Legal Consequences of Disclosing Personal Data from an Official Petition

Introduction: Nature of the Violation

The disclosure of personal data obtained from an official petition by a citizen to state or local government bodies constitutes a gross violation of personal data legislation and official ethics. Such actions fall under several categories of offenses, as they not only affect general privacy protection norms but also special information processing regimes within the scope of governmental powers. Punishment of the guilty requires a comprehensive approach, combining administrative, disciplinary, civil-law, and, in some cases, criminal measures.

Legal Framework and Offense Classification

The main regulatory acts governing this area include:

Federal Law No. 152-FZ of July 27, 2006 "On Personal Data." Article 7 ("Confidentiality of Personal Data") explicitly prohibits the operator and other individuals from disclosing personal data without the consent of the subject.

Federal Law No. 59-FZ of May 2, 2006 "On the Procedure for Consideration of Citizens' Petitions in the Russian Federation." Article 6 establishes a ban on disclosing information contained in a petition, as well as information about the private life of the applicant, without their consent. Personal data indicated in a petition are subject to this protection.

Code of the Russian Federation on Administrative Offenses (KоАП РФ).

Criminal Code of the Russian Federation (UK РФ).

Labour Code of the Russian Federation (TК РФ) — if the offender is an employee of a state body.

Types of Responsibility and Procedure for Attraction

1. Administrative Responsibility
The most likely and widespread form of punishment. Regulated by Chapter 13 of the KоАП РФ "Administrative Offenses in the Field of Telecommunications and Information."

Article 13.11 of the KоАП РФ "Violation of Personal Data Legislation."

Part 2: Processing personal data without the written consent of the subject where required, results in a fine. In the context of petitions, consent for processing is implied for the purpose of consideration but not for disclosure to third parties.

Punishment: For officials — a fine from 30,000 to 50,000 rubles; for legal entities — from 150,000 to 250,000 rubles. For repeated violations, fines increase (Article 9, Part 13.11 of the KоАП РФ).

Article 13.14 of the KоАП РФ "Disclosing Information with Limited Access."

Although personal data are not state secrets in themselves, their confidential status established by law allows for qualification under this article, especially if the information became known due to official or professional activities.

Punishment: A fine for individuals from 500 to 1,000 rubles, for officials from 4,000 to 5,000 rubles.

The authority competent to consider cases: Roskomnadzor (Articles 23.1, 23.48 of the KоАП РФ). To initiate a case, it is necessary to file a complaint with the territorial body of Roskomnadzor, providing evidence of disclosure (screenshots, witness testimony, copies of petitions).

2. Disciplinary Responsibility
If the offender is a state or municipal employee, an employee of the operator organization.

Grounds: Violation of official duties, job description, internal regulations on the protection of personal data.

Measures: Reprimand, warning, dismissal on relevant grounds (Paragraph 6, Article 81 of the TК РФ — disclosure of protected information that became known due to the performance of labor duties).

Procedure: Initiated by the head of a state body based on the results of an official investigation, which may be initiated on the basis of a citizen's complaint.

3. Civil-Law Responsibility
The injured citizen is entitled to claim compensation for damage caused by the disclosure of their personal data (Article 24 of FZ-152 "On Personal Data").

What can be claimed:

Compensation for moral damage (Articles 151, 1099-1101 of the GК РФ). The amount is determined by the court taking into account the nature of the physical and moral suffering caused, the degree of the offender's guilt. To successfully recover, it is necessary to prove the fact of the violation and the infliction of moral suffering (for example, due to the dissemination of personal information, threats, calls, etc.).

Compensation for losses (actual damage and lost profits), if their amount can be proven (for example, expenses for changing a phone number, address, legal services).

Procedure: Filing a lawsuit with the district court of the place of residence or location of the respondent (state body that allowed the leak).

4. Criminal Responsibility
Arises in the most severe cases when disclosure has led to significant violations of the rights and legitimate interests.

Article 137 of the UK РФ "Violation of the Inviolability of Private Life."

Part 1: Unlawful collection or dissemination of information about a person's private life, constituting their personal or family secrets, without their consent. Information constituting a personal secret may include details set forth in the petition (about health, financial situation, family conflicts, etc.).

Part 2: The same act committed with the use of one's official position.

Punishment: Fine up to 300,000 rubles, mandatory/corrective labor, compulsory labor, arrest, or deprivation of liberty for several years with the deprivation of the right to hold certain positions.

Article 140 of the UK РФ "Refusal to Provide Information to a Citizen" (if disclosure was accompanied by concealment of facts creating a threat to life or health, but this is a special case).

Procedure: To initiate a criminal case, it is necessary to file a statement with the Investigative Committee of the Russian Federation or the police, providing all available evidence.

Algorithm of actions for the injured party
Recording the fact of disclosure. Gather evidence: screenshots of publications, correspondence, certified extracts, witness testimony, audio or video recordings.

Addressing the head of the state body. Submit a written complaint to the head of the body from which the leak occurred. Demand the conduct of an official investigation and the attraction of the guilty party to disciplinary responsibility.

Submitting a complaint to Roskomnadzor. This is a key step for attracting administrative responsibility. The complaint should contain a description of the situation and accompanying evidence.

Addressing law enforcement agencies. If there are signs of a criminal offense (for example, dissemination of information about private life, resulting in severe consequences) — a statement to the Investigative Committee of the Russian Federation.

Addressing the court. For the recovery of moral damage and losses. The lawsuit may be filed against a specific official (if it is established) or against the state body as the operator of personal data.

Example from Judicial Practice

The decision of the Moscow City Court in Case No. 33-**** (2022) upheld the decision of the district court to award compensation for moral damage in the amount of 50,000 rubles to a citizen in favor of a state institution, whose personal data (name, address, essence of the complaint about neighbors) were unlawfully published by an institution employee in a public chat of a messenger during a discussion of an official issue. The court qualified the actions as a violation of Article 7 of FZ-152 and Article 24 of the Constitution of the Russian Federation, indicating that consent for data processing for the purpose of consideration is not consent for their public dissemination.

Conclusion

The disclosure of personal data from a petition to a state body is a serious offense that violates the constitutional right to the inviolability of private life and undermines trust in authority. The mechanism for protection and attracting to responsibility is multilevel and requires an active position from the injured party in collecting evidence and sequentially addressing all controlling and rights protection authorities. The effectiveness of punishment directly depends on the correct qualification of the offense and the choice of appropriate means of legal protection.
© elib.ng

Permanent link to this publication: