Strengthening administrative responsibility for violation of the Law for Personal Data Protection

The Federal Law №13-FZ «On Amendments to the Code of the Russian Federation on Administrative Offenses» dated 07.02.2017 defines a new version of Article 13.11 of the Code.

In the previous version of this article the responsibility was defined only for violation of the procedure of collecting, storing, using and distribution of information about citizens, i.e. personal data. The article provided for punishment in the form of a warning or fine in the amount of: for citizens – from 300 to 500 RUB, for officials - from 500 to 1,000 RUB, and for legal entities - from 5,000 to 10,000 RUB.

The new version of Article 13.11 of the Code on Administrative Offenses provides for responsibility for the following law violations (given that such acts are not criminally liable):

• processing of personal data for purposes not specified in the Federal Law №152-FZ «On Personal Data» from 27.07.2006;
• processing of personal data that are inconsistent with the purposes of their collection.

In such cases a warning or penalty are provided in the amount of: for citizens from 1 000 to 3 000 RUB, for officials - from 5,000 to 10,000 RUB, for legal persons - from 30 000 to 50 000 RUB.

• processing of personal data without written consent of the personal data subject in those cases where such consent must be obtained under the law;
• processing of personal data with violation of rules on the composition of information included in the written consent of the subject of personal data.

These violations may result in a fine in the amount of: for citizens - from 3,000 to 5,000 RUB, for officials - from 10,000 to 20,000 RUB, for legal entities - from 15,000 to 75,000 RUB.

• failure by an operator to perform publication or other guaranteed free access to documents that determine his/her policy on the processing of personal data. The same applies also to implemented information about requirements for the protection of personal data.
• failure by an operator to provide the information to a personal data subject about his/her own personal data.

After such violation may follow: a warning or penalty for citizens - from 700 to 1,500 RUB, for officials - a fine from 3,000 to 6,000 RUB, for individual entrepreneurs - from 5,000 to 10,000 RUB, and for legal entities - from 15 000 to 30 000 RUB.

On the opinion of the authors of the law, the strengthening responsibility will contribute to the unavoidability of punishment, taking into account the severity of the consequences of offenses.

For comparison, the fine for illegal collection and distribution of personal data is: in Germany - 300 000 EUR, in France - from 150 000 to 300 000 EUR, and in Spain - from 40 000 to 600 000 EUR. In addition, the fiscal authorities in these cases may confiscate illegally obtained profits or impose a fine on turnover.

Now the Federal Service for Supervision in the Sphere of Communications, Information Technology and Mass Communications (Roskomnadzor) is made responsible for drawing up protocols on the relevant administrative cases, while earlier such cases were sanctioned by the Prosecutor's office.

According to Roskomnadzor, 911 scheduled inspections were carried out for 9 months of 2016 within control measures for the compliance of personal data processing with the requirements of the legislation of RF. Based on the results of 459 scheduled inspections 1495 violations were detected. The most frequent violations were: submission of notices on the processing of personal data, containing incomplete information or misinformation, to an authorized body (16% of the total number of violations detected); failure to submit information on the termination of the processing of personal data or on the change of information contained in the notice on personal data processing to an authorized body (14% of the total number of violations detected). Based on the results of all control measures in this direction the bodies of Roskomnadzor imposed administrative fines in the amount of more than 4.8 million RUB and recovered from them more than 2.4 million RUB.

As a reminder, Roskomnadzor is authorized to maintain the Register of operators, processing personal data. As of March 10, 2017 the Register has the information on 373 412 personal data operators. To get acquainted with their activities is possible by subscribing to the Information and Analytical system Globas-i.