The presidential administration did not approve amendments to the bill on billing fines for data breaches

The amendments provided for mitigation of sanctions for companies subject to certain conditions. So, if a company allocates 0.1% of its working capital to cybersecurity, pays compensation to victims and complies with the requirements of the personal data law, it will be punished with the lower limit.

• In the first reading, amendments to the Code of Administrative Offenses were approved, which stipulated that for the first violation that resulted in the leakage of personal data of citizens, a fine of up to 15 million rubles would be imposed.
• In case of recidivism, a turnover fine of 0.1% to 3% of the income for the calendar year, but not less than 15 million rubles and not more than 500 million rubles.

The Administration Administration did not support the proposal to allocate a mandatory percentage of working capital to cybersecurity. Furthermore, the definition of the identifier that will allow determining the size of the leak should be specified in the law on personal data, and not in the Code of Administrative Offenses, as currently proposed, and compensation should be awarded by the court.

The review also notes that the elements of the crime must be clearly defined; It is now described as “the action or inaction of a person that resulted in the unlawful transfer of information.”

The Ministry of Digital Development told the publication that together with other departments they are working on amendments to the second reading, the final version has not yet been formed.

Representatives of large companies and specialized associations hope that extenuating circumstances will be included in the final version of the bill.