The final version of the draft law on negotiable fines for personal data leaks provides for a fine of 3% of a company's total revenue. This is reported by RBC with reference to a source close to one of the authors of the amendments.
The final version of the bill introducing negotiable fines for personal data leaks has been sent to the Government.
The document is formalized as amendments to the Code of Administrative Violations. According to the initiative, for a leak:
- if it concerns from 1 thousand to 10 thousand subjects of personal data (i.e. citizens), the fine for legal entities will be from 3 million to 5 million rubles;
- for data leakage from 10 thousand to 100 thousand subjects - from 5 million to 10 million rubles;
- more than 100 thousand — from 10 million to 15 million rubles.
For repeated violation with any volume of discredited information from 1 thousand subjects, a fine from 0.1 to 3% of revenue for the calendar year preceding the violation or for a part of the current year, but not less than 15 million rubles and not more than 500 million rubles is proposed. For leaks of biometric personal data it is proposed to fine legal entities from 15 million to 20 million rubles. The draft also proposes to introduce fines of different sizes for personal data leaks for citizens and officials.
According to data from the explanatory note to the project, over 2 billion records with almost 300 million user data were published in 2022, of which 16% contained passwords. The leaders in terms of compromised data were delivery services(34%) and retail (14%). At the same time, now the maximum fine for companies that allowed personal data leaks is up to 100 thousand rubles and up to 300 thousand rubles in case of repeated violation.
The amendments will come into force 30 days after the official publication.
Source: RBC
