The Lisbon City Council was ordered by the Southern Central Administrative Court to pay a fine of 463,700 euros for violations of the General Data Protection Regulation in the Russiagate case, related to the sending of personal data of anti-Putin activists to Russian entities. The amount results from the deduction of approximately 274 thousand euros related to 42 administrative offenses that expired during the proceedings.
The initial fine of 1.25 million euros had been reduced to 738 thousand euros in 2025 due to the statute of limitations on several violations. That amount became final in January 2026, but the Lisbon City Council requested the dismissal of another 42 administrative offenses, a request that was accepted by the Public Prosecutor's Office and led to the current amount of 463 thousand euros.
The violations occurred between 2013 and 2021, and the Lisbon council did not dispute the sending of emails with personal data to third-party entities. The council's defense claims the process has not yet concluded.
The lawyer for the National Data Protection Commission considers this the largest fine imposed in Portugal for data protection violations and that, barring any calculation error, there will be no room for further appeal or reduction.
