Compensation for damages caused by the violation of information security

In the context of the digitalization of society and the development of the information sphere, information relations arise, change and cease in the information sphere and are regulated by law. As a reflection of legal norms, they determine their main features. They are characterized by the primacy of legal norms, as information relations are the result of the regulatory action of the relevant information law on public relations. That is why such social relations acquire a legal form, i.e. become legal. At the same time, the information law norm regulates the behavior of the parties to public relations. It provides correspondence of mutual obligations and rights of the subjects - participants of these relations, as well as their legal responsibility for behavior that does not fit into the framework established by law [2, p. 151].

According to the Law of Ukraine “On Information”, the term “information” is conveyed as “any information and/or data that may be stored on physical media or displayed in electronic form” [3]. Information has certain properties, in particular, value, reliability, relevance.

From the standpoint of information security, the following properties of information can be distinguished: confidentiality (namely, information cannot be obtained by an unauthorized user); integrity (it means the impossibility of modification by an unauthorized user); availability (the ability to be obtained by an authorized user, if he has the appropriate authority, at any time).

Information security (in the context of direct information protection activities) can be considered a set of measures aimed at ensuring the protection of information from unauthorized access, use, disclosure, destruction, modification, access, verification, recording, or destruction of data.

Information security by scope can be considered in the context of security of the state, organization, and individual. Let's focus on the essence of information security of the organization and the individual.

Instead, the information security of an individual is characterized as a state of his direct protection from negative information effects, as well as effects on his ability to search for, collect, process, and use information. Information security of the individual also provides for the appropriate protection of various social groups and associations of people to which it belongs [4, p. 18].

As of today, the basic legal framework for the prevention and cessation of offenses in the information sphere is almost formed; it provides for civil, disciplinary (including tangible), administrative, and criminal liability for offenses and crimes in the information sphere, bylaws in the information sphere. However, their practical application is rather weak: there are no specific mechanisms for applying and complying with the law in practice, there are difficulties in imposing penalties for violating it, there is no systematization of law enforcement actions to exercise their responsibilities and rights in the information sphere.

The main provisions of information legislation are available in the Constitution of Ukraine [5], laws “On Information” [3], “On Personal Data Protection” [6], where data on individuals (personal data) are considered as information or a set of information on individuals, a person who is identified or can be specifically identified, classified as restricted (confidential).

In our opinion, when determining the specifics of compensation for damage caused by information security violations, it is important to pay attention directly to specific violations.

In particular, potential threats to information relations (relations concerning the collection, processing, and accumulation of information) and ways of their implementation are reflected in the relevant State Standard, according to which threats can be posed by: 1) technical channels, including channels of electromagnetic radiation and interference, radio, chemical and other channels; 2) channels of special influence forming fields and signals in order to destroy the protection system or violate the integrity of information; 3) unauthorized access - by connecting to equipment and communication lines, disguised as a registered user, overcoming protection measures for the use of information or imposing false information, the use of embedded devices or programs and the introduction of computer viruses [7].

It should also be noted that in order to protect the information in the system, the Resolution of the Cabinet of Ministers of Ukraine creates a comprehensive system of information protection, which is designed to protect information from: 1) leakage of technical channels, which include channels of spurious electromagnetic radiation and guidance, formed under the influence of physical processes during the operation of information processing facilities, other technical means, and communications; 2) unauthorized actions with information, including the use of computer viruses; 3) special influence on the means of information processing, which is carried out by the formation of physical fields and signals and can lead to a violation of its integrity and unauthorized blocking [8].

Violations of information security are set out in more detail in the Criminal Code of Ukraine. In particular, criminal liability has been established for: unauthorized interference in the work of electronic computers (computer), automated systems, computer networks or telecommunication networks (Article 361); creation for the purpose of use, distribution or sale of malicious software or hardware, as well as their distribution or sale (Article 361-1); unauthorized sale or dissemination of information with limited access, which is stored in computers (computer), automated systems, computer networks or on such media (Article 361-2); unauthorized actions with information processed in electronic computers (computer), automated systems, computer networks or stored on the media of such information, committed by a person who has the right to access it (Article 362); violation of the rules of operation of electronic computers (computers), automated systems, computer networks or telecommunication networks or the order or rules of protection of information processed in them (Article 363); interfering with the work of electronic computers (computer), automated systems, computer networks or telecommunication networks by mass dissemination of telecommunication messages (Article 363-1) [9].

