The right to privacy, as enshrined in Article 8 of the European Convention on Human Rights (hereinafter ECHR), imposes a number of positive obligations on States to protect victims of all forms of violence, including cyberviolence; to establish and implement in practice an adequate legal framework to protect against violence committed by private persons; to take reasonable steps to avoid a real and immediate risk of recurring violence that the authorities knew or ought to have known about; and to conduct an effective investigation into acts of violence.

In the case of M. Ș. D. v. Romania, handed down in December 2024, the European Court of Human Rights (hereinafter the ECtHR or the Court) unanimously ruled that the right to privacy was violated by the authorities’ failure to protect the victim of cyberviolence.

Circumstances of the Case:

In October 2016, after the end of a short-term relationship, the applicant’s ex-partner, out of jealousy and revenge, distributed her intimate photographs to family members and friends of her brother, using fake accounts on Facebook. Subsequently, he published the same images and the complainant’s personal data on websites offering escort services. As a result, the applicant was contacted by unknown persons interested in such services. The complainant stated that her ex-partner verbally and physically assaulted her after the break-up and threatened to disseminate her intimate images within the university.

The complainant immediately filed a complaint with the authorities, but the criminal proceedings lasted until the statute of limitations for criminal liability expired. In the grounds for the decision to close the criminal case, the authorities concluded that the former partner’s actions did not constitute the offenses of invasion of privacy, computer forgery, harassment or threat. In addition, the Romanian authorities criticized the applicant’s behaviour, blaming her for the “sexualized” nature of the relationship by voluntarily sending intimate photos, and argued that the criminal sanctioning of the ex-boyfriend would represent an “excessive penalization” of his conduct.

ECtHR’s Findings:

The ECtHR reiterated that the effective investigation must be prompt and thorough. In this case, the Romanian authorities opened the investigation more than six months after the complainant lodged her complaint with the police; they heard the suspect more than one year and eight months later; they opened the investigation against him more than two years and five months after the complaint was lodged; and he admitted the acts committed more than seven months later. The ECtHR noted that the authorities failed to take measures to ensure that the necessary evidence was collected, even though some of it was available online or on computers. Equally, the authorities failed to protect the applicant from possible abuse by her ex-partner or to mitigate it – even after the complaint was lodged, he continued his wrongful actions.

The ECtHR took into account the national court’s findings regarding the prosecutor’s lack of impartiality and dismissive attitude towards the applicant, which contributed to her revictimization. The Court also found particularly worrying the prosecutor’s decision not to continue the investigation into the applicant’s case, which was taken based on the intervening statute of limitations on criminal liability, as determined by the national court. The Romanian authorities have therefore failed to fulfill their obligation to conduct an effective investigation.

As regards the legal framework, the ECtHR found that, at the time of the investigation of the case, it did not ensure the necessary protection of the applicant against acts of cyber violence. The amendments to the Romanian Criminal Code, which contribute to the protection of victims of ‘revenge pornography’, entered into force too late, already after the final judgments in the applicant’s case had been delivered.

Personal Note:

The case of M.Ș.D. v. Romania emphasizes the importance of the protection of the right to privacy in the context of cyberviolence, given the increased dangerousness of this phenomenon which is due to the possibility of rapid distribution of intimate images and personal data on the internet. The Court confirmed that cyberviolence is nowadays becoming an aspect of violence against women and girls and can take different forms, including computer violations of privacy, intrusion into the victim’s computer and the retrieval, sharing and manipulation of data and images, including intimate data, etc.

The ECtHR considered that the failure of the Romanian authorities to investigate the case until the expiry of the limitation periods called into question their ability and willingness to conduct an effective investigation, which was essential to maintain public confidence in respect for the rule of law.

In addition to the psychological trauma and feelings of anxiety and fear caused to the applicant, she was re-victimized by the authorities when she lodged her complaint, which is totally unacceptable when it comes to victims of any form of violence. The Court reiterated that online violence or “cyber violence” is closely linked to offline or “real-life” violence and must be seen as another facet of the complex phenomenon of domestic violence (§ 119).

The Court also emphasized that both international instruments and the established caselaw of the ECtHR have highlighted the particular vulnerability of victims of domestic violence and the need for active State involvement in their protection. The problem in question is also widespread in the Republic of Moldova, as our state has been condemned in several cases concerning failure to protect victims of violence.

Finally, in view of the high vulnerability of victims of cyber violence, the state should intervene as actively and promptly as possible to protect them from further acts and avoid an indifferent, preconceived or discriminatory attitude.

Author: Valeria BUTORINA, Junior Legal Officer

Photo sources: Freepik, Moldova 1