Article 417 CP: Disclosure of Secrets and Restricted Data by Public Officials

Public bodies handle information every day that cannot circulate freely: tax and police data, medical records, files under processing, proceedings declared confidential. Article 417 of the Spanish Criminal Code (CP) protects that confidentiality by punishing the authority or public official who discloses secrets or information learned by reason of their office which must not be divulged. It is an offence with very serious consequences for a public servant's career — it can mean losing the post permanently — and, at the same time, a route to redress for the citizen whose data was leaked. We examine its elements, penalties, special disqualification, moral damages and the differences from Article 197 CP.

What Article 417 CP punishes

The provision sits in Title XIX of Book II of the CP (offences against the public administration), within the chapter on breach of custody of documents and violation of secrets (violación de secretos). Its first paragraph provides that the authority or public official who discloses secrets or information learned by reason of their office or position, and which must not be divulged, incurs a fine of twelve to eighteen months and special disqualification from public employment or office for one to three years.

The protected interest is twofold: the proper functioning of the administration and citizens' trust that the data they hand over to public authorities will not end up in the hands of third parties.

Elements of the offence

• Qualified offender: only an authority or public official can commit it. The criminal-law concept in Article 24 CP is broader than the administrative one: it covers anyone taking part in the exercise of public functions by law, election or appointment. A private individual who takes advantage of a secret obtained from an official may answer under the separate offence in Article 418 CP.
• Subject matter: secrets or information "which must not be divulged". No formal classification as secret is required: it suffices that a duty of confidentiality attaches to the information by its nature or under the applicable rules.
• Functional connection: the offender must have learned the information by reason of their office or position; if it was obtained outside their duties, other provisions apply, as explained below.
• Conduct: disclosing, that is, communicating the information to a third party not authorised to know it, by any means. A single recipient is enough, although the extent of dissemination will weigh on the assessment of harm.
• Mental element: it is an intentional offence. Since negligence is only punishable where the law expressly so provides (Article 12 CP), a merely negligent disclosure falls outside the offence, without prejudice to disciplinary liability.
• Completion: the offence is complete upon the disclosure itself, with no need for actual harm; serious harm operates as an aggravated form.

Penalties: from the basic to the aggravated form

Form	Penalty
Basic offence (Article 417.1, first paragraph)	Fine of 12 to 18 months and special disqualification from public employment or office for 1 to 3 years
Serious harm to the public interest or to a third party (Article 417.1, second paragraph)	Imprisonment of 1 to 3 years and special disqualification from public employment or office for 3 to 5 years
Secrets of a private individual (Article 417.2)	Imprisonment of 2 to 4 years, fine of 12 to 18 months and suspension from public employment or office for 1 to 3 years

Classification is decisive. The basic offence carries no prison term: the dispute centres on the fine and, above all, on the disqualification. In the serious-harm form, a sentence in the lower range for a defendant with no record allows an application to suspend enforcement; under paragraph 2, with a minimum of 2 years, the upper half may mean actual imprisonment. The defence must focus from the outset on which form applies and on the individualisation of the penalty.

What special disqualification means

Under Article 42 CP, special disqualification from public employment or office (inhabilitación especial) entails the definitive loss of the employment or office concerned, even if elective, and of any attached honours, together with the incapacity to obtain the same or analogous positions for the duration of the sentence. The judgment must specify the posts, offices and honours affected.

The difference from suspension (Article 43 CP) is essential: suspension only bars the convicted person from exercising the office while the sentence runs, so they recover the post once it is served; disqualification means losing the position permanently. Note that Article 417.2 — despite carrying the heaviest prison term — provides for suspension, while paragraph 1 carries disqualification: for a career civil servant, keeping or permanently losing the post can weigh as heavily as the custodial sentence itself.

Civil liability for moral damages

The commission of an offence creates an obligation to repair the harm caused (Article 109 CP), including compensation for material and moral damage (Article 110 CP). In secrecy offences the characteristic harm is not financial but moral: the exposure of intimate data, the damage to reputation, the distress of knowing that sensitive information is circulating beyond the sphere in which it was entrusted.

Settled case law accepts that moral damage does not require proof of a specific financial loss: it is inferred from the very nature of the intrusion and is quantified on a prudential basis having regard to the sensitivity of the data, the extent of dissemination and the personal, family or professional impact on the victim. Article 113 CP extends compensation to harm caused to the victim's relatives or to third parties. The injured party may claim it by joining the criminal proceedings as a private prosecutor (acusación particular); for the accused official, the quantification of moral damages is a separate front of the defence.

Differences from Articles 197 and 198 CP

This is the most frequent source of confusion. Article 197 CP is an ordinary offence against privacy: it punishes with imprisonment of 1 to 4 years and a fine of 12 to 24 months whoever, without consent, seizes personal documents, intercepts communications or accesses restricted personal data without authorisation. Article 198 CP aggravates those acts when committed by an official outside the cases permitted by law, with no criminal investigation under way, and abusing their position: the Article 197 penalties in their upper half plus absolute disqualification for 6 to 12 years.

The Supreme Court clarified the dividing line in its judgment of 26 March 2026 (appeal 3274/2023): the key lies in how the information was accessed. Article 197 presupposes unauthorised access; Article 417 punishes the official who reached the data legitimately, by reason of their office, and whose unlawful act is disclosing it. Thus, the official who consults a database unrelated to their duties without authorisation and spreads what they found falls within Articles 197 and 198; the one who discloses what they learned lawfully in their post answers under Article 417. The difference in penalties is enormous, so the correct classification is often the first battle of the proceedings.

Paragraph 2: secrets of a private individual

Where what is disclosed are the secrets of a private individual — tax, medical or police information the administration holds about a citizen — Article 417.2 CP raises the response to imprisonment of 2 to 4 years, a fine of 12 to 18 months and suspension from public employment or office for 1 to 3 years: on top of the breach of official duty, the privacy of a specific person is injured.

Nor should this form be confused with the disclosure of secrets by private individuals under Article 199 CP, which punishes whoever reveals another person's secrets learned through their occupation or employment relationship (imprisonment of 1 to 3 years and a fine of 6 to 12 months) and, more severely, the professional who breaches their duty of confidentiality. The boundary is again the offender: Article 417.2 requires the status of public official and that the secret was learned by reason of the public office.

Key defence strategies

In our experience as defence lawyers for public officials, these are the lines we examine first:

1. The information was not secret: if the data was public knowledge, had already been disclosed or carried no duty of confidentiality, the subject matter of the offence is missing.
2. Functional connection: establishing whether or not the information was learned by reason of the office determines the applicable offence (417 versus 197/198).
3. Absence of intent: a negligent disclosure or a careless remark made without awareness of the duty of confidentiality does not satisfy the mental element.
4. No serious harm: contesting the aggravated form in order to bring the facts back to the basic offence, which carries no imprisonment.
5. Civil liability: reviewing whether the moral damages claimed are real and proportionate to the dissemination and the seriousness of the intrusion.

We also act for the injured party, bringing a private prosecution to claim compensation for moral damages. You can read more in our analysis of Article 197 CP.