Every citizen wants his personal life to be safe, his secrets to remain hidden from others, and his data and information from documents to be reliably protected. And the state provides a very extensive set of laws for this, which guarantees confidentiality and personal protection.
Unfortunately, such laws are violated quite often. At the same time, they are violated both by citizens and various organizations, including government ones. In this article we will talk about the responsibility that the disclosure of personal information imposes, as well as in which cases the disclosure of personal information is an administrative crime and when it is a criminal offense.
Legislation
- The main regulator is the Federal Law “On Personal Data” dated July 27, 2006 No. 152. The provisions of the document disclose:
- Concepts used (Article 3).
- Principles and features of processing certain information (Articles 5–13).
- The rights of the subject, i.e. the person presenting the information (Articles 14–17). Article 17 states that citizens can demand compensation for losses and compensation for moral damage.
- Operator responsibilities, i.e. organization or person processing information (Articles 18–22.1).
- Decree of the Government of the Russian Federation of March 16, 2009 No. 228 (as amended on February 28, 2019) “On the Federal Service for Supervision in the Field of Communications, Information Technologies and Mass Communications.”
- Decree of the Government of the Russian Federation dated November 1, 2012 No. 1119 “On approval of requirements for the protection of personal data during their processing in information systems.” The document names Roskomnadzor as the supervisory authority in the area related to personal information and contains a list of powers of this structure.
IMPORTANT: there are more than 50 acts of different authorities on the procedure for working with data - each ministry and service has its own characteristics.
Types of liability for disclosure of personal data
Every person is endowed by the Constitution of the Russian Federation with the right to maintain the secret of private life (Article 23).
The protection of this right is ensured by complying with the provisions of Art. 24 of the Constitution, which declares that the collection and dissemination of information about a person’s personal and family life without his consent is illegal. The meaning of the legal term “personal data” is formulated in the Law “On Personal Data” dated July 27, 2006 No. 152-FZ. This is any information about various data directly or indirectly related to an individual. In this case, the information may concern both a specific individual and the one they are trying to identify.
We have described in more detail what personal data is here.
Example
There is an individual - Ivanov Ivan Ivanovich. Obviously, the specified personal data will not allow one to unambiguously identify a specific person, because there are probably a lot of people with such “parameters”. However, F.I.O. is the personal data of an individual known to us.
The information “Ivanov Ivan Ivanovich, passport 45 08 No. 123456” allows you to identify (define) a specific person - to select from a large group one with an accurate description.
Personal data includes full name, identity card details, place and date of birth, address, education, marital, property status, insurance certificate number and other similar information relating exclusively to a specific person.
The employer's personnel service, by virtue of its functions, collects documents from employees and compiles their personal files for the purposes of the established procedure for personnel records. An employee’s personal file contains information about family, personal life, position and amount of remuneration for work, identity cards, etc. The documentary composition of personal files is the personal data of employees, and the employer, following the provisions of the law, is obliged to ensure their protection (Article 18.1 of Law No. 152-FZ).
What happens if you do not receive consent to the processing and use of personal data, read here.
And here you will find a sample of such consent.
Art. 7 of Law No. 152-FZ establishes the confidentiality status of personal data. This article generally prohibits persons with access to personal information from disclosing this information without the consent of its owner.
The consequences of non-compliance with the rules of labor discipline, including disclosure of information, are described in detail in the article “Disciplinary offense under the Labor Code of the Russian Federation - concept and signs .
Failure to comply with this norm will result in liability (Article 24 of Law No. 152-FZ). Its main types are as follows:
- disciplinary - according to the Labor Code of the Russian Federation;
- administrative - according to the Code of Administrative Offenses of the Russian Federation;
- criminal - according to the Criminal Code of the Russian Federation.
ConsultantPlus experts spoke about the magnitude of sanctions for the disclosure of personal data of employees by an employee who has access to such information. Get trial access to the K+ system and go to the HR Guide for free.
