The article addresses a subject of acute contemporary significance: the criminal law protection of personal data under conditions of an emerging data economy.

The research hypothesis advanced by the authors posits that, while the enactment of Article 2721 of the Criminal Code of the Russian Federation represents a qualitatively new stage in the evolution of criminal law protection of personal data, the legislative construction of this norm contains substantial conceptual and technical deficiencies that impede effective law enforcement and require systematic legislative correction. The stated aim of the study – to determine the mechanism of criminal law protection of personal data in a data economy, assess the effectiveness of the new legislative instrument, and formulate proposals for its improvement – is declared as fully achieved by the authors.

The methodological framework of the study integrates general scientific methods – dialectical, systemic-structural, formal-logical, analytical and synthetic approaches – with specialised legal methods, including comparative law, formal dogmatic analysis and statutory interpretation.

The principal results of the research are structured across several interrelated dimensions. First, the authors examine the legal nature of personal data as the subject matter of criminal offences, demonstrating that, within the data economy paradigm, personal information acquires characteristics fundamentally distinguishing it from traditional objects of legal protection: it may be reproduced, aggregated and enriched without apparent detriment to the original subject, which substantially complicates the criminal qualification of unlawful acts. Second, the paper provides a systematic analysis of the corpus delicti under Article 2721, identifying the constituent elements of its subject matter – computer information, the personal data content thereof, and the illegal origin of such information – as a tripartite construct that is unique within Russian criminal law and demands careful doctrinal elaboration. Third, the authors critically examine the legislative placement of Article 2721 within Chapter 28 of the Criminal Code (crimes in the sphere of computer information), arguing that the primary object of the offence is not computer security but rather the constitutional right of the individual to privacy, personal and family secrecy as guaranteed by Article 23 of the Constitution of the Russian Federation, thereby supporting the position that normative placement within Chapter 19 would be more doctrinally coherent. Fourth, the study conducts a rigorous analysis of qualification problems arising from competition between Article 2721 and related criminal law provisions, including Articles 137, 183, 272 and 2741 of the Criminal Code, proposing specific rules for resolving such conflicts in practice.

The authors propose a normative clarification of the concept of “illegal acquisition” of personal data by way of a cross-reference to the grounds established by Federal Law No. 152-FZ on Personal Data; and the introduction of an immunity provision within the footnotes to Article 2721 for persons who voluntarily disclose unlawfully obtained data arrays, modelled on analogous incentive norms elsewhere in the Criminal Code.