Lisbon city council loses “Russiagate” appeal, €1.25M fine stands

  • Lusa
  • 27 January 2026

The Constitutional Court argued that the law makes no distinction between private companies and public entities (whether commercial or not) with regard to the Data Protection Regulation.

Portugal’s Constitutional Court has rejected Lisbon city council’s appeal in the case known as “Russiagate”, ruling that the local authority will have to pay the fine related to the transfer of personal data to Russia.

According to Tuesday’s Diário de Notícias newspaper, the city council claimed that there was no reason to pay the fine — around €1.25 million for 225 infringements of the General Data Protection Regulation (GDPR) in the first decision — because, in the council’s view, non-commercial public entities were not covered.

The Constitutional Court rejected this argument, ultimately validating all previous court decisions on this matter.

The judges argued that the law makes no distinction between private companies and public entities (whether commercial or not) with regard to the Data Protection Regulation.

Lisbon city council had been ordered in 2022, to pay a fine of €1.25 million after being accused by activists who took part in a protest outside the Russian embassy in January 2021 in support of Alexey Navalny (a Russian opposition figure who died in prison in 2024) of handing over their personal data to the Russian embassy.

The National Data Protection Commission opened a case that ended with the Lisbon city council, chaired at the time by Socialist, Fernando Medina, being ordered to pay the fine.

The city council contested the decision and, in 2024, the Lisbon Administrative and Tax Court partially upheld its appeal and reduced the fine to around €1 million.

With Social Democrat Carlos Moedas now as mayor, a new appeal was lodged with the South Central Administrative Court, and the decision resulted in a further reduction of the fine to €738,000, which according to the Diário de Notícias newspaper, corresponds to 65 fines for violation of the Data Protection Law.

However, according to the newspaper, as there have been several appeals, it is possible that of the initial 225 offences, around 30 remain, some of which are at risk of becoming time-barred.