Starting from July 1, 2017, liability for violations of personal data protection laws to be toughened

The previous version of Article 13.11 of the Code of Administrative Offenses of the Russian Federation (“CAO”) provided only one general type of administrative offence: violation of the procedure for collecting, storing, using and disseminating personal data. The amount of fine for such violation did not exceed RUB 10,000.

For reference: 1 EUR = RUB 67.81 (as of June 30, 2017).

Federal Law No.13-FZ dated February 7, 2017, coming into force on July 1, 2017, completely changes Article 13.11 of the CAO and introduces 6 new administrative offences in regard to personal data protection and increases amounts of the fines:

It should be noted that the above list of offenses covers a wide range of possible violations, including violations of the procedure for collecting personal data on the company’s web site through feedback forms, company’s failure to publish its personal data processing policy, cross-border transfer of personal data without consent of employees or consumers (including transfer within a group of companies), mailout and mass distribution of marketing materials and advertising to consumers without their consent, as well as violations of the requirements for storage of personal data in hardcopy form.

In addition, starting from July 1, 2017 changes to Articles 28.3 and 28.4 of the CAO will come into effect, allowing officials of Roskomnadzor (Russian Data Regulator) to hold companies and their officials liable for violating the provisions of Article 13.11 of the CAO. These changes in practice should simplify and speed up the process of imposing administrative liability, since earlier only prosecutors had the exclusive competence to initiate cases on administrative offenses under Article 13.11 of the CAO.

--------------------------------

The article contains photograph www..securitylab.ru