A recent court decision confirmed charges against the Lisbon City Council for its conduct in handling personal data, with judges highlighting that “the only possible conclusion is that the municipality acted with intent, as it is evident that their actions violated administrative duties, and the municipality was aware of this violation.”
This ruling marks the second legal setback for the Lisbon City Council regarding a 1.25 million euro fine imposed by the National Data Protection Commission (CNPD) in 2022 for violations of the General Data Protection Regulation by “communicating the personal data of protest organizers to third parties.”
The CNPD initially identified 225 infractions related to communications made by the municipality concerning protests, rallies, or parades.
The fine originated from a case opened following a complaint lodged with the CNPD on March 19, 2021.
The issue involved the municipality’s communication of personal data of protest organizers to the Russian embassy in Portugal and the Russian Ministry of Foreign Affairs.
The activists, opponents of the Russian regime, had protested in January 2021 for the release of Russian government critic Alexey Navalny, arguing that the Lisbon City Council compromised their safety and that of their families in Russia by distributing their data.
The initial fine imposed on the municipality has been reduced over time, owing to the expiration of certain charges, and now stands at 738,000 euros. This amount corresponds to 65 confirmed infractions.
The decision announced today can be appealed.
