The article is devoted to the issues of criminal-legal regulation of patients’ personal data constituting medical secrecy. The research objective is to assess the level of legal regulation of public relations, at which criminal encroachments are performed, during the personal data processing, and to improve the Russian criminal law in this sphere. It was determined that the level of criminal-legal protection of personal data requires improving. Illegal trafficking of personal data, including biometric ones, entails a threat to public relations. Biometric personal data are a valuable resource and may entail commitment of such unlawful actions as manufacturing and marketing of fake models of biometric personal data. The author proposes measures to improve the components of crime, stipulating criminal liability for the violation of privacy and of the Russian legislation on personal data (Art. 137 of the Russian Criminal Code). The author asserts the feasibility of establishing criminal liability for unlawful processing of personal data which infringed substantial harm on the rights and legal interests of a person. Taking into account a high public danger of the deeds which can be committed using biometric personal data and their value, we consider it necessary to criminalize the components of crime consisting in manufacturing and (or) marketing of fake models of biometric personal data.