Submitted a large package of amendments to the Code of Administrative Offenses relating to the Internet

[root]

Submitted a large package of amendments to the Code of Administrative Offenses relating to the Internet


Ministry of Justice of the Russian Federation laid out for public discussion a bill that introduces a whole package of amendments to the Code of Administrative Offenses, and many of the points in it relate to mass communications, communications, in particular - the Internet. The project aims to "improve the legislation on administrative offenses, taking into account the accumulated experience of law enforcement to ensure the consistency, efficiency and stability of the legal regulation of relations in the field of administrative responsibility."

The bill is a kind of “assembly” of existing norms, scattered in the current versions, in different sections. Some norms were transferred to it unchanged, and in some cases they nevertheless underwent some adjustments.

In particular, the Telegram channel Telecom Review drew attention that in the category "Administrative offenses encroaching on public safety" will appear "Art. 39.24. Violation of critical information infrastructure security requirements "And" 39.25. Failure to provide information required by law in the field of ensuring the security of critical information infrastructure of the Russian Federation ".

Article 39.24 contains the following paragraphs:

1. Violation of the requirements for creating security systems for significant objects of critical information infrastructure of the Russian Federation and ensuring their functioning, established by federal laws and other regulatory legal acts of the Russian Federation adopted in accordance with them, if such actions (inaction) do not contain signs of a criminal offense, - entails the imposition of administrative fine on officials in the amount of from ten thousand to fifty thousand rubles; for individual entrepreneurs - from thirty thousand to seventy thousand rubles; for legal entities - from fifty thousand to one hundred thousand rubles.
2. Violation of the requirements for ensuring the security of significant objects of critical information infrastructure of the Russian Federation established by federal laws and other regulatory legal acts of the Russian Federation adopted in accordance with them, with the exception of cases that have caused damage to the critical information infrastructure of the Russian Federation, if such actions (inaction) do not contain signs of a criminal offense, - shall entail the imposition of an administrative fine on officials in the amount of from ten thousand to fifty thousand rubles; for individual entrepreneurs - from thirty thousand to seventy thousand rubles; for legal entities - from fifty thousand to one hundred thousand rubles.
3. Violation of the procedure for reporting computer incidents, responding to them, taking measures to eliminate the consequences of computer attacks carried out in relation to significant objects of critical information infrastructure of the Russian Federation, established by federal laws and other regulatory legal acts of the Russian Federation adopted in accordance with them, entails the imposition of an administrative a fine on officials in the amount of ten thousand to fifty thousand rubles; for individual entrepreneurs - from fifty thousand to one hundred thousand rubles; for legal entities - from one hundred and fifty thousand to two hundred thousand rubles.
4. Violation of the procedure for the exchange of information on computer incidents between subjects of critical information infrastructure of the Russian Federation, between subjects of critical information infrastructure of the Russian Federation and authorized bodies of foreign states, international, international non-governmental organizations and foreign organizations involved in responding to computer incidents - entails the imposition of administrative a fine on officials in the amount of twenty thousand to fifty thousand rubles; for individual entrepreneurs - from fifty thousand to one hundred thousand rubles; for legal entities - from one hundred thousand to five hundred thousand rubles.

Article 39.25:

1. Failure to submit or violation of the deadlines for submission to the federal executive body authorized in the field of ensuring the security of critical information infrastructure of the Russian Federation, information on the results of assigning one of the significance categories to the critical information infrastructure of the Russian Federation or on the absence of the need to assign it one of such categories provided for by law in the field of security of critical information infrastructure of the Russian Federation, - entails the imposition of an administrative fine on officials in the amount of from ten thousand to fifty thousand rubles; for individual entrepreneurs - from thirty thousand to seventy thousand rubles; for legal entities - from fifty thousand to one hundred thousand rubles.
2. Failure to submit or violate the procedure or deadlines for the submission to the state system of detection, prevention and elimination of the consequences of computer attacks on the information resources of the Russian Federation of information provided for by the legislation in the field of ensuring the security of critical information infrastructure of the Russian Federation - entails the imposition of an administrative fine on officials in the amount of from ten thousand up to fifty thousand rubles; for individual entrepreneurs - from fifty thousand to one hundred thousand rubles; for legal entities - from one hundred thousand to five hundred thousand rubles.