Art. 81 (on the disclosure of personal data that became available in connection with the performance of official duties) and 90 of the Labor Code of the Russian Federation (on violation of the procedure for receiving, storing, processing information that has characteristics of personal information) is called dismissal as the maximum measure of liability for the disclosure of personal information.
For more information about disciplinary liability, see the article “Disciplinary liability of an employee and its types .
According to Art. 13.11 and 13.14 of the Code of Administrative Offenses of the Russian Federation, disclosure of personal data is punishable by an administrative fine.
The fine under the Code of Administrative Offenses is planned to be increased 10 times. The bill has already been submitted to the State Duma. Find out more about the planned innovations in the Review material from ConsultantPlus. If you do not have access to the K+ system, get a trial online access for free.
Law violation
The main reason for filing a complaint is non-compliance with the procedure for processing information:
- collection without the consent of the person;
- distribution without permission;
- other violations.
IMPORTANT: any information relating to a person is considered personal, and there are many grounds for a complaint. Even a neighbor who deliberately collects data can be prosecuted under Art. 137 of the Criminal Code of the Russian Federation.
There are cases when the collection of personal information is lawfully carried out without the consent of the person - Part 1 of Art. 6 of the Federal Law.
When consent to the processing of personal data is not required
In accordance with Part 1 of Art. 6 of Law No. 152, consent to the processing of personal data is not required in the following cases:
- if the person is a participant in legal proceedings;
- if the data is necessary for government agencies to exercise their powers in the provision of state and municipal services, including for registering a citizen on the State Services portal;
- for the execution of an agreement for which a person acts as a beneficiary or guarantor (or for concluding such an agreement on his behalf);
- if the situation requires immediate action necessary to preserve the life and health of a citizen, and it is impossible to obtain his consent (for example, the person is unconscious);
- the collected personal data will be used for the purposes of statistical or other research, provided that they are anonymized;
- the person previously independently made his data available to an unlimited number of users;
- data must be disclosed in accordance with applicable legal requirements;
- information is used for journalistic, creative or scientific activities, as well as for the work of the media, provided that this does not violate the rights and legitimate interests of the citizen.
Where to complain about illegal use of personal data
There are several authorities you can contact depending on the circumstances.
Dear readers! To solve your problem right now, get a free consultation
— contact the lawyer on duty in the online chat on the right or call: +7 (499) 938 6124 — Moscow and region.
+7 (812) 425 6761 — St. Petersburg and region. 8 (800) 350 8362 - Other regions of the Russian Federation You will not need to waste your time and nerves
- an experienced lawyer will solve all your problems!
Complaint to Roskomnadzor
The relevant body for combating abuses when working with information, so it is the first place to contact in case of violation of the law on personal data.
When drawing up a complaint, attention is paid to the description of the violation: by whom, when, under what circumstances it was committed. A reference to the relevant provisions of the law is required.
It is important to indicate:
- Name of the authority to which the appeal is sent.
- Full name, address of the applicant’s place of residence.
- Date of application.
- Applications confirming the violation.
Roskomnadzor is prosecuting under Articles 13.11, 13.14 of the Code of Administrative Offences. These are the basic norms for processing information.
Roskomnadzor publishes quarterly activity reports with useful tips and answers to frequently asked questions. You can find them on the department's website.
Police
If we are talking about the commission of a crime (Articles 137, 272 of the Criminal Code), then a statement about illegal actions is submitted to the police. After the corresponding message, officials will conduct an inspection and, if signs of a crime are detected, will initiate a criminal case.
Court
Since the law provides for the possibility of recovering damages and compensation for moral damage, a statement of claim is sent to the court to protect rights.
Criminal liability
Criminal liability occurs if a person’s personal data has been disclosed, creating a threat to his private life, affecting his safety, or providing public access to information that is not subject to publicity and is protected by the laws of the Russian Federation. Such acts are punishable by Article 137 of the Criminal Code, called “violation of privacy,” which includes three points:
Part one of Article 137 of the Criminal Code of the Russian Federation . Considers the illegal collection of information about the personal life of a citizen, the dissemination of this information, as well as the dissemination of personal and family secrets of a citizen through speeches or works for mass demonstration. Punishable:
- Fine up to 200,000 rubles;
- A fine in the amount of the offender’s income for one and a half years;
- Compulsory work up to 360 hours;
- Correctional labor for up to a year;
- Forced labor for 2 years;
- Four months of arrest;
- Two years in prison.
