The mayor’s office in Lisbon has been fined $1.4 million for sharing the personal data of protest organizers with embassies of countries targeted by the protests, Portugal’s data protection commission said on Friday.
The mayor’s office came under fire in June 2021 when Ksenia Ashrafullina, a Russian-Portuguese organizer of a protest rally in Lisbon, said she had received an email showing the city hall had shared data on her and fellow organizers with the Russian Embassy.
After an internal investigation, it was revealed that data on organizers of 180 protests has been shared with embassies since 2012, 52 of which occurred after the European Union’s General Data Protection Regulation — which bans such data sharing — came into force in 2018.
The city hall, then led by Socialist mayor Fernando Medina, shared data of protesters in front of the Cuban, Angolan, Venezuelan, Israeli embassies with the targeted institutions.
The decision by the data protection commission (CNPD), published on its website, said that between 2018 and 2021 there were a total of 225 data breaches committed by the mayor’s office related to sharing protesters’ personal information with embassies and other entities.
In a statement, the mayor’s office, now headed by Social Democrat Carlos Moedas, said the decision was a “heavy legacy the previous leadership … left to the people of Lisbon,” adding the fine now posed a challenge for the budget.
“We will evaluate this fine in detail and how best to protect the interests of citizens and the institution,” it said.
Medina did not immediately respond to a request for comment Ashrafullina, who organized the rally in support of jailed Kremlin critic Alexei Navalny, told Reuters she was satisfied with the CNPD’s decision: “We have been waiting for it, and it finally came.”
But Ashrafullina is still scared about the consequences of the data-sharing.
“I’m worried about what would happen if I ever needed to go back to Russia,” she said.