Criminal law protection of personal data in a data economy

The article addresses a subject of acute contemporary significance: the criminal law protection of personal data under conditions of an emerging data economy.

The research hypothesis advanced by the authors posits that, while the enactment of Article 272¹ of the Criminal Code of the Russian Federation represents a qualitatively new stage in the evolution of criminal law protection of personal data, the legislative construction of this norm contains substantial conceptual and technical deficiencies that impede effective law enforcement and require systematic legislative correction. The stated aim of the study – to determine the mechanism of criminal law protection of personal data in a data economy, assess the effectiveness of the new legislative instrument, and formulate proposals for its improvement – is declared as fully achieved by the authors.

The methodological framework of the study integrates general scientific methods – dialectical, systemic-structural, formal-logical, analytical and synthetic approaches – with specialised legal methods, including comparative law, formal dogmatic analysis and statutory interpretation.

The principal results of the research are structured across several interrelated dimensions. First, the authors examine the legal nature of personal data as the subject matter of criminal offences, demonstrating that, within the data economy paradigm, personal information acquires characteristics fundamentally distinguishing it from traditional objects of legal protection: it may be reproduced, aggregated and enriched without apparent detriment to the original subject, which substantially complicates the criminal qualification of unlawful acts. Second, the paper provides a systematic analysis of the corpus delicti under Article 2721, identifying the constituent elements of its subject matter – computer information, the personal data content thereof, and the illegal origin of such information – as a tripartite construct that is unique within Russian criminal law and demands careful doctrinal elaboration. Third, the authors critically examine the legislative placement of Article 2721 within Chapter 28 of the Criminal Code (crimes in the sphere of computer information), arguing that the primary object of the offence is not computer security but rather the constitutional right of the individual to privacy, personal and family secrecy as guaranteed by Article 23 of the Constitution of the Russian Federation, thereby supporting the position that normative placement within Chapter 19 would be more doctrinally coherent. Fourth, the study conducts a rigorous analysis of qualification problems arising from competition between Article 2721 and related criminal law provisions, including Articles 137, 183, 272 and 2741 of the Criminal Code, proposing specific rules for resolving such conflicts in practice.

The authors propose a normative clarification of the concept of “illegal acquisition” of personal data by way of a cross-reference to the grounds established by Federal Law No. 152-FZ on Personal Data; and the introduction of an immunity provision within the footnotes to Article 272¹ for persons who voluntarily disclose unlawfully obtained data arrays, modelled on analogous incentive norms elsewhere in the Criminal Code.

1. Afanasev S.D., Chikhladze L.T. Legal regulation of big data: modern problems in the context of the formation of the data economy. Zakon i pravo = Law & Legislation, 2024, no. 2, pp. 37–42. DOI: 10.24412/2073-3313-2024-2-37-42. (In Russ.).

2. Begishev I.R., Kirpichnikov D.V. Problems of personal data protection in criminal law. Ugolovnaya yustitsiya = Russian Journal of Criminal Law, 2020, no. 15, pp. 11–16. DOI: 10.17223/23088451/15/3. (In Russ.).

3. Shutova A.A. Social conditionality rules on the existence of criminal liability for the infringement of personal data. Yuridicheskaya nauka i praktika: Vestnik Nizhegorodskoi akademii MVD Rossii = Legal science and practice: Journal of Nizhny Novgorod Academy of the Ministry of Internal Affairs of Russia, 2015, no. 4 (32), pp. 332–335. (In Russ.).

4. Prosvetova O.B. Personal data protection, Cand. Diss. Thesis. Voronezh, 2005. 22 p. (In Russ.).

5. Belgorodtseva N.G. Theoretical and legal aspects of personal data protection, Cand. Diss. Thesis. Moscow, 2012. 25 p. (In Russ.).

6. Khokhlova E.V. Illegal actions with personal data: criminal law research, Cand. Diss. Belgorod, 2024. 255 p. (In Russ.).

7. Akinina N.Yu., Anisimov V.F., Kochupalov R.V. Criminalization of personal data illegal trade. Vestnik Sur gutskogo gosudarstvennogo universiteta = Surgut State University Journal, 2024, vol. 12, no. 3, pp. 84–91. DOI: 10.35266/2949-3455-2024-3-8. (In Russ.).

8. Shchepelkov V.F. Criminal liability for illegal personal data trafficking (Article 272.1 of the Criminal Code of the Russian Federation). Vestnik Volgogradskoi akademii MVD Rossii = Journal of the Volgograd Academy of the Ministry of the Interior of Russia, 2025, no. 3 (74), pp. 35–42. (In Russ.).

