Data Protection Law Amended To Increase Personal Data Subjects' Rights

• Published date: 23 June 2021
• Subject Matter: Privacy, Data Protection, Privacy Protection
• Law Firm: Gorodissky & Partners
• Author: Nikita Maltsev

Russia's legislation evolves rapidly and its personal data laws are no exception. On 27 March 2021 Russia enhanced personal data subjects' rights by changing fines and extending the limitation period for data-related breaches.

No changes to fines for data localisation breaches

The Federal Law on Amendments to the Code of Administrative Offences (19-ФЗ, 24 February 2021) amends the amount of administrative fines prescribed by Article 13(11) of the Code of Administrative Offences for Several Types of Offences Against the Federal Law On Personal Data (152-ФЗ, 27 July 2006). The fines may apply to legal entities and their responsible managers (eg, CEOs and data protection officers) on a case-by-case basis.

However, the amendments do not change the highest fines, which apply to breaches of the so-called 'data localisation' requirement. As before, companies which fail to ensure that the recording, systematisation, accumulation, storage, clarification (ie, updating or changing) and extraction of Russian nationals' personal data is carried out using databases located in Russia (when collecting such personal data in any manner, including via the Internet) may face a fine of between Rb1 million and Rb6 million (approximately $13,000 to $80,000). Responsible managers may face a fine of between Rb100,000 and Rb200,000 (approximately $1,300 to $2,600).

Administrative fines for repeated offences are higher. A 'repeated offence' is an offence that occurs within one year of the date on which the previous liability was completely enforced. A repeated breach of the localisation requirement incurs a fine of between Rb6 million and Rb18 million (approximately $80,000 to $240,000) for companies, while responsible managers may face a fine of between Rb500,000 and Rb800,000 (approximately $6,600 to $10,500) (Articles 13(11)(8) and 13(11)(9) of the code).

New limitation period

The...