Russia: Adopted Law amending Criminal Code establishing liability for illegal use and transfer, collection and storage of computer information containing personal data (Bill No. 502113-8)

On 27 November 2024, the Federation Council adopted Bill No. 502113-8, which amends the Criminal Code of the Russian Federation. The Bill criminalises the unauthorised collection, storage, use, and transfer of databases containing personal data obtained through unlawful means. It also penalises the creation and operation of information resources intended for the unlawful storage and distribution of personal data. The penalties for these offences range from fines to imprisonment, depending on the severity and circumstances of the offence. Aggravating factors include actions committed by a group, resulting in significant harm, or involving special categories of personal data such as racial, national, political, religious, or biometric data. The Bill will be sent to the President of the Russian Federation to be signed.