# Lisbon City Council GDPR violation ruling

> Live situation record from CLSTR: https://clstr.news/situations/lisbon-city-council-gdpr-violation-ruling
> Updated: 2026-09-10T08:28:22.000Z. Sources: 10. Developments: 2.

The South Central Administrative Court ordered the Lisbon City Council to pay a fine of 463,700 euros in relation to the “Russiagate” case. The ruling found the municipality violated the General Data Protection Regulation (GDPR) by sharing the personal data of anti-Putin activists with Russian authorities.

The incident originated in 2021 during the administration of Fernando Medina. An audit showed that data concerning 52 protests was shared with the Russian embassy, alongside information shared with the embassies of China, Israel, and Venezuela. 

The final fine was reduced from an initial penalty of over 1 million euros because 42 administrative offenses expired due to the statute of limitations. Legal defense for the council noted that the process may still undergo further changes.

## Timeline

### 2026-09-10: Lisbon City Council fined for sharing activist data with Russia

Lisbon City Council must pay 463,700 euros for GDPR violations after sharing anti-Putin activists' data with Russian authorities in the “Russiagate” case.

4 sources. https://clstr.news/cluster/lisbon-city-council-fined-for-sharing-activist-data-with-russia

### 2026-09-08: Lisbon City Council announces 21.5 million euro investment plan

Lisbon City Council plans to invest 21.5 million euros in urban conservation and digital modernization, including 15 million euros for technological upgrades and cybersecurity.

6 sources. https://clstr.news/cluster/lisbon-city-council-announces-215-million-euro-investment-plan

---
Cite as: Lisbon City Council GDPR violation ruling. CLSTR, https://clstr.news/situations/lisbon-city-council-gdpr-violation-ruling