Big business opposes bill on fines for turnover leaks

In January, the State Duma approved in the first reading bills on negotiable fines and criminal liability for personal data leaks. For data leaks of more than 100 thousand citizens, legal entities will face a fine of up to 15 million rubles, and for a repeated violation – a reverse fine.

According to the publication’s interlocutors, companies are concerned that the draft law in its current form will leave organizations that make conscientious efforts to ensure the protection of customers’ personal data to be held accountable, but may become victims of a hacker attack or a failure of software developed by a third-party company.

The proposed fine could affect the financial situation of the organization. However, the document does not contain conditions that mitigate the liability of those who invest in infrastructure to protect personal data.

Market representatives also fear that representatives of large companies will try to adapt to the new rules, but it is not a fact that this will increase the level of information security. Some companies will find it easier to give money to extortionists than to pay fines for turnover.

In March 2024, Opora Rossii proposed to reduce the amount of fines for billing for small and medium-sized businesses for personal data leaks. Representatives of the association believe that the adoption of the bill in its current form entails risks for small and medium-sized businesses.

They asked that the document be supplemented with a clause separating data leakage from its processing, and also determining what specific act it would be responsible for.