons. Currently, the maximum fine for a business for a data breach is RUB 500,000. (Article 13.11 of the Code of Administrative Offenses of the Russian Federation).