Legal Consequences of Disclosing Personal Data from an Official Request

Introduction: Nature of the Violation

Disclosing personal data obtained from an official request of a citizen to state or local government agencies constitutes a serious violation of personal data legislation and official ethics. Such actions fall under several offenses due to their impact not only on general privacy protection norms but also on special regimes of information processing within the scope of state authority. Punishment of the guilty party requires a comprehensive approach, combining administrative, disciplinary, civil-law, and, in some cases, criminal measures.

Normative Base and Offense Qualification

The main regulatory acts governing this area include:

Federal Law No. 152-FZ of July 27, 2006 “On Personal Data.” Article 7 (“Confidentiality of Personal Data”) explicitly prohibits the operator and other individuals from disclosing personal data without the consent of the subject.

Federal Law No. 59-FZ of May 2, 2006 “On the Procedure for Considering Citizens' Requests in the Russian Federation.” Article 6 establishes a ban on disclosing information contained in the request as well as information about the private life of the applicant without their consent. Personal data indicated in the request are subject to this protection.

Code of the Russian Federation on Administrative Offenses (KоАП РФ).

Criminal Code of the Russian Federation (УК РФ).

Labor Code of the Russian Federation (TК РФ) — if the discloser is an employee of a state agency.

Types of Liability and Procedure for Attraction

1. Administrative Liability
The most likely and widespread form of punishment. Regulated by Chapter 13 of the KоАП РФ “Administrative Offenses in the Field of Telecommunications and Information.”

Article 13.11 of the KоАП РФ “Violation of Personal Data Legislation.”

Part 2: Processing personal data without written consent of the subject where required, results in a fine. In the context of requests, consent for processing is implied for the purpose of consideration, but not for disclosure to third parties.

Punishment: For officials — a fine from 30,000 to 50,000 rubles; for legal entities — from 150,000 to 250,000 rubles. For repeated violations, fines increase (Part 9 of Article 13.11 of the KоАП РФ).

Article 13.14 of the KоАП РФ “Disclosure of Information with Limited Access.”

Although personal data are not state secrets in themselves, their confidential status established by law allows for qualification under this article, especially if the information became known due to official or professional activities.

Punishment: A fine for individuals from 500 to 1,000 rubles, for officials from 4,000 to 5,000 rubles.

The authorized body to consider cases: Roskomnadzor (Articles 23.1, 23.48 of the KоАП РФ). To initiate a case, it is necessary to file a complaint with the territorial management of Roskomnadzor, providing evidence of disclosure (screenshots, testimonial evidence, copies of requests).

2. Disciplinary Liability
If the culprit is a state or municipal employee, an employee of the operator organization.

Basis: Violation of official duties, job description, internal regulations for the protection of personal data.

Measures: Reprimand, warning, dismissal on relevant grounds (Paragraph 6 of Article 81 of the TК РФ — disclosure of protected information that became known due to the performance of labor duties).

Procedure: Initiated by the head of a state agency based on the results of an official investigation, which may be initiated on the basis of a citizen's complaint.

3. Civil-Law Liability
The victim has the right to claim compensation for damage caused by the disclosure of their personal data (Article 24 of the FZ-152 “On Personal Data”).

What can be claimed:

Compensation for moral damage (Articles 151, 1099-1101 of the GК РФ). The amount is determined by the court taking into account the nature of the physical and moral suffering caused, the degree of guilt of the violator. Successful enforcement requires proving the fact of violation and the infliction of moral suffering (for example, due to the dissemination of personal information, threats, calls, etc.).

Compensation for losses (actual damage and lost profits), if their amount can be proven (for example, costs for changing the phone number, address, legal services).

Procedure: Filing a lawsuit with the district court of the place of residence or location of the respondent (state agency that allowed the leak).

4. Criminal Liability
It occurs in the most severe cases when disclosure has led to a significant violation of the rights and legitimate interests.

Article 137 of the Criminal Code of the Russian Federation “Violation of the Inviolability of Private Life.”

Part 1: Unlawful collection or dissemination of information about the private life of a person constituting their personal or family secret without their consent. Information constituting personal secrets may include details set forth in the request (about health, financial situation, family conflicts, etc.).

Part 2: The same act committed with the use of one's official position.

Punishment: Fine up to 300,000 rubles, mandatory/corrective labor, compulsory labor, arrest, or imprisonment for several years with the deprivation of the right to hold certain positions.

Article 140 of the Criminal Code of the Russian Federation “Refusal to Provide Information to a Citizen” (if disclosure was accompanied by concealment of facts creating a threat to life or health, but this is a special case).

Procedure: To initiate a criminal case, it is necessary to file a statement with the Investigative Committee of the Russian Federation or the police, providing all available evidence.

Algorithm of actions for the victim
Fixation of the fact of disclosure. Gather evidence: screenshots of publications, correspondence, authenticated extracts, testimonial evidence, audio or video recordings.

Appeal to the head of a state agency. Submit a written complaint to the head of the agency from which the leak occurred. Demand an official investigation and the attraction of the guilty party to disciplinary liability.

Submitting a complaint to Roskomnadzor. This is a key step for attracting administrative liability. The complaint should contain a description of the situation and accompanying evidence.

Appeal to law enforcement agencies. In the presence of signs of a criminal offense (for example, dissemination of information about private life, resulting in severe consequences) — a statement to the Investigative Committee of the Russian Federation.

Appeal to the court. For the recovery of compensation for moral damage and losses. The lawsuit may be filed against a specific official (if it is established) or against a state agency as the operator of personal data.

Example from Judicial Practice

The decision of the Moscow City Court in Case No. 33-**** (2022) upheld the decision of the district court to award compensation for moral damage in the amount of 50,000 rubles to a citizen whose personal data (name, address, the essence of the complaint about neighbors) were illegally published by an employee of the institution in a public chat of a messenger during a discussion of an official issue. The court qualified the actions as a violation of Article 7 of the FZ-152 and Article 24 of the Constitution of the Russian Federation, indicating that consent for the processing of data for the purpose of consideration is not consent for their public dissemination.

Conclusion

Disclosing personal data from an official request to a state agency is a serious offense violating the constitutional right to the inviolability of private life and undermining trust in authority. The mechanism of protection and attraction to liability is multilevel and requires an active position from the victim in collecting evidence and sequentially addressing all controlling and protective institutions. The effectiveness of punishment directly depends on the correct qualification of the offense and the choice of appropriate means of legal protection.
© library.tz

Permanent link to this publication: