SF approved the law on negotiable fines for companies for personal data leakage

The Federation Council on November 27 approved a bill that introduces fines for violation of a number of legal requirements in the field of personal data.

"The Code of Administrative Violations of the Russian Federation is amended to establish responsibility for offenses in the field of personal data, including biometric personal data and personal data leaks," - said during the plenary session of the Council of Federation Artem Sheikin, a member of the SF Committee on Constitutional Legislation and State Building.

According to Sheikin, negotiable fines for repeated data leaks will range from 1 to 3% of companies' annual revenue. The minimum amount of negotiable fines, as he noted, will be from 20 million to 500 million rubles.

The law also introduces fines of up to Br15 million for the illegal transfer of information, which includes a special category of personal data, which includes health information.

He also added that fines for officials in case of leakage of personal data will amount to Br2 million. In addition, fines for violation of the order of biometrics processing for legal entities will be up to Br2 million, while for officials - Br1 million.

Sheikin also said that criminal liability for illegal use, transfer, collection or storage of illegally obtained computer information, which contains personal data, will be introduced. As he noted, the qualified corpus delicti of such a crime will entail increased criminal liability, up to 10 years of imprisonment.

It is noted that for the creation of a site, which is knowingly intended for the illegal circulation of computer information with personal data obtained illegally, a fine of 700 thousand rubles or compulsory labor, or imprisonment for up to five years with the same fine.

Russia has toughened penalties for leaking personal data. What you need to know

On the eve of the State Duma deputies adopted an amendment to toughen administrative penalties for the leakage of personal data. It was specified that in comparison with the first reading the sanctions were specified partly in the direction of mitigation, partly in the direction of increasing responsibility. In addition, an amendment was adopted to penalize up to five years' imprisonment for the unlawful use of personal data of minors.