State Duma toughens fines on companies for repeated leaks of personal data

For illegal distribution from 1 thousand to 10 thousand interested parties or from 10 thousand to 100 thousand identifiers, the following fines are established: for Russians – from 100 thousand to 200 thousand rubles, for officials – from 200 thousand rubles to 400 thousand rubles, for companies – from 3 million rubles to 5 million rubles.

In addition, for a massive leak (more than 100 thousand interested parties or more than 1 million identifiers), fines for individuals will increase to 400 thousand rubles, for officials – up to 600 thousand rubles, for companies – up to 15 million of rubles.

In case of repeat offenses, administrative penalties will amount to up to 600 thousand rubles for Russians, up to 1.2 million rubles for officials, as well as from 1% to 3% of the company’s total income received from the sale of all the goods and services. for the calendar year.

The approved law also increased fines for illegal data processing: in case of repeat offenses for individuals – up to 30 thousand rubles, for officials – up to 200 thousand rubles, for legal entities – up to 500 thousand rubles.

In addition, the State Duma adopted an amendment proposing to introduce penalties of up to five years in prison for illegal use, transfer, collection or storage of information containing personal data of minors.

Before the amendments were approved, the maximum fines for personal data leaks were up to 12,000 rubles for Russians, up to 50,000 rubles for civil servants and up to 300,000 rubles for companies.

A draft law on fines for leaking information to companies was submitted to the State Duma in December 2023. Deputies adopted the document in first reading in January 2024.