Extraordinary increase in liability for personal data disclosure

The Russian Law on increasing administrative and criminal liability for personal data leakage was signed on November 30, 2024 and will enter into force in six months.

According to the new law, there are different amounts of fines, depending on the amount of leaked information. In particular, for the illegal distribution of 1 thousand to 10 thousand subjects of personal data a legal entity is expected to be fined up to 5 million rubles.

Also in December 2024, a new article of the Criminal Code of the Russian Federation comes into force, which establishes liability for illegal use and or transfer, collection and storage of information on computers containing personal data. If there is a cross-border leak of personal data, then sentences are proposed with a restriction of freedom for up to 8 years, and if the crime entails serious consequences, the perpetrator receives a term of up to 10 years. Roskomnadzor will be able to track violations of personal data processing rules using automated systems that will identify non-compliance with legislation by websites without interaction with the personal data operator.

These new strict changes in the legislation will affect all operators of personal data, regardless of their location. It is quite obvious that foreign companies present in the Russian internet space face the challenge of protecting sensitive information and ensuring privacy compliance when transferring data across borders from one national jurisdiction to another. The companies can find in AURORA company full professional legal and technical support, not to fall under fines and sanctions related to the new laws.