Is it allowed to leave the pages with the passport data of users open?

Question

Information Security

When uploading documents to the site, I discovered an interesting feature, a link like site.com/file/21312
I tried to change this number and opened a document with passport data, address and phone number of another person.
It turns out that more than 20,000 documents with passport data are in the public domain. Is it normal? Is it legal?

Answer 1

As I understand from 152-FZ, this is illegal. This situation falls under the definition of "PD security threat", and the PD operator is obliged to deal with them.
Link to 152-FZ
Link to article 19 of this law, on the obligations of the PD operator.