9. Styazhkina S.A. Issues of qualification of illegal trafficking of personal data. Vestnik Udmurtskogo universi teta. Seriya Ekonomika i pravo = Bulletin of Udmurt University. Series Economics and Law, 2025, vol. 35, no. 5, pp. 945–952. DOI: 10.35634/2412-9593-2025-35-5-945-952. (In Russ.).

10. Esakov G.A. Illegal circulation of personal data (Art. 272.1 of the Criminal code of the Russian Federation). Ugolovnoe pravo, 2025, no. 11 (183), pp. 10–17. (In Russ.).

11. Chukreev V.A. Personal biometric data as subjects of criminal law protection. Vestnik Universiteta imeni O.E. Kutafina (MGYuA) = Courier of Kutafin Moscow State Law University (MSAL), 2022, no. 3, pp. 107–116. DOI: 10.17803/2311-5998.2022.91.3.107-116. (In Russ.).

12. Volkova A.V. Social conditionality of criminalization of illegal actions with computer information containing personal data. Problemy prava = Issues of law, 2025, no. 4 (100), pp. 86–95. (In Russ.).

13. Knyazkov A.A. Criminal law novel for violation of the legislation on personal data (Art. 2721 of the Criminal Code of Russia): design features of the composition and qualification issues. Vestnik Universiteta imeni O.E. Kutafina (MGYuA) = Courier of Kutafin Moscow State Law University (MSAL), 2025, no. 5, pp. 65–73. DOI: 10.17803/2311-5998.2025.129.5.065-073. (In Russ.).

14. Russkevich E.A. On criminal liability for illegal actions with computer information containing personal data. Ugolovnyi protsess, 2025, no. 7 (247), pp. 53–59. (In Russ.).

15. Alikhadzhiyeva I.S. Self-serving digital crime with personal data, in: Problemy pravookhranitel'noi deyatel'nosti na sovremennom etape, Proceedings of the IV All-Russian (with international participation) scientific and practical conference (Kostroma, April 24–25, 2025), Kostroma, Kostroma State University Publ., 2025, pp. 167 173. (In Russ.).

16. Alikhadzhiyeva I.S. Transforming identity crime. Vestnik Prikamskogo sotsial'nogo instituta = Bulletin of Prikamsky Social Institute, 2025, no. 2 (101), pp. 6–12. (In Russ.).

17. Alikhadzhiyev I.S. Private Life, Personal Secret or Personal Data: How to Interpret Information about the Person to the Law Enforcement Officer?. Izvestiya Yugo-Zapadnogo gosudarstvennogo universiteta. Seriya: Istoriya i pravo = Proceedings of Southwest State University. Series: History and Law, 2023, vol. 13, no. 3, pp. 90–101. DOI: 10.21869/2223-1501-2023-13-3-90-101. (In Russ.).

18. Alikhadzhiyev I.S. Private Life, Personal Secret or Personal Data: How to Interpret Information about the Person to the Law Enforcement Officer?. Izvestiya Yugo-Zapadnogo gosudarstvennogo universiteta. Seriya: Istoriya i pravo = Proceedings of Southwest State University. Series: History and Law, 2024, vol. 14, no. 2, pp. 91–106. DOI: 10.21869/2223-1501-2024-14-2-91-106. (In Russ.).

19. Phuoc Thinh Tran, Khanh Truong Duong, Staroverova O.V., Leonova O.A. Data economy: barriers, problems, and solutions. Ekonomika i upravlenie: problemy, resheniya, 2025, no. 5 (158), vol. 9, pp. 142–155. DOI: 10.36871/ek.up.p.r.2025.05.09.017. (In Russ.).

20. Alikhajieva I.S. Bill № 502113-8 «On amending the Criminal Code of the Russian Federation (in the part of establishing responsibility for illegal use and transfer, collection and storage of computer information containing per sonal data)»: scientific comment. Ugolovnoe pravo: strategiya razvitiya v XXI veke, 2024, no. 2, pp. 213–222. (In Russ.).

21. Shutova A.A. Novelties in Russian criminal law on liability for personal data breaches. Uchenye zapiski Ka zanskogo universiteta. Seriya Gumanitarnye nauki = Kazan Journal of Historical, Linguistic, and Legal Research, 2024, vol. 166, no. 6, pp. 122–134. DOI: 10.26907/2541-7738.2024.6.122-134. (In Russ.).

22. Shkhagapsoev Z.L. On the issue of criminal liability for illegal actions with computer information containing personal data. Yuridicheskii vestnik Dagestanskogo gosudarstvennogo universiteta = Law herald of Dagestan State University, 2025, vol. 54, no. 2, pp. 150–155. DOI: 10.21779/2224-0241-2025-54-2-150-155. (In Russ.).