Enforcement in Russia
In Russia, the Agency is responsible for the enforcement of data protection rules. The Agency is entitled to:
- carry out checks;
- consider complaints from data subjects;
- demand necessary information about personal data processing by the data operator;
- order the data operator to undertake certain actions according to the law, including discontinuance of the processing of personal data;
- file court actions;
- initiate criminal cases; and
- impose administrative liability for violations of data privacy rules.
If the Agency becomes aware that a data operator is in violation of the law, an enforcement notice may be issued, requiring the data operator to correct the violation.
A data operator can face civil or administrative penalties for violation of personal data law. Executives of the data operator responsible for violation of data rules may also face personal liability, including, in some cases, criminal liability. Criminal liability is not often applied, but may be imposed for violations, such as:
- Unlawful collection or dissemination of information about a data subject's private life, personal or family secreta, or public dissemination or leak to mass media of such information;
- Violation of data subjects’ right so secrecy of correspondence, telephone conversations, postal, telegraphic and other communications; or
- Unlawfully accessing legally protected computer information, if this act resulted in the destruction, blocking, modification or copying of computer information, including personal data.
Usually, in the case of violation of data protection law, the Agency will serve an enforcement notice requiring the correction of the violation. In many cases, the Agency and may also impose an administrative penalty and in some cases, may also recommend further actions against the individuals responsible for the violation.
The default administrative fines for most initial violations of data privacy rules are between ₽60, 000 – 150, 000 and ₽300,000 for repeated violations.
There are some specific rules for a breach of rules for written consent. In these cases, the fine for initial offences is between ₽ 300, 000 and ₽700, 000, and for repeated violations ₽1, 000, 000 – ₽1, 500, 000.
For violation of data localization rules, the maximum administrative penalty is currently ₽18, 000, 000 for repeated violations, actual penalties are imposed at lower levels.
The State Duma is considering significantly increasing existing fines and implementing new fines:
- Failure to fulfill or untimely fulfillment of the obligation to notify the Agency of the intention to process personal data - from ₽ 100,000 to ₽300,000;
- Failure to notify or late notification of the Agency of a leak of personal data. Companies are proposed to be fined up to ₽3, 000, 000 for this violation;
- Actions (or inaction) of the data operator causing a leak of personal data would involve a fine for companies between ₽5, 000, 000 and ₽20, 000 000, depending upon the number of affected data subjects, as well as the number of identifiers relating to affected data subjects. For repeated leaks, a fine ranging from 0.1% to 3% of the data operator’s aggregate revenue (in any case it must be not less than ₽15, 000, 000 or more than ₽500, 000, 000); and
- It is also proposed to criminalize the unlawful processing of computer information containing personal data, as well as the creation or operation of information resources intended for the unlawful storage or dissemination of such information. Penalties would include fines, compulsory labor and imprisonment.
While there has been a strong negative reaction in industry to the new fines and it would be expected that the proposed bill will be changed, it does appear that higher penalties for data law violations will come into force in the foreseeable future.