Article 96, Article 91-4); providing information that does not correspond to reality (Article 212-3); untimely provision of information (Articles 91-4, Articles 166-4); intentional concealment of information (Article 53-2, Article 82-3, Article 83-1, Article 91-3, Article 92-1, Article 163-5, Article 186-3); coercion to disseminate or impede the dissemination of certain information, as well as censorship (Articles 212-11); dissemination of information that does not correspond to reality, disgraces the honor and dignity of the person (Article 164-3); disclosure of a secret protected by law by a person who is supposed to protect this secret (Articles 164-3); violation of the procedure for storing information (Articles 212-5, Articles 212-6); intentional destruction of information (Article 921 of the Code of Administrative Offenses, Article 2124); unreasonable assignment of certain types of information to the category of information with limited access (Article 212-2), etc. [10].

Thus, there is a wide range of possible violations of information security. To ensure the rights and freedoms of the subjects of information relations and compensate them for damage caused by information security violations, the Law of Ukraine “On Information” provides as follows: “If the violation of the right to freedom of information compensation by court decision. Subjects of power as plaintiffs in cases of protection of honor, dignity and business reputation have the right to demand in court only the refutation of inaccurate information about themselves and have no right to demand compensation for moral (non-pecuniary) damage. This does not deprive officials of the right to protection of honor, dignity and business reputation in court” [3].

Therefore, for violating information security, a person may receive compensation for tangible and non-pecuniary damage.

The civil legislation of Ukraine also provides for the compensation to a person as a result of violation of his civil rights. Losses in this case are: “1) losses incurred by the person in connection with the destruction or damage of the thing, as well as costs incurred by the person or must be made to restore his violated right (real damage); 2) income that a person could actually receive under normal circumstances, if his right was not violated (lost benefit)” [11]. As a general rule, damages are reimbursed in full, unless the contract or law provides for compensation in a smaller or larger amount.

The legislator also established that a person has the right to compensation for non-pecuniary damage caused as a result of the violation of his rights. This rule also applies to compensation for non-pecuniary damage for information security violations. In particular, under Part 3 of Art. 23 of the Civil Code of Ukraine “non-pecuniary damage is reimbursed in cash, other property or otherwise; the amount of monetary compensation for non-pecuniary damage is determined by the court depending on the nature of the offense, the depth of physical and mental suffering, impairment of the victim or deprivation of his ability to implement them, the degree of guilt of the person who caused moral damage, if the guilt is the basis for compensation, as well as, taking into account other circumstances that are significant” [11].

It is also necessary to keep in mind the Resolution of the Plenum of the Supreme Court of Ukraine, which stipulates that “non-pecuniary damage may consist, in particular: in the humiliation of honor, dignity, prestige or business reputation, moral distress due to damage to health, violation of law property (including intellectual property), rights granted to consumers, other civil rights in connection with illegal detention under investigation and trial, in violation of normal life ties due to the inability to continue active public life, disruption of relations with others, the onset of other negative consequences” [12].

It should be noted that in cases of violation of information security, it is much easier to obtain compensation for tangible damage than compensation for non-pecuniary damage.

It is also essential that the statement of claim for non-pecuniary damage should state: the court must find out what confirms the fact of causing the plaintiff moral or physical suffering or non-pecuniary loss, under what circumstances or by what actions (inaction) they are caused, in what amount or in what material form the plaintiff assesses the damage caused to him and why it turns out, as well as other circumstances relevant to resolving the dispute.

The amount of compensation for non-pecuniary damage must be determined by the court depending on the nature and extent of the suffering and taking into account other circumstances. In particular, the state of health of the victim, the severity of forced changes in his life and work relationships, the degree of decline in prestige, business reputation, time and effort required to restore the previous state, etc. are taken into account. In this case, the court must proceed from the principles of reasonableness, balance, and fairness [12].

Summarizing the above, we can conclude that in the current environment of information society, digitalization, etc. information security is important in the field of private law. As a result, violations of information security may result in administrative and criminal liability. However, the option of civil liability is also important, in particular, compensation for tangible and non-pecuniary damage, which requires applying to the court. At the same time, it should be remarked that the actual compensation can occur only if the fact of damage is properly proved and the amounts contained in the claim are justified.