Leaking personal data is now punishable by up to 10 years in prison

For illegal distribution, including negligence, of personal information, the operator will be obliged to pay a fine depending on the amount of damage:

• loss of 1 thousand to 10 thousand subjects of personal data (or from 10 thousand to 100 thousand “identifiers” – unique designations of information about an individual in the operator’s system) – fines: for individuals – from 100 thousand to 200 thousand rubles; for officials – from 200 thousand to 400 thousand rubles; for legal entities – from 3 million to 5 million rubles.
• loss of 10 thousand to 100 thousand personal data or from 100 thousand to 1 million identifiers – fines: for individuals – from 200 thousand to 300 thousand rubles; for officials – from 300 thousand to 500 thousand rubles; for legal entities – from 5 million to 10 million rubles.
• loss of more than 100 thousand interested parties or more than 1 million identifiers – fines: for individuals – up to 400 thousand rubles; for officials – 600 thousand rubles; for legal entities – 15 million rubles.

In case of repeated violations, fines are multiplied (up to 600 thousand rubles for individuals and up to 1.2 million for officials, for example), and other rates are applied to companies: from 1 to 3% of total income from goods /services during the calendar. one year before receiving a fine (the range will be from 20 to 500 million rubles).

In addition, operators who have leaked information will be fined if the amount of information lost falls into a “special category”, as well as for late notifying customers about leaks.

The second law signed by the president refers to the illegal use of personal data. And here we are talking about possible prison. For example, a fine can be replaced by forced labor if the violation is not critical.

For the loss of data of minor citizens or illegal use of biometric data, the fine will increase to 700 thousand rubles (up from 300 thousand rubles). The equivalent can be two years of income, forced labor for up to five years, or imprisonment for up to five years.

If it becomes clear to the court that the operator’s actions were motivated by self-interest and that significant damage was caused intentionally, then the fine can reach 1 million rubles, imprisonment for three years, hard labor for 5 years or imprisonment for up to 6. years.

In the case of a cross-border data leak, the terms can be even more serious: 8 years, and 10 years if the loss of information would entail “serious consequences.”

The laws are available on the official legal information portal. They do not apply to the use of data for personal/family purposes.