Maxim Ali told Izvestia how to get compensation for personal data leakage

The Zamoskvoretsky District Court has registered the first claim against Yandex.Food in connection with the recent leak of personal data of its users.

Maxim Ali, Head of IP/IT practice at Maxima Legal, specifically for Izvestia evaluated the prospects of such cases and the chances of obtaining financial compensation from the company.

In the case where personal data is made public the data subject has two civil law remedies to defend their rights in court – compensation for damages or compensation for moral damage.

According to Maxim, the first option makes no sense in practice. This is due to the fact that in Russian courts it is very difficult to prove damages even in the most obvious situations, because first of all one has to confirm at least their approximate amount, which is practically impossible to do in the case of personal data leakage. The expert also noted that this is not the only problem.

“Let’s take the seemingly understandable situation where, after a leak, a specific amount has been debited from your card. What can you stumble on? Some of the data the intruders can take from public sources, such as name and place of work from social networks. Then the operator will argue that there is no direct causal link between the leakage and the loss. It is also not uncommon for fraudsters to resort to “social engineering”: swiping a code from a text message over the phone, giving details of you that have leaked onto the web. And here the court will also side with the operator because it will consider that you are guilty of disclosing confidential data”, explained Maxim Ali.

Analyzing the option of compensation for moral damage, the expert stressed that the law and judicial practice have no criteria for determining its amount, so this question will be decided in each specific situation. As examples, he cited the case of 2016, when the Moscow City Court awarded compensation in the amount of 1 thousand rubles for circulating a photo in a swimming costume with insulting comments, as well as the case of 2019, in which 1 thousand rubles was awarded as a result of calls demanding payment of a non-existent debt.

“So even with good evidence, it will be more like tens, at most a couple of hundred thousand roubles. And you certainly shouldn’t expect millions of dollars in compensation. They are usually recovered for causing death. You might end up paying as much or more for a lawyer than you would have received from the infringer in a data protection dispute. Reimbursement of court costs will not help much, as courts often reduce compensation below the price range of the legal market,” Maxim warned.

Maxim Ali also drew attention to the fact that work is already under way to amend the CAO and introduce fines for data leaks. In particular, we are talking about increasing the amounts of fines themselves to hundreds of thousands of rubles, and about turnover fines in the form of a percentage of the company’s revenue.

However, according to the expert, “until courts reconsider their approach to protection of personal data subjects or until Russia establishes an adequate institution of class action lawsuits, we should not expect operators to be very afraid of lawsuits from users”.

To read the full article (in Russian) please visit Izvestia website >>>