In the article “33.5. Abuse of Freedom of the Media »The whole range of violations will be collected, for which both the media and users are currently receiving fines:

• information about prohibited organizations without marking that they are prohibited;
• public dissemination of disrespectful information about the days of military glory, memorable dates of Russia, etc .;
• instructions for the manufacture of explosives and firearms;
• public calls for terrorism or justifying materials;
• disclosure of state secrets;
• remote sale of alcohol;
• distribution of fakes under the guise of reliable information;
• the same article about fakes, but when it entails the creation of interference with the work of vital objects;
• fakes about emergency situations;
• disinformation resulting in the death of a person;
• mat.

Another major monolith in the bill is “chapter 33 “Administrative offenses in the field of collection, processing, dissemination and protection of information” "To which drew attention of Kommersant. A new paragraph is introduced in the article on "Violation of the legislation of the Russian Federation in the field of personal data", which will regulate the punishment for leaks of personal data:

"6. Failure to comply with the obligation to maintain the confidentiality of personal data - entails the imposition of an administrative fine on citizens in the amount of ten thousand to twenty thousand rubles; for officials - from forty thousand to one hundred thousand rubles; for individual entrepreneurs - from one hundred thousand to three hundred thousand rubles; for legal entities - from three hundred thousand to five hundred thousand rubles. ”

The experts interviewed by the publication are not all enthusiastic about this innovation. According to InfoWatch, in 2019 the number of data leaks in Russia increased by 40%. During the pandemic, the number of attempts to illegally access data increased by about half as a result of the massive transition to remote work, noted DeviceLock founder Ashot Hovhannisyan.

However, the introduction of such a large fine raises questions - the measure can be called premature and inhumane in the context of the general economic situation, says Ekaterina Portman, director of Deloitte Legal in the CIS. Meanwhile, according to the director of the legal department of the ICD, Irina Gudkova, a fine of 500 thousand rubles is significant only for small businesses. For large organizations, it will be nothing more than a “small nuisance,” the expert said.

The cost of databases when they are sold on the darknet is much higher than the proposed fines, therefore, this measure will not deter attackers from draining the databases, I am sure the chairman of the committee for the legal support of the digital economy of the Moscow branch of the Russian Bar Association Alexander Zhuravlev.

Media lawyer of the Center for Circular Rights and RosKom Svobody, lawyer Ekaterina Abashina notes that:

“In the current edition of the Code of Administrative Offenses of the Russian Federation, liability for leakage of personal data is provided for in clause 6 of article 13.11 Code: punishment of up to 20 thousand rubles for individual entrepreneurs, for legal entities - up to 50 thousand rubles. At the same time, the prerequisite for punishment is the existence of harm to the subject of personal data - if the PD operator’s non-observance of the confidentiality of personal data led to unlawful or accidental access to personal data, their destruction, modification, blocking, copying, provision, distribution or other illegal actions in relation to personal data, that is, if harmful consequences have occurred. In this case, the mere fact of non-compliance with the requirements of the law is not enough. ”

“The Justice Ministry suggests adding a new article to the same article (albeit by changing the numbering) -“ failure to fulfill the obligation to maintain the confidentiality of personal data ”with increased fines (up to 500 thousand rubles for legal entities), continues the lawyer of RosKomSvobody. - On the one hand, the leak can be perceived as a violation of the confidentiality of the Persians. On the other hand, according to Section 7 of the Law “On Personal Data”, operators and other persons who have gained access to personal data are required not to disclose to third parties and not to distribute personal data without the consent of the subject of personal data, unless otherwise provided by federal law. ”

“In conjunction with this rule of the Law“ On Personal Data ”, the amendments proposed by the Ministry of Justice would be interpreted as a punishment for unlawful actions of Persian operators to transfer data to other persons, and not as a punishment for leaks,” notes Ekaterina Abashina.

Regarding the amendments to the Code of Administrative Offenses of the Russian Federation on KII, the lawyer believes that:

“... this is a continuation of the package of bills“ On Critical Information Infrastructure ”, which was adopted in the summer of 2017.

The 2017 package included the special law on KII (187-ФЗ dated July 26, 2017), the federal law on amendments to other acts in connection with the adoption of the law on KII (193-ФЗ dated July 26, 2017) and the corresponding amendments to Criminal Code of the Russian Federation. Simply put, in 2017, the foundations were laid for the creation of a system to counter cyber attacks on the information infrastructure of Russia and a punishment was established for attackers.

Now it is proposed to introduce administrative fines for those who have additional responsibilities after the adoption of the law “On the Security of Critical Information Infrastructure of the Russian Federation” (187-FZ of July 26, 2017) and whose inaction can slow down the process of creating or operating a KII security system. I think this is the meaning of these amendments in the Code of Administrative Offenses of the Russian Federation. ”

If you have any comments or suggestions, you can leave them on the document page .

Source