Lisbon Council may have to pay a huge price for sharing the personal data of three Russian activists who carried out a protest in the city in January with the Russian Embassy.
The case has been described as everything from “unacceptable” and “frightening” to “extremely serious” and “political terrorism”. Even President Marcelo Rebelo de Sousa described the situation as “regrettable” and said that “it should never have happened”.
Specialists in data protection laws explain that the council committed at least four data protection violations, each one of them punishable with fines of up to €20 million – meaning the council could be slapped with as much as €80 million in fines.
Elsa Veloso, a lawyer specialising in privacy and data protection, told Público newspaper that the “data protection specialist who has worked at the city hall for three years should have reported the data protection violations in 72 hours”.
Despite publicly apologising for the incident – describing it as a “bureaucratic error which won’t be repeated again” – Lisbon Mayor Fernando Medina (PS) is being pressured by his political rivals to resign. Carlos Moedas, who is running for Lisbon Mayor in the upcoming local elections with the support of rival party PSD, says Medina “has no choice but to resign”. Other political leaders such as BE’s Catarina Martins and PSD’s Rui Rio are also demanding further explanations about this case.
Politico newspaper explained that municipal authorities obtained the personal data when the dissidents applied to hold a rally in January to protest against the arrest of Russian opposition leader Alexei Navalny.
The only reason the activists found out that their data had been shared with Russian authorities was because the email containing their personal information was accidentally forwarded by the council to one of them.
“We gave city hall all of our information because the protest was being held in the midst of the COVID crisis, and we wanted to be sure that we were complying with all of the sanitary rules that were in place,” protest organiser Ksenia Ashrafullina, a 36-year-old Russian-Portuguese dual citizen, told Politico.
“They accidentally forwarded me the email they had sent to the Russian authorities, which included a PDF file with our data transcribed,” she added.
Her demands for an explanation were ignored until she lodged a formal complaint. “I get that with the elections coming up, we’re part of a bigger political game now … If this helps to make Portugal a more democratic country, I guess that’s fine,” said Ashrafullina.
Meanwhile, Fernando Medina has confirmed that an audit into what happened is underway and that he is waiting for its results to respond to the criticism he has received.
The Russian Embassy has since said that the activists’ personal data was “deleted” as “it was not relevant”, and that it was never shared with the Russian authorities, wrote Expresso. But the damage has been done and answers are now needed.
By MICHAEL BRUXO
[email protected]
