Case Summary and Outcome

The European Court of Human Rights (Third Section) held that Russian authorities violated Article 8 of the European Convention on Human Rights by failing to protect Anastasiya Volodina from acts of cyberviolence and by conducting a delayed and ineffective investigation into her complaints. In 2016, Volodina reported to the police that her intimate images had been published online without her consent, but it took nearly 2 years to open a criminal investigation. The Court found that the delay and procedural failures amounted to a breach of the State’s positive obligation to safeguard her right to private life. While acknowledging that Russian law formally includes civil and criminal provisions protecting individuals against the non-consensual dissemination of personal data, the Court concluded that these legal safeguards had not been effectively implemented in practice in Volodina’s case, thus creating a climate of impunity. The judgment also highlighted the broader implications of cyberviolence, particularly as a form of gender-based abuse. Drawing on international sources, the Court discussed various forms of cyber violence against women and girls (VAWG), including “revenge porn”, and emphasized the serious impact such abuse can have on victims’ physical and psychological integrity. It stressed the duty of States to take proactive measures to prevent and respond to such harm.

---

Facts

On November 1, 2014, Valeriya Igorevna Volodina, a Russian national, began a relationship with S., an Azerbaijani national. After their separation in 2015, S abducted and assaulted her multiple times.

On June 22, 2016, Volodina reported to the Ulyanovsk police about the breach of her right to privacy and informed them that her social media account on VKontakte had been hacked. Her pseudonym had been replaced with her real name, and her personal information, passport photo, and intimate images had been published. S admitted to Volodina’s brother that he had hacked her account.

On November 7, 2016, the Ulyanovsk police declined to open a criminal investigation, stating that the content had been published on social media, not in the media. A supervising prosecutor annulled this decision due to the police’s failure to interview S. After further refusals and annulment, a criminal investigation was finally initiated on March 6, 2018, under Article 137 of the Russian Criminal Code (criminal liability for invasion of privacy), leading to interviews with S and the seizure of his electronic devices.

In February, March, and September 2018, new fake social media accounts in Volodina’s name emerged on VKontakte and Instagram, again featuring her intimate photographs. On August 13 and September 19, 2018, Volodina reported to police that S had sent her death threats via social media. The police refused to initiate criminal proceedings, claiming the threats were not “real.” [para. 11] Volodina requested an order to prevent S from contacting her using the internet, but the investigator denied it. A domestic court upheld the refusal.

On January 19, 2019, police suspended the investigation into the fake social media accounts, stating that the accounts had been created using phone numbers and IP addresses registered in Azerbaijan. On June 25, 2019, the Zavolzhskiy District Court set aside this suspension decision.

On October 14, 2020, investigators closed the criminal proceedings and concluded that S had created fake profiles and published nude images of Volodina without her consent. The investigator found Volodina’s photos on S’s phone during the investigation. However, S successfully had the case dismissed by invoking the statute of limitations. Neither Volodina nor her legal counsel were informed.

Volodina filed a case before the European Court of Human Rights. In Volodina v. Russia (no. 1), the Court unanimously held a violation of Articles 3 (prohibition on torture and inhuman or degrading treatment) and 14 (prohibition of discrimination) of the European Convention on Human Rights (the Convention). The instant case is a follow-up case dealing specifically with the State’s obligations under Article 8 (right to respect for private and family life) of the Convention.

---

Decision Overview

The case concerned whether the Russian authorities had fulfilled their positive obligations under Article 8 of the European Convention on Human Rights to protect Anastasiya Volodina from cyberviolence – specifically the non-consensual dissemination of her private photographs, cyberstalking, and online impersonation.

Volodina argued that the State failed to protect her private life, as required by Article 8, by not responding effectively to her repeated complaints of online abuse. She maintained that Russian authorities delayed opening a criminal investigation—waiting nearly two years—and failed to collect crucial evidence in a timely manner. She also claimed that Russia lacked a comprehensive legal framework capable of addressing domestic violence occurring in digital spaces.

In response, the Russian government contended that its domestic legal system offered adequate protection under both criminal and civil law. It pointed to Article 137 of the Criminal Code, which criminalizes the unauthorized disclosure of private information, and cited several provisions of the Civil Code (Articles 150, 151, 152.1, and 152.2) that allow victims to claim non-pecuniary damages and request the removal of unlawfully shared images.

The Court reaffirmed that Article 8 of the Convention protects not only an individual’s private life but also their physical and psychological integrity. Referring to Volodina v. Russia (No. 1), the Court reiterated that the non-consensual publication of intimate images undermines dignity and conveys humiliation and disrespect. It further emphasized that the State has a positive obligation to respond to cyberviolence—especially when linked to domestic abuse—with effective legal remedies and prompt investigative action.

In its analysis, the Court drew on multiple international sources, including the 2015 UNESCO-ITU Broadband Commission’s report on gender and digital safety, which defines cyberviolence against women and girls (VAWG) as including “revenge porn”—the non-consensual online dissemination of intimate images intended to shame and harm the victim. The Court outlined five features of cyber VAWG: anonymity, action at a distance, automation, accessibility, and perpetuity. It also referred to a 2018 report by the UN Special Rapporteur on violence against women and girls, which recommended that States criminalize such conduct and provide access to protection orders. Additionally, the Court cited a study by the Cybercrime Convention Committee’s working group on cyberbullying and online violence, reinforcing the growing recognition of cyberviolence as a serious human rights concern.

The Court recalled its established case law under Articles 2, 3, and 8, which sets out three core positive obligations in cases of domestic violence:

(a) the duty to establish and enforce an adequate legal framework;

(b) the duty to take reasonable measures to prevent a real and immediate risk of further violence; and

(c) the duty to conduct an effective investigation.

Applying these principles, the Court acknowledged that Russian law on paper contained both criminal and civil provisions prohibiting the unauthorized dissemination of personal data. However, in practice, the implementation of those provisions in Volodina’s case was inadequate. The Court held that the authorities failed to apply the law effectively or to ensure accountability for the acts of cyberviolence she endured.

The Court found that the police acted dismissively and attempted to close the case on procedural grounds. A criminal investigation was only initiated nearly two years after the initial complaint, with no timely efforts to gather forensic evidence. Ultimately, the case was closed due to the expiration of the statute of limitations, despite the existence of incriminating evidence. The Court also noted that Russian law lacked specific mechanisms to prevent repeated acts of cyberviolence or to monitor perpetrators. Volodina was not granted any form of protection or restraining order to prevent ongoing abuse. The authorities’ failure to sanction the perpetrator, the Court concluded, created a climate of impunity that failed to produce a deterrent effect and undermined the State’s responsibility to protect women from cyberviolence.

The Court unanimously found that Russia had violated Article 8 of the Convention and awarded Volodina €7,500 in non-pecuniary damages and €5,386.46 in legal costs and expenses.

---