Judicial decrees were analyzed by the following criteria:

- The category (area of activity) of legal entities/operators engaged in personal data processing (hereinafter referred to as "Operators"), against which administrative actions have been taken.

- The types of administrative offenses and the liability for violating the requirements of the personal data legislation of the Russian Federation.

- The number of cases heard as a part of administrative legal proceedings in regard to violations of personal data processing, and the result of such hearings.

There's been a growing trend in the number of judicial decrees on taking administrative actions pursuant to Article 19.7 and Section 1, Article 19.5, of the Code of Administrative Offenses of the Russian Federation since 2008.

It should be noted that courts actively exercise the right to take administrative actions on the same instance of violation against both a legal entity and its official (12 such cases were discovered out of a total of 43 which were analyzed). Such joint and several penalties are prescribed by Article 2.1, Section 1, of the Code of Administrative Offenses of the Russian Federation: "Imposition of an administrative penalty on a legal entity shall not relieve the guilty individual of administrative liability for such offense, and taking administrative or criminal actions against an individual shall not relieve the legal entity of administrative liability for such offense."

The following entities are the "leaders" in the number of personal data violations discovered by Roskomnadzor in the course of exercising its powers: management companies and municipal (state) organizations rendering housing and utility services, insurance companies (mainly medical and social insurance), credit companies (banking institutions), recruitment agencies etc.

A significant number of discovered violations are related to corpus delicti prescribed by Article 19.7 of the Code of Administrative Offenses of the Russian Federation: "Failure to submit or untimely submission to a public authority (official) of data (information), submission of which is prescribed by the law and is necessary for such authority (official) to perform its lawful activities; as well as submission to a public authority (official) of such data in an incomplete or distorted form."

Operators' actions involving corpus delicti prescribed by Article 19.7 of the Code of Administrative Offenses of the Russian Federation can be divided into the following categories:

1) Failure to submit or untimely submission of a notice of personal data processing to Roskomnadzor (violation of Section 1, Article 22, of the Federal Law).

2) Failure to submit or untimely submission of a response to Roskomnadzor's request (violation of Section 4, Article 20, of the Federal Law).

3) Submission of incomplete or incorrect information on personal data processing to Roskomnadzor (violation of Section 3, Article 22, of the Federal Law).

4) Failure to submit information on changing of data contained in the notice (violation of Section 7, Article 22, of the Federal Law).

In most cases, upon hearing the cases based on Roskomnadzor's materials, the court decided to impose a fine on Operators.

At the same time, the law enforcement practice includes three regulations on refusing to take administrative actions due to expiration of the statute of limitations established by Section 1, Article 4.5, of the Code of Administrative Offenses of the Russian Federation. Time limits for holding an individual/entity liable for certain offenses are related to the time of incurrence of liability for submitting information (for example, pursuant to Section 7, Article 22, of the Federal Law, the time limit is within 10 days from the date of change of information contained in the notice of personal data processing). Therefore, a time limit for holding an individual/entity liable for an administrative offense is calculated from the end date of the time limit of incurrence of liability (for example, 2 months and 10 days from the date of change of information contained in the notice of personal data processing).

Operators are not held liable for violations pursuant to Article 19.5 of the Code of Administrative Offenses of the Russian as often as for those pursuant to Article 19.7 of the Code of Administrative Offenses of the Russian Federation. The number of such judicial decrees is much less than that of decrees based on Article 19.7 of the Code of Administrative Offenses of the Russian Federation. In general, when deciding on taking administrative actions pursuant to Article 19.5 of the Code of Administrative Offenses of the Russian Federation, the first instance court presumes the legitimacy of orders issued by Roskomnadzor.

The analysis of information on violations interfering with the rights of personal data subjects reveals the following important facts:

1) There are a big number of judicial decrees related to cooperation between organizations, which have signed agreements with individuals on rendering housing and utility services, and organizations, which arrange for payments and penalties on such agreements. The court is not unanimous on the procedure of personal data processing, when functions of arranging for individuals' payments for rendered housing and utility services are delegated to a third party.

2) Some judicial decrees reveal contradictory legal regulation of personal data transfer at the municipal and city level. Municipal (city) regulatory acts were discovered which except any use (including transfer) of citizens' databases from the operation of the Federal Law.

Most administrative offense reports were issued as a result of unscheduled inspections based on applicants' complaints/appeals. With only a few exceptions, such inspections were carried out prior to the adoption of the Federal Law No. 294-FZ of December 26, 2008, On Protection of the Rights of Legal Entities and Individual Entrepreneurs in the course of State and Municipal Control (Supervision).

Most judicial decrees were issued in the Samara Region (10) and the Republic of Bashkortostan (8).