Yes and no. GDPR only protects the data of natural persons, not the government. It's difficult to follow because the natural person in this case happens to be

Yes and no. GDPR only protects the data of natural persons, not the government. It's difficult to follow because the natural person in this case happens to be the leader of the ruling political party and the government's reason for using GDPR as an enforcement tool tenuous at best. GDPR does two important things: it gives natural persons rights over the data collected about them[1] and creates requirements for when/how/why a company can collect data about natural persons as well as what can be done with it (called "processing"). GDPR requires companies get affirmative consent from individuals in order to collect information about them and to inform them about how that information is processed. Importantly, the definition of processing under GDPR includes gathering, disclosing, and disseminating information. From reading the demand letter and not knowing much else about the case it seemed to me that the government is taking the position that the data transaction between the source and the journalists was unlawful because the subject owner of the data (the politician) did not consent and that whoever provided the information (assuming they were permitted to possess the data) did not fulfill their obligation to protect it. If you take the journalism/politician/embezzlement piece out of the equation the logic makes more sense. If you live in the EU and someone gets a copy of your tax return and posts it on Facebook the government would do well to figure out how that person got your tax return and make sure your accountant (who rightly has a copy of your tax return) is sufficiently protecting your personal information. Where the logic falls apart is that GDPR is expressly not intended to apply to information collected for "journalistic purposes," as is the case in Romania. [1] https://advisera.com/eugdpracademy/knowledgebase/8-data-subject-rights-according-to-gdpr/ https://advisera.com/eugdpracademy/knowledgebase/8-data-subj...