Russia: Introduced Bill amending the Criminal Code establishing criminal penalties for personal data infringements (Bill No. 502113-8)

On 4 December 2023, the Bill amending the Criminal Code establishing criminal penalties for personal data infringements (Bill No. 502113-8) was introduced in the State Duma. The Bill introduces a new article, Article 2721, to the Criminal Code, establishing criminal penalties for the illegal collection, storage, use, and transmission of computer information containing personal data obtained through unauthorised means. The Bill also outlines penalties for other offences, such as the illegal transfer of databases to foreign entities and the creation of internet resources facilitating unlawful storage and access to personal data. In cases of illegal collection of computer information containing personal data obtained through unauthorised means, entities face a fine of up to RUB 300’000 or forced labour or imprisonment for up to 4 years. If the data includes sensitive or biometric data, a fine of up to RUB 700’000 or confiscation of a person's salary or other income and prohibition from engaging in certain activities or forced labour or imprisonment for up to 5 five years will be applicable. The acts committed out of mercenary interest or causing significant harm will face a fine of up to RUB 1 million, confiscation of a person's salary or other income and prohibition from engaging in certain activities or forced labour or imprisonment for up to 6 years. In cases involving illegal cross-border transfer, the acts are punishable by imprisonment for up to 8 years with a fine of up to RUB 2 million or confiscation of the person's salary or other income and prohibition from engaging in certain activities. If the acts led to serious consequences, imprisonment for up to 10 years with a fine of up to RUB 3 million or confiscation of a person's salary or other income, and prohibition from engaging in certain activities will be applicable. The creation of internet resources facilitating unlawful storage and access to personal data will be punishable by a fine of up to RUB 700’000 or confiscation of a person's salary or other income and prohibition from engaging in certain activities or forced labour or imprisonment for up to 5 years and a fine of up to RUB 700’000 or confiscation of salary and other revenues.