CAO case law 2022-2025

732

Privacy Advocates sample

01.2022-05.2025

publicly available court rulings directly or indirectly tied to PD and Arts. 13.11, 13.12 CAO

Not counted

appeals against refusals to open a case, administrative suits and civil disputes

Final instance

if a case went through several instances, the final result is counted

Authority pairs

prosecutors and the FSB, prosecutors and RKN, Interior Ministry and RKN, Interior Ministry and prosecutors: the first usually runs the preliminary check or records the breach, the second opens and investigates

A finding is not a fine

a fine is replaced with a warning (Art. 4.1.1 CAO) or liability is waived for insignificance (Art. 2.9 CAO)

Update: practice on the same parts for 06.2025-10.2026 and 2026 statistics: last two slides of the subsection; post-420-FZ sanctions and 2025 trends: Section 30

• Part and violation
• Cases
• Moscow
• Ent./ST / Off. / Ind.
• RKN / Prosecutor
• Warnings
• Acquittals

• Art. 13.11(1)-(1.1): no basis for processing
• 475
• 230
• 305 / 106 / 47
• 359 / 116
• 51
• 64

• (2)-(2.1): no written consent
• 94
• 47
• 70 / 19 / 5
• 68 / 26
• 2
• 17

• (3): policy not published
• 11
• 3
• 2 / 8 / 5
• 4 / 7
• -
• 2

• (4): subject not told about processing
• 27
• 14
• 15 / 9 / 3
• 22 / 5
• 6
• 4

• (5)-(5.1): subject's demand not met
• 42
• 19
• 21 / 9 / 12
• 42 / -
• 6
• 8

• (6): access to paper-based PD
• 11
• 4
• 5 / 6 / -
• 9 / 2
• -
• 1

• (8)-(9): no database in Russia
• 65
• 63
• 57 / 7 / 1
• 65 / -
• -
• 6

• Art. 13.12(2): uncertified security tools
• 2
• -
• 1 / 1 / -
• FSB 2
• -
• 1

• Art. 13.12(6): protection rules
• 5
• 1
• 2 / 5 / -
• FSB 3 / 2
• -
• 2

(1)-(1.1), 475 cases

a frequent trigger is citizens' complaints about companies and authorities. Courts accept leaks in Telegram and on websites as sufficient grounds, unlike complaints without evidence. Checks on high-level orders, e.g. a deputy prime minister's, are prioritised and end in reports. Of 106 penalised officials, 9 were DPOs

(2)-(2.1), 94 cases

employee PD leaks are also classed under this offence. Roskomnadzor regularly refuses to open cases under Art. 24.5(1)(1) or (2) of the CAO: no event or no offence. Of 19 penalised officials, 2 were DPOs

(3), 11 cases

most cases start with a complaint, about 40% end in a refusal to open a case. A consumer credit cooperative was fined: the published policy named another website

(4), 27 cases

complaints of no reply; in 40-50% of cases refusal to open on formal grounds: no proof of the request or a formal reply was given. An employer was fined for not answering a former employee, citing internal regulations the employee had signed

(5)-(5.1), 42 cases

complaints of ignored demands to correct or delete PD. Courts often find the citizen's demand formally unproven, but a late or evasive operator reply is classed as a violation

Practice: outcomes under (3)-(5.1) turn on evidence of the subject's request and operator's reply

Art. 13.11(6), 11 cases

Paper media

loss or improper storage of documents with PD

many violators: state institutions, schools, hospitals

no access control to personal files and registers

the violation surfaces after a complaint, leak or internal check

Art. 13.11(8)-(9), 65 cases

Databases outside Russia

usually online PD collection with no Russian database

most are foreign legal entities, some prosecuted repeatedly

cases open after Roskomnadzor's remote monitoring or refusal to follow its order

Art. 13.12 CAO, 7 cases

Only on FSB and prosecutor materials

(2), 2 cases: uncertified security tools, no FSTEC role as initiator or party

(6), 5 cases: all leak-related, unauthorised file access recorded in a supervisory act

no warnings, disqualifications or confiscations, no DPOs penalised

Art. 13.12 sanctions after 104-FZ: Section 30

Example, Art. 13.12(6): the regional FSB's "Cyber Shield" operation scanned public Google Drive links with ripgrep and found Vedomost_deti.zip with names and addresses of an after-school centre's pupils

• Part
• Pre-30.05.2025
• After
• Fine
• Warning
• Discontinued
• Other

• (1)-(1.1)
• 503
• 296
• 144
• 82
• 21
• 49

• (2)-(2.1)
• 47
• 20
• 9
• 4
• 5
• 2

• Part 3
• 11
• 13
• 7
• 6
• -
• -

• Part 4
• 28
• 24
• 12
• 2
• 4
• 6

• (5)-(5.1)
• 44
• 9
• 5
• 2
• -
• 2

• Part 6
• 11
• 3
• -
• 1
• -
• 2

• (8)-(9)
• 70
• 37
• 31
• -
• -
• 6

• (10)
• -
• 13
• 6
• 5
• 1
• 1

• (12)-(18)
• -
• 13
• 3
• 6
• 1
• 3

What changed after 30.05.2025

warnings under (1)-(1.1) rose from 8% to 28% of rulings

regions give 70% of (1)-(1.1) rulings against 47% before

under (10) on non-notification, prosecutors open over half the cases

leaks under (12)-(18): warning in 6 of 13 rulings; Comline, Orion Telecom, PKR Analytics cases: Section 30

in 2026 the picture reversed, see the next slide

Important: here every ruling of each instance counts, while the 2022-2025 sample counts a case by its last instance, so compare shares, not numbers

8 of 83

magistrates

rulings replaced the fine with a warning, 5 of them in prosecutor cases on municipal institutions

41 of 72

commercial courts

fine replaced with a warning at first instance in cases accepted before 01.01.2026

150 000 ₽

magistrates' median

fine under Art. 13.11(1) by magistrates

75 000 ₽

commercial courts' median

fine under Art. 13.11(1) in commercial courts

The commercial court window closed

from 30.05.2025 to 31.12.2025 commercial courts heard Art. 13.11 cases, and a warning was the usual outcome

Few leaks reach the courts

a practice review for January-August 2026 shows only 12 leak rulings under (12)-(17)

2025 trends

overall shares of warnings and offences for 2025: Section 30 "Liability"

A guide for new cases

Minimum fine, not a warning

before magistrates a realistic goal is the minimum fine, or a fine below the minimum where allowed