Current changes in personal data legislation

Elvira Danilova

Associate Director
Legal

Provision

Offense

Current liability

New liability

pt. 1-1.1.  of art. 13.11. of the Code of Administrative Offences of the Russian Federation (hereinafter - «CAO of Russia»)

Processing of personal data in cases not stipulated by law, or processing of personal data incompatible with the purpose of collecting personal data, except for cases stipulated in p. 2, 11-18 of art. 13.11 and 17.13 of the CAO of Russia, if these actions do not contain a criminal offense.

Administrative fine:

• for officials: 10 000 – 20 000 RUB.
• for legal entities: 60 000 – 100 000 RUB.

For repeated violations:

• for officials: 20 000 – 50 000 RUB.
• for individual entrepreneurs: 50 000 – 100 000 RUB.
• for legal entities: 100 000 – 300 000 RUB.

Administrative fine:

• for officials: 50 000 – 100 000 RUB.
• for legal entities: 150 000 – 300 000 RUB.

For repeated violations:

• for officials: 100 000 – 200 000 RUB.
• for individual entrepreneurs and legal entities: 300 000 – 500 000 RUB.

pt. 10 of art. 13.11. of the CAO of Russia

Failure to notify or untimely notification of Roskomnadzor regarding the intention to process personal data.

There is no specific liability.

In practice, liability under art. 19.7 of the CAO of Russia «Failure to provide information» applied (administrative fine for officials: 300 - 500 RUB; for legal entities: 3 000 – 5 000 RUB).

Administrative fine:

• for officials: 30 000 – 50 000 RUB.
• for individual entrepreneurs and legal entities: 100 000 – 300 000 RUB.

Provision

Offense

Liability

pt. 11 of art. 13.11. of the CAO of Russia

Failure to notify or untimely notification of Roskomnadzor in the event of establishing the fact of unlawful or accidental transfer (provision, distribution, access) of personal data resulting in a violation of the data subject rights (hereinafter – «data breach»).

Administrative fine:

• for officials: 400 000 – 800 000 RUB.
• for individual entrepreneurs and legal entities: 1 – 3 million RUB.

pt. 12 of art. 13.11. of the CAO of Russia

Actions (inaction) of the data operator that resulted in the data breach of 1 000 to 10 000 data subjects and (or) from 10 000 to 100 000 identifiers, if these actions (inaction) do not contain signs of a criminal offense.

An identifier refers to a unique designation of information about an individual contained in the operator's personal data information system and relating to that individual (note 4 to art. 13.11 of the CAO of Russia).

Administrative fine:

• for officials: 200 000 – 400 000 RUB.
• for individual entrepreneurs and legal entities: 3 – 5 million RUB.

pt. 13 of art. 13.11. of the CAO of Russia

Actions (inaction) of the data operator that resulted in the data breach of 10 000 to 100 000 data subjects and (or) 100 000 to 1 million identifiers, if these actions (inaction) do not contain signs of a criminal offense.

Administrative fine:

• for officials: 300 000 – 500 000 RUB.
• for individual entrepreneurs and legal entities: 5 – 10 million RUB.

pt. 14 of art. 13.11. of the CAO of Russia

Actions (inaction) of the data operator that resulted in the data breach of more than 100 000 data subjects and (or) more than 1 million identifiers, if these actions (inaction) do not contain signs of a criminal offense.

Administrative fine:

• for officials: 400 000 – 600 000 RUB.
• for individual entrepreneurs and legal entities: 10 – 15 million RUB.

pt. 15 of art. 13.11. of the CAO of Russia

Repeated data breach, stipulated by pt. 12-14 of art. 13.11 of the CAO of Russia committed by a person subjected to administrative punishment under pt. 12-16, 18 of art. 13.11 of the CAO of Russia.

Administrative fine:

• for officials: 800 000 – 1.2 million RUB.
• for individual entrepreneurs and legal entities: from 1% to 3% of the aggregate amount of revenue received from the sale of all goods (works, services) for the calendar year preceding the year in which the violation was detected, or the amount of the credit organization’s own funds (capital) as of the date of the violation, but not less than 20 million RUB and not more than 500 million RUB.

pt. 16 of art. 13.11. of the CAO of Russia

Actions (inaction) of the data operator that caused a breach of special categories of personal data.

Administrative fine:

• for officials: 1 – 1.3 million RUB.
• for individual entrepreneurs and legal entities: 10 – 15 million RUB.

pt. 17 of art. 13.11. of the CAO of Russia

Actions (inaction) of the data operator that resulted in the biometric data breach, except for cases stipulated by art. 13.11.3 of the CAO of Russia.

Administrative fine:

• for officials: 1.3 – 1.5 million RUB.
• for individual entrepreneurs and legal entities: 15 – 20 million RUB.

pt. 18 of art. 13.11. of the CAO of Russia

Repeated breach of special categories of personal data or biometric data, committed by a person subjected to administrative punishment under pt. 12-18 of art. 13.11. of the CAO of Russia.

Administrative fine:

• for officials: 1.5 – 2 million RUB.
• for individual entrepreneurs and legal entities: from 1% to 3% of the aggregate amount of revenue received from the sale of all goods (works, services) for the calendar year preceding the year in which the violation was detected, or the amount of the credit organization’s own funds (capital) as of the date of the violation, but not less than 25 million RUB and not more than 500 million RUB.

pt. 2 of art.  13.11.3. of the CAO of Russia

Violation of the procedure for processing biometric personal data in the unified biometric system (hereinafter – «UBS»), UBS vectors in the information systems of state bodies, the Central Bank of Russia and accredited organizations, which carry out authentication on the basis of individuals’ biometric personal data, or requirements to information technologies and technical means, intended for processing biometric personal data, UBS vectors for the purposes of identification and (or) authentication.

Administrative fine:

• for officials: 100 000 – 300 000 RUB.
• for officials: 500 000 – 1 million RUB.

pt. 3 of art.  13.11.3. of the CAO of Russia

Failure to take organizational and technical measures to ensure the security of biometric personal data during their processing in the UBS, its interaction with other information systems or failure to take organizational and technical measures to ensure the security of biometric personal data during their processing in other information systems providing authentication using individuals’ biometric personal data, including information systems of accredited state bodies.

Administrative fine:

• for officials: 300 000 – 500 000 RUB.
• for legal entities: 1 – 1.5 million RUB.

pt. 4 of art.  13.11.3. of the CAO of Russia

Processing of biometric personal data, UBS vectors for individuals’ authentication in information systems of state bodies, organizations, information system of the Central Bank of Russia, without accreditation or if accreditation is suspended or terminated.

Administrative fine:

• for officials: 500 000 – 1 million RUB.
• for legal entities: 1 – 2 million RUB.

pt. 8 of art. 14.8 of the CAO of Russia

Refusal to conclude, execute, amend or terminate an agreement with a consumer due to the consumer's refusal to pass identification and (or) authentication using their biometric personal data.

Administrative fine:

• for officials: 50 000 – 100 000 RUB.
• for legal entities: 200 000 – 500 000 RUB.