Privacy International defends the right to privacy across the world, and fights surveillance and other intrusions into private life by governments and corporations. Read more »


I. Legal Framework

Constitutional privacy framework

The Constitution of the Russian Federation recognizes rights of privacy, data protection and secrecy of communications. Article 23 states, "1. Everyone shall have the right to privacy, to personal and family secrets, and to protection of one's honor and good name. 2. Everyone shall have the right to privacy of correspondence, telephone communications, mail, cables and other communications. Any restriction of this right shall be allowed only under an order of a court of law." Article 24 states, "1. It shall be forbidden to gather, store, use and disseminate information on the private life of any person without his/her consent. 2. The bodies of state authority and the bodies of local self-government and the officials thereof shall provide to each citizen access to any documents and materials directly affecting his/her rights and liberties unless otherwise stipulated under the law." Article 25 states, "The home shall be inviolable. No one shall have the right to enter the home against the will of persons residing in it except in cases stipulated by the federal law or under an order of a court of law."1

Data protection framework

In 2006, Russia adopted the Law on Personal Data, and the Law on Information, Information Technologies and Protection of Information, which replaced the 1995 Law of Information, Informatization and Protection of Information.2 Adoption of the Law on Personal Data fulfills Russia’s obligation to transpose the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data into national law.3 The Law on Personal Data generally protects personal data from being collected and processed illegally and without consent of data subject. However, the law is still far from ideal since it gives wide exemptions to the government. The Law on Personal Data came into force in January 2007, but most of its provisions are still inactive; for example, the law provides for the creation of a data protection authority, but none is operational to date.

Privacy regulator

Russian public organizations tried to change the Law on Personal Data to make its data protection agency an independent body much like it is in many European countries but the Law as passed established the data protection agency as a branch of the Ministry of Communications. As of May 2007, the data protection agency was still inactive.4

Statutory rules on privacy

The term "personal data" and some guarantees for personal data protection also appear in other laws, in particular, the Tax Code,5 the Labor Code6 and the federal Law on Statements of Civil Status. Also, confidentiality of information has been mentioned in various laws relevant to professional secrets.7

In Russia (especially in Moscow and St. Petersburg) illegal collection and distribution of data on private persons and organizations is commonplace. Quite popular are databases on purchase/sale of cars, car owners, passport data and foreign passport data of Russian citizens, data on real estate (purchase and sale of apartments, their parameters, location and proprietors), databases of taxpayers, and information about people wanted for crimes and those who have been previously convicted. Cheap CDs with such databases are easily available on the streets and the Internet.8 In autumn 2004, CDs appeared with detailed information about income of taxpayers.

Russian legislation provides criminal liability for the invasion of privacy. The Criminal Code provides a penalty for violation of the immunity of private life,9 violation of secrecy of communications,10 and infringement of home inviolability.11 The Criminal Code also provides liability for unauthorized access to legally protected computer information.12 The Criminal Code includes sentences such as fines, forced labor, arrest, a ban on the right to hold certain positions or to be engaged in a certain activity and, in some cases, imprisonment for a period of up to five years.13 The maximum fine is RUB 300,000 (8,640 EUR).14

According to the Civil Code, privacy is a legally protected non-property right.15 Attached to this right are personal dignity, personal immunity, honor and good name, business name, personal secret and family secret. If an individual suffers physical or moral damages by violation of his or her personal non-property rights or some other non-material welfare rights, as well as in other cases provided by the law, a court can force the person invading privacy to provide financial compensation.16 The Administrative Code states that "infringement of a legally established procedure of collection, storage, use or distribution of information about citizens (personal data)" shall lead to a warning or penalty.17 The Administrative Code also establishes liability for disclosure of information if access to it is restricted by federal law.18 The illegitimate refusal by a public official to submit information to a person is also an administrative breach of the law.19

Information Technologies

A special "Department K" within the Ministry of Internal Affairs and its branches in cities of Russia are responsible for investigation of crimes in a sphere of information technologies. The number of cybercrimes grows in Russia every year. In 2005 and in 2006 there were over 14,000 known cybercrimes in Russia (each year).20 Most cases relate to unauthorized access to computer systems and networks and the distribution of pirated software, though sometimes Department K deals with cases of breaches of privacy. In March 2005 the court condemned the criminals to fines from 50,000 to 93,000 rubles (about 1,440 – 2,680 EUR).

In October 2006, three young Russian hackers were convicted to 8 years of high security prison and a 100,000 RUB (2,880 EUR) fine after they gathered information about British online services and blackmailed their owners.21 In March 2007, the Financial Times wrote about a high-skilled group of Russian criminals that used phishing methods to cheat Internet users and steal money from banks. The gang's takings are reported to be over 110,167,000 EUR, and the criminals haven't been convicted yet.22