Case dates back to March 2019, when the municipality communicated personal data of Russian protesters to the Russian embassy. Activists claim that sharing the data put their safety “at risk”
The activists who saw their personal data shared by the Lisbon City Hall with the Russian embassy will sue the municipality, demanding 120 thousand euros as “compensation for the moral damage suffered.
In a statement, Pavel Elizarov, Russian activist from the Parus association; Katsiaryna Drozhzha, Belarusian activist from the Pradmova association; and Alexandra Correia, Portuguese activist from the Tibet-Portugal Support Group, say that, “with the sponsorship of lawyers Leonor Caldeira and Francisco Teixeira da Mota” they have decided to go ahead with a lawsuit against CML for 120 thousand euros “which will also revert to the entities” they represent.
“In February 2022, the National Commission for Data Protection applied to CML a fine of 1,250,000 euros, but this fine did not benefit any person or entity victim of this repeated practice of improper sharing of personal data. This is precisely the goal of our action: to repair the moral damage suffered by these three people specifically affected,” write the activists in the note released this Thursday.
In the statement, the activists say that the sharing of the data has put “at risk” their safety and that of their families, with such sharing contributing “to a widespread sense of fear and increased danger.
“We are hopeful for a positive decision that will allow us to repair (to the extent possible) the moral damages suffered, bringing justice to the victims and contributing to jurisprudence that strengthens the rights of activists in Portugal,” say the activists.
Russiagate” case goes back to 2019
A case was opened due to a complaint – which was filed with the National Commission for Data Protection (CNDP) on March 19, 2021 – regarding the communication by the Lisbon municipality to the Russian Embassy in Portugal and the Russian Ministry of Foreign Affairs of personal data of the promoters of a demonstration held near the embassy.
The activists, dissidents of the Russian regime, had held a protest in January 2021 for the release of Alexey Navalny, an opponent of the Russian government, and argued that the Lisbon City Council, led at the time by Fernando Medina, the current Minister of Finance, jeopardized their safety and that of their family members in Russia by releasing their data.
Fernando Medina has “publicly apologized” for sharing this data, assuming it was “an unfortunate mistake that could not have happened,” and said he learned about the case through the media.
One month after the disclosure of data to the Russian authorities, the Lisbon City Council approved by majority vote (with eight votes in favor, six against and three abstentions) the dismissal of the municipality’s data protection officer and coordinator of the personal data protection project team, Luís Feliciano.
The president of the CNPD, Filipa Calvão, heard in parliament on this matter, argued that the data protection officer should not be dismissed, stressing that the responsibility should be attributed only to the municipality.
Medina refused that the exoneration of the responsible had served as a “scapegoat” and defined it as a necessity to “reestablish trust in the functioning of the services”.
Questioned at the time about the polemic, Prime Minister António Costa considered that there were no political responsibilities to be drawn from the data transmission, regretting the idea that CML was “a kind of espionage center for Mr. Putin”.
Also confronted with the case, Russia’s ambassador in Portugal, Mikhail Kamynin, stated in June 2021 that the embassy deleted the protesters’ data, stressing that the information was not transmitted to Moscow.
In January 2022, the CNPD fined the Lisbon City Council 1.2 million euros in the process concerning the processing of personal data of participants in demonstrations, after having identified 225 administrative offenses in the communications made by the municipality within the scope of demonstrations, rallies or parades.
The fine for the administrative offence of failure to carry out a data protection impact assessment could reach 10 million euros, while the remaining 224 fines could each go up to 20 million euros.