image copyrightGetty Imagesimage captionRussian diplomats have not publicly commented on the issue
Authorities in the Portuguese capital Lisbon illegally handed over protesters' personal details to the foreign embassies they were picketing, an audit has found.
Data was shared 52 times from 2018-19, said Lisbon mayor Fernando Medina.
He declined to say which embassies were involved, but media reports cited China, Israel and Russia.
Last week, a protest organiser said her personal details had been shared with the Russian embassy in Portugal.
The woman – who has dual Russian-Portuguese citizenship – said she did not know whether she would now be allowed back in Russia.
Russia, China and Israel have so far made no public comments on the issue.
- Three years of GDPR: the biggest fines so far
Mr Medina on Friday acknowledged that the audit of city council procedures concluded that protest organisers' data had been illegally shared.
There were 182 such cases since 2012, but the mayor highlighted 52 instances which happened after the EU's General Data Protection Regulation – which bans such data sharing – came into force in 2018.
The mayor apologised, and said the official responsible for data protection would be dismissed.
"This was an inadequate policy which should never have happened," Mr Medina said.
Mr Medina is now himself under pressure to resign, the BBC's Alison Roberts in Lisbon reports.
media captionWATCH: What is GDPR?