Data will be protected by capital

[root]

Is it possible to stop the leakage of personal information with a "long ruble"

The Ministry of Digital Development and other departments supported the introduction of a turnover penalty for operators who lose personal data (PD) of users. The current measures are unable to stop the flow of personal information leaving the “left” from organizations. What are the prospects for a new type of punishment and how to make it effective, RSpectr found out together with market participants.

WHY FINE FROM THE TURNOVER

The proposal to tighten sanctions for the leakage of personal data was made on February 17 in the Federation Council during a round table on improving legislation in the field of personal data circulation. A participant in the event, director of legal initiatives at the Internet Initiatives Development Fund (IIDF), Alexandra Orekhovich, told RSpectr that such an initiative was expressed by the Ministry of Digital Development, and representatives of the Federation Council supported it. At the same time, the expert clarified that the proposal has not yet been "dressed in the form of a specific bill."

The press service of the Ministry of Digital Development of RSpectr confirmed the initiative, saying that the introduction of turnover fines "will help reduce the number of incidents associated with PD leaks."

Ministry of Digital Development, press service:

– It is important to note that the current penalties do not encourage operators to unconditionally comply with the requirements of legislation in the field of personal data.

“The issue of increasing responsibility for leaks of PD has been discussed for a long time and so far fruitlessly. The absence of serious punishment for 15 years of the law can cause nothing but surprise. I am not aware of a single draft law that has reached discussion in parliament,” Mikhail Emelyannikov, managing partner of the Emelyannikov, Popova and Partners consulting agency, told RSpectr.

He added that

THE ROUND TABLE AT THE FEDERATION COUNCIL IS THE MOST SIGNIFICANT EVENT, BUT IT IS ONLY A CONCEPT SO far​

We see a consensus, and we can expect that work on the relevant standards will enter an active phase, Alexei Parfentiev, head of the analytics department at SearchInform, predicts in a conversation with RSpectr.

A. Orekhovich agrees that turnover fines can indeed affect the reduction in the number of PD leaks. A similar position is shared by many market participants. “Think of Oriflame, which had 1.3 million customer data put up for sale by hackers. Then the company paid a fine of 30 thousand rubles. With such symbolic amounts, it makes no sense for large players to fight for the security of personal information, ”Konstantin Stepanov, Executive Director of HFLabs (engaged in the processing and structuring of personal data in large companies), tells RSpectr.

However, the participants of the round table noted the need to take into account the degree of guilt and the influence of the human factor in identifying violations, A. Orekhovich specified.

Alexandra Orekhovich, IIDF:

“It's one thing when a leak was the result of an organization's failure to properly fulfill its obligations to ensure the safety of data. That is, it did not fulfill the necessary technical or administrative measures. And it’s completely different when it happened due to the employee’s misconduct, despite all the measures taken by the company.

The situation with the storage of confidential information in state-owned companies is deplorable. According to SearchInform, in 2021, most often PD disappeared from state institutions:

• healthcare (45%);
• power structures (38.5%);
• government bodies (23.5%).

Without strict responsibility for violations, the problem cannot be solved, but the approach must be balanced and differentiated, A. Parfentiev believes

Konstantin Stepanov, HFLabs:

– Different data has different value. If attackers become aware of the address of a person and the amount in his bank accounts, it is life-threatening. And if they find out that someone is registered on a site selling goods, this is not so critical.

DIVIDE AND PUNISH

Experts agree that turnover fines ideally grade the degree of liability. At the same time, it is important to take into account a number of factors when punishing, M. Emelyannikov notes:

• the size of the leak (number of affected subjects);
• the composition of the data to which illegal access has been obtained (special categories, payment information, biometrics at least);
• potential consequences of the loss of PD for the subjects, the composition and content of the measures taken by the operator to protect against their loss.

These factors can be taken into account to a greater extent in law enforcement practice when determining the amount of liability. Although some of them, for example, the number of subjects and categories of data, can be directly specified in the law, says M. Emelyannikov.

Evgeny Sukhanov, director of the information security department at Oberon, believes that the incident factor should be taken into account in the law. The operator should be punished more severely for a leak than for a safety non-compliance found during a regular regulatory audit, he said in an interview with RSpectr.