Part two of Article 137 of the Criminal Code of the Russian Federation . It considers the same crime, but with the caveat that the information was obtained or disseminated through the official position of the perpetrator. Punishable in the following ways:
- 100,000 – 300,000 rubles fine;
- 4 years of forced labor;
- 6 months of arrest;
- Up to 4 years of imprisonment;
- Deprivation of the right to engage in a certain type of activity that gives authority for a period of up to 5 years.
Part three of Article 137 of the Criminal Code of the Russian Federation. It also considers the dissemination of information publicly, but affects only those data that relate to crimes committed against a minor. And also committed by causing significant physical or moral suffering. That is, this part considers the dissemination of any information relating to significant crimes and their impact on the identity of the victim. The punishment will be:
- Fine from 150,000 to 300,000 rubles;
- A fine in the amount of the offender’s earnings for a period of up to 3 years;
- Up to 5 years of forced labor;
- Up to 6 months of arrest;
- Up to 5 years of imprisonment;
- Prohibition on carrying out activities that give certain powers for a period of up to 6 years.
How to file a complaint
According to the general rule specified in the Federal Law on the Procedure for Considering Citizens' Appeals, anonymous complaints are not accepted and no response is provided for them.
But most government agencies, including Roskomnadzor, have websites. It is therefore possible to file a complaint online. In addition, appeals in writing are allowed, as well as during a personal visit to the RKN department.
It should be remembered that statements to the court and the police are made on paper.
General concepts
It’s worth starting with the very concept of “Personal Data”. From a legal point of view, they are any information from a citizen’s documents that is not subject to public disclosure, as well as all information that must be kept secret in accordance with certain regulations and laws. At the same time, this concept often includes various personal information about a person, his secret and not intended for disclosure publicity. It is because of this that confusion may arise in determining responsibility and the offense itself. So we will consider the disclosure of personal information as both an administrative and a criminal offense.
Do you all need to register with Roskomnadzor?
There may be a feeling that for a long time now all employers need to run to Roskomnadzor and register as a personal data operator. However, it is not. Here are the exceptions:
- the collection of personal data of a citizen by the operator is carried out in connection with the establishment of labor relations;
- personal data is collected for the purpose of concluding an agreement, without subsequent transfer and distribution to third parties, it is also provided for the use of personal data only for the execution of an agreement with a citizen;
- processing of personal data that is in the public domain;
- collecting the last name, first name and patronymic of citizens without indicating a telephone number or e-mail;
- personal data is collected for the purpose of allowing a citizen to enter the territory of the operator collecting the data once, or in similar cases;
- collection, processing and storage of personal data is carried out on paper without the use of automation tools. By the way, you can store your paper archive, including personnel documents and personal data, outside the office. This way you can avoid their loss and unauthorized access to information.
In all other cases, registration is required!
Don’t forget that Delis Archive has a “New Year’s” promotion - we give useful gifts to current and future clients!
What more could you ask for?
Many citizens whose personal information was disclosed are not at all satisfied with the standard punishment that can be imposed for such a crime. In this regard, the victim has every right to sue the offender, demanding compensation from him. In this case, you can only demand compensation for moral damage, since physical harm does not occur when information is disclosed.
Compensation for moral damage is a rather complex concept. This is a monetary penalty that the victim can demand for the suffering and inconvenience caused to him caused by the disclosure of his personal data or personal information. You can demand it both during the proceedings by filing a petition, and through a separate independent claim. In this case, you determine its size yourself, but it can be reduced either at the request of the court or at the request of the defendant. If you want to file claims for compensation for moral damages, then the help of a lawyer will be useful - only he will be able to establish the exact amount and prepare the papers.
