Disclosing Secrets vs Breaching Official Secrets: How Access to Information Makes the Difference

One of the most sensitive situations in criminal proceedings involving state actors is the leak of reserved information. An official, a police officer or a public figure passes on data that they obtained in the course of their duties. The immediate question is which criminal offence applies. The answer is not automatic: it depends, in the words of the Supreme Court, on how access to the information was obtained.

Two distinct offences for the same conduct

Article 197 of the Criminal Code (CP) protects personal privacy and confidentiality. It punishes a person who, without authorisation, takes possession of another's papers, letