On November 27, 2024 the Federation Council approved laws amending the Criminal Code of the Russian Federation (hereinafter referred as the “Criminal Code”) and the Code of Administrative Offences of Russian Federation (hereinafter referred as the “Administrative Offences Code”) to and toughening liability for violations of law in the area of personal data (in accordance with the previously introduced Draft Laws: No. 502104-8 “On Amending the Code of Administrative Offences of the Russian Federation” and No. 502113-8 “On Amending the Criminal Code of the Russian Federation”).

More in our update.

According to the Group-IB research, last year the amount of publicly released databases of Russian companies six times outnumbered those unlawfully made public in 2021. At the same time, special provisions, regulating liability for personal data leaks, are not foreseen neither in the Code of Administrative Offenses of Russia nor in the Criminal Code.

Therefore, on 4 December 2023, the draft laws No. 502104-8 “On Amendments to the Code of Administrative Offences of the Russian Federation” (“draft law No. 502104-8") and No. 502113-8 “On Amendments to the Criminal Code of the Russian Federation” (“draft law No. 502113-8”), providing toughening liability for personal data leakage, were submitted to the State Duma.

According to the explanatory notes to these draft laws, currently existing liability is disproportional and incomparable to the potential social harm which can personal data leakage result in.

Over the past two years, the number of arbitration disputes on the recovery of unjust enrichment from foreign IT-companies has increased significantly. For the period from 2022 to 2023, according to the Arbitration Case File, dozens of claims were filed by Russian legal entities against the largest foreign software manufacturers: IBM Eastern Europe/Asia LLC, Dell LLC, Hewlett Packard Enterprise LLC, and HP Inc LLC.