Mintsifra agreed not to introduce fines for companies for the first personal data leak

Representatives of Rostelecom, MTS, Avito, Yandex, Ozon, Vimpelcom, VK and other companies attended a meeting at the Ministry of Digital Development on July 7 dedicated to this issue, Kommersant writes.

• In May, the agency agreed to a bill that involves the introduction of a fine of 1% of annual revenue and up to 3% if the company did not report the leak to Roskomnadzor in a timely manner.
• On June 6, the State Duma adopted in third reading amendments to the law "On personal data": they introduce the obligation for all companies to inform the Roskomnadzor about leaks of personal information of citizens. Companies must report a leak to Roskomnadzor within 24 hours of its discovery, and within 72 hours to provide the results of the investigation and information about those responsible.

Sources from "Kommersant" assure that the Digital Ministry has promised not to introduce fines for the first revealed fact of the leak.

The agency also agreed to reduce the penalty for leakage below 1% of billing, but this issue will still be discussed. In addition, they discussed the possibility of reducing the fine for hiding the fact of a Roskomnadzor leak.

The Ministry of Digital Development instructed the companies led by Rostelecom and VK to develop proposals for amendments to the bill within two weeks.

Now a fine for legal persons for data leakage under art. 13.11 of the Code of Administrative Offenses is from 60 thousand to 100 thousand rubles, in case of recidivism - up to 500 thousand rubles. For example, in 2021, Oriflame paid a fine of 30,000 rubles for leaking the data of 1.3 million customers, while Yandex.Food received a fine of 60,000 rubles this year.