Application of a risk-based approach to criminal law security of biometric personal data

Abstract

Objective. This article explores the potential for a risk-based approach to the criminal law protection of biometric personal data. It examines the theoretical prerequisites for a transition from a tort-centric model of criminal protection of assets based on risk management, analyzes criteria for differentiating criminal liability depending on the degree of public danger posed by acts related to the circulation of biometric information, and draws on international and industry experience in risk-based regulation of digital technologies. Particular attention is paid to the criminal law prohibition enshrined in Article 2721 of the Criminal Code of the Russian Federation, which largely embodies the author's proposed logic of a differentiated, risk-based response to attacks related to the illegal circulation of personal data, including biometric data. Conclusions. Based on the study's results, criteria for assessing criminal law risk in the field of biometrics are proposed, and an assessment is made of the extent to which the new regulation addresses previously identified gaps and what areas for legislative improvement remain relevant.