Maxim Ali helped RBC understand the potential penalties for doxing

Maxim Ali - Partner

Doxing is the publication of personal information about a person without their consent for the purpose of harassment, blackmail or profit.

The term is derived from the English derivative dox (a variant spelling of the word docs); the person who commits doxing is called a doxer. The information published by the perpetrator may include a person’s home address, place of work, financial and medical information, private photos and videos, statements made on social networks many years ago, and fragments of personal correspondence.

Russian law does not distinguish doxing as a separate phenomenon. However, the law regulates related actions and envisions serious consequences for the offender – up to and including criminal articles.

Maxim Ali, Partner and Head of IP/IT practice at Maxima Legal, told RBC that in any case the disclosure of confidential information, such as personal data, commercial or official secrets, may lead to responsibility. According to the expert, a typical criminal article for doxing may be Article 137 of Criminal Code of the Russian Federation providing for up to two years of imprisonment for illegal collection or dissemination of private information. In addition, Maxim noted that extortion under the threat of doxing (Article 163 of the Criminal Code), as well as hacking of computer infrastructure to obtain information (Article 272 of the Criminal Code) would also be considered a crime.

The more complicated case includes the collection of open data. “For example, which the user himself has posted. But if something is in the public domain, it is not a fact that you have the right to use it. This is as true for intellectual property as it is for personal data. You can get an administrative fine for distributing other people’s data from the same social networks. However, the fines in this area are designed for legal entities – they sometimes amount to hundreds of thousands of roubles. But if we talk about “individuals”, even for repeated distribution of the most sensitive data, the maximum fine is only 20 thousand roubles, so such offenders may only be stimulated by criminal liability,” Maxim Ali explained. At the same time, Maxima Legal expert pointed out that there is a trend of increasing fines for unlawful processing of personal data, while the number of cases either does not increase or sometimes even decreases.

Another possible case of law violation when publishing open data is the use of photos. However, as Maxim explained, the few exceptions that allow this (e.g. publicly significant purposes) will not suit doxers, and the injured party has the possibility of claiming compensation for moral damage from the doxer.

“If you look at the business specifics, some cases of doxing may well turn out to be unfair competition. Then the case may be taken up by the Federal Antimonopoly Service of the Russian Federation, which has a right to issue an injunction to the infringer, fine it half a million rubles and pave the way for an injured competitor to claim lost profit in court,” also stressed Maxima Ali. 

To read the full article (in Russian) please visit RBC website >>>