Confidentiality of Personal Data in Case of Cyberthreats

Abstract

Despite the presence of the current legal regulation of personal data and their circulation on the Internet, Russia has recently become one of the leaders in personal data leaks. It turns out that the right to confidentiality and the right to protection of personal data are not implemented in the digital environment due to the susceptibility to cyberattacks and the lack of appropriate measures and guarantees in this field. The Russian legislator establishes the obligations of the operator of personal data, including the obligation of the operator to notify the authorized body of the leakage of personal data, as well as administrative, criminal and civil liability for their disclosure. However, there are no effective mechanisms that would prevent leaks and other disclosure of personal data in a preventive manner and would allow full compensation for the damage caused to individuals. The legal doctrine proposes to strengthen the penalties for violations in the field of personal data and specify the possibility of compensation for moral damage to a person who has suffered from a leak. The author’s approach is to provide for the need to check the operator’s activities for violations that led to the leakage of personal data (post-control), as well as to introduce a compliance system that allows preventive prevention of leakages and other violations in the field of personal data (a priori control), and train employees to minimize the risks of disclosure and other illegal use of personal data.