Lisbon Fined for Sharing Protester Data with Russia

Lisbon’s Administrative Court has mandated that the city must pay €1,027,500 for improperly disclosing personal information of anti-Putin demonstrators during a 2021 incident. This ruling stems from the city’s admission that it provided the personal data of three activists to the Russian embassy in Lisbon, a controversy that has since been dubbed ‘Russiagate’ in Portugal. The demonstrators were advocating for the release of Alexei Navalny, a prominent political dissident arrested in January 2021. The activists, two of whom hold dual Russian citizenship, claimed that the city’s actions endangered their safety and that of their families in Russia. Under Portuguese law, protest organizers are required to submit personal details to the city council, which then forwards this information to law enforcement and relevant authorities. However, the city council controversially interpreted its obligations to include sending this data to the Russian embassy, where the protest was occurring. Following the court's decision, Lisbon Mayor Carlos Moedas expressed regret over the incident, attributing the issue to the previous Socialist administration. The court's ruling came after the city council appealed a larger fine of €1,250,000 initially imposed by the Portuguese National Data Protection Commission (CNPD). The Administrative Court determined that some violations were time-barred, resulting in a reduction of the fine by €222,500. This case highlights ongoing concerns regarding data privacy and the implications of governmental actions on individual safety, particularly in politically sensitive contexts.