Legal Liability in the Field of Personal Data Protection: Topical Issues in Russian Legislation and Judicial Practice

Introduction. Rapid digitalization and development of the artificial intelligence technologies have foregrounded a fundamental conflict: the civil, administrative, and criminal liability mechanisms lag behind the rate of personal data circulation. This puts at risk the constitutional right of citizens for privacy and threatens national security, which is aggravated by the doctrinal uncertainty in distinguishing the areas of responsibility in a complex chain of personal data suboperators and cloud providers. The study aims to conduct a comprehensive analysis of the legislation and judicial practices in the field of personal data protection in the Russian Federation for developing the proposals on adjusting the norms of legal liability.

Materials and Methods. In the frame of the research, the following materials were studied: Russian laws, lawsuits regarding personal data protection, official statistical data, and scientific publications in the field of information, administrative, and civil laws. A combination of general scientific and specific legal methods was used to conduct the research.

Results. A number of systemic problems in law enforcement mechanisms applied with regard to violation of personal data protection law in Russia have been revealed. Upon the analysis of court judgments, a disproportion between the actual damage suffered by the subjects of personal data breach and the size of administrative fines imposed on the personal data operators has been acknowledged. Procedural difficulties for the citizens to prove the damage have been identified. A high proportion of offenses related to the covert commercial use of unlawfully obtained databases, along with the low preventive efficiency of the existing penalties, have been revealed.

Discussion and Conclusion. The obtained results lead to the conclusion about the necessity to modernize the model being currently in effect in Russia by tightening state enforcement measures and optimizing security algorithms. The author has proposed the mechanisms to improve the protection process, including the statutory enshrinement of the minimum amount of moral damage compensation to the suffered parties, a clearer distinction between the adjacent corpus delicti regulated by the Articles 137, 272, and 272.1 of the Criminal Code of the Russian Federation, and others. Implementation of these recommendations will ensure predictable law enforcement, allow overcoming the legislative gaps, and establishing the uniform approaches to legal liability in the digital environment.

1. Filimonova EA. Protection of the Right to Privacy in the Context of Digital Transformation of Society. Legal Order and Legal Values. 2025;3(1):46–52. (In Russ.) https://doi.org/10.23947/2949-1843-2025-3-1-46-52

2. Belgorodtseva NG. Theoretical and Legal Aspects of Personal Data Protection. Cand.Sci. (Law) Dissertation. Moscow; 2012. 201 p. (In Russ.)

3. Mazitov II. Legal Liability for Personal Data Breach in Russia: Challenges and Solutions. Education and Law. 2024;(6):375–379. (In Russ.) https://doi.org/10.24412/2076-1503-2024-6-375-379

4. Gilmullina DA, Chikeneva IV. Protection of Personal Data in the System of Legal Labor Relations. Izvestia Orenburg State Agrarian University. 2014;(3(47)):231–234. (In Russ.)

5. Barinov SV. About Novelties of the Administrative Legislation on Responsibility for Violation of the Legislation of the Russian Federation in the Field of Personal Data. In: Proceedings of the X International Scientific and Practical Conference “Yenisei Political and Legal Readings. Legal Liability: National and International Aspects” (Krasnoyarsk, September 21–23, 2017). Krasnoyarsk: Siberian Federal University; 2018. P. 136–144. (In Russ.)

6. Velder IA. System of Legal Protection of Personal Data in the European Union. Cand.Sci.(Law) Dissertation. Kazan; 2006. 187 p. (In Russ.)

7. Kupryashin VS, Petrov AA, Moiseenko MI. Civil Liability for Violations of Personal Data Legislation: Cooperation Between the Ministry of Internal Affairs and the Prosecutor's Office in Ensuring Information Security. Law and Power. 2025;(10):60–64. (In Russ.)

8. Fedosin AS, Chervonenko VF. On Criminal Liability for Violations of Legislation in the Field of Automated Processing of Personal Data. Vestnik of Academy of Economic Security of the Ministry of Internal Affairs of Russia. 2011;(5):126–131. (In Russ.)

9. Bachilo IL. Information Law: Textbook for Universities. Moscow: Yurait Publishing House; 2026. 419 p. (In Russ.)

10. Kopenkin IO. The Increasing of Criminal Legal Responsibility for the Protection of Personal Data in Modern Conditions. Scientific Works of the Russian Academy of Advocacy and Notaries. 2024;(1(72)):152–154. (In Russ.)

11. Panchenko AV. Criminal Liability for Large-Scale Leaks of Personal Data: The Limits of Application of Article 137 of the Criminal Code of The Russian Federation in the Era of Big Data. Current Issues in Combating Crime. 2026;(1):50–56. (In Russ.)

12. Piskaikina VM. The Problem of Personal Data Protection in the Era of Digitalization. Russian Studies in Law and Politics. 2025;(9(2)):124–140. (In Russ.) https://doi.org/10.12731/2576-9634-2025-9-2-238

13. Gataev AA. Certain Issues of Criminal Liability for Violations of Legislation on Personal Data. In: Proceedings of the VI National in Absentia Scientific and Practical Conference “Current Problems of Law Enforcement and Management at the Current Stage of Development of Society”. Stavropol: Stavropol Publishing House “Paragraph”, LLC; 2024. P. 154–156. (In Russ.)

14. Zelenkina OYu. Specific Features of Investigating Crimes in the Sphere of Computer Information. Siberian Criminal Procedure and Criminalistic Readings. 2019;(2(24)):92–100. (In Russ.)

15. Romanenko DD, Shvets AV. Administrative and Criminal Penalties for Cybercrime: New Articles and Their Application. In: Proceedings of the VIII National Scientific and Practical Conference “Documentation Management in the Digital Environment”. Moscow: OOO "Sfera"; 2026. P. 461–464. (In Russ.)