ANOTHER IMPORTANT POINT THAT WILL AFFECT THE EFFECTIVENESS OF PUNISHMENT IS THE QUALITY OF THE EVIDENCE BASE​

Ashot Hovhannisyan, the founder of DLBI, a data leak intelligence and darknet monitoring service, is confident that the punishment depending on the amount of revenue will cause strong resistance from the operators when they are held accountable. “At least all decisions to issue such fines will be challenged in courts to the last. And here it is necessary to seriously deal with the proof of the fact of the leak and its cause, which includes many special examinations, ”he told RSpectr.

Ashot Hovhannisyan, DLBI:

– The main task here is to confirm the source of information on which the reliability of the subsequent decision is based, but it should not be too expensive and complicated for the applicant. So far, the operator’s standard reaction is: “Prove that the information was leaked from us.”

This position is practically impenetrable for the victims (except for bank account balances), as it requires expensive and complex examinations, which are usually actively opposed, A. Oganesyan explained.

Also, judges who will make a decision, including in the appellate and cassation instances, must have special knowledge. So far, the situation with this is even worse than with the fines themselves, the head of the DLBI believes.

BUSINESS AND STATE STRUCTURES - WHO WILL ANSWER?

Naturally, the initiative should primarily affect the largest corporations with state participation, such as Rostelecom, Sberbank, VTB, which are the largest PD operators, M. Emelyannikov believes. At the same time, the expert admits that the situation with state structures is more complicated - it is more appropriate to fine officials who are responsible for the security of personal information.

Of course, the law should equally apply to state and commercial organizations, because from the point of view of the subject of PD there is no difference where they leak from, Georgy Belyakov, head of the information security department at Linxdatacenter, told RSpectr.

A. Hovhannisyan believes that it would be strange to punish companies and departments that are part of it on behalf of the state.

PERSONAL RESPONSIBILITY, INCLUDING FINANCIAL​

However, a well-developed system for establishing the guilt of specific individuals and proving their responsibility for data leakage is also needed here, he specified.

Information security (IS) experts believe that state-owned companies need to outsource their information security structure to specialized firms, either to data protection centers created with state support, or completely state-owned.

Alexey Parfentiev, SearchInform:

- The problem of the public sector is not in the absence of information security budgets or low equipment with protective tools, but in the shortage of specialized personnel. The salary policy of the state institution will not allow competing in terms of working conditions with the commercial sector.

EUROPEAN EXAMPLE IS CONTINUOUS

In the European Union, monetary penalties have been applied for several years, depending on the amount of revenue. These sanctions are provided for by the General Data Protection Regulation (GDPR). In the EU, both turnover fines and fixed amounts for leaks have been practiced for four years now. The latter are measured in millions of euros. Of course, such measures have shown results: European companies are forced to either better protect data, or not be a PD operator at all, says A. Parfentiev.

VIOLATORS MAY BE FINED UP TO EUR 20 MILLION OR UP TO 4% OF THE ANNUAL TURNOVER FOR THE PREVIOUS FINANCIAL YEAR​

The main effect achieved in the EU is the deterrence and prevention of further violations by companies, states A. Orehovich.

“In addition to fines, which may be insignificant for corporations, reputational damage is also important. This means that the results of inspections should be widely publicized,” E. Sukhanov explained.

In Russia, turnover fines also appeared in the legislation. In particular, they are provided for refusing to block content prohibited in the Russian Federation. Their size varies from 1/20 to 1/5 of the company's annual income, reminded A. Orehovich.

Also in 2021, the penalty for disclosing confidential information increased tenfold. As part of the protection of consumer rights, it was forbidden to collect redundant, unnecessary data for the provision of services. Calls from the “bank security service” were officially equated with fraud.

At the same time, G. Belyakov believes that as long as the PD leak does not cause real and significant reputational damage to operators, no fines will work.

Image: RSpectr, Adobe Stock
A source

 

[Alexander Konovalenko.]

It is high time to punish the leakage of personal data. Up to criminal liability.