Russian State Duma introduces bill criminalizing ‘unlawful’ use of personal data, likely to combat investigative journalism

Deputies and senators from the ruling United Russia party introduced a package of bills to the State Duma, which would increase the punishment for leaking personal data, and criminalizing the use of such data. The corresponding documents were published on the the State Duma’s website.

The lawmakers suggested establishing liability for:

• Unlawful use, transfer, collection, and storage of personal data obtained through unlawful means. This will be punishable by up to four years’ imprisonment. Or up to five years if the information contains “special categories of data” or biometric personal data;
• Unlawful use of personal data out of “self-interest,” resulting in major damage, committed by a group of persons through prior conspiracy or the use of their official position. The punishment calls for up to six years imprisonment with a fine of up to one million rubles (around $11,000);
• The same acts related to the transfer of personal data abroad. The penalty is up to eight years imprisonment with a fine of up to two million rubles (around $22,000). If these actions led to serious consequences or were committed by an organized group, the penalty is up to ten years imprisonment with a fine of up to three million rubles (around $33,000);
• Creation of resources or programs knowingly designed for illegal storage and transfer of information containing personal data. The penalty is up to five years imprisonment with a fine of up to 700,000 rubles (around $7,700).

Independent publication Agenstvo notes that the introduction of liability for the use of personal data will criminalize the work of investigative journalists. “Analyzing databases is one of the last methods of investigative journalism left at the disposal of Russian journalists,” Agenstvo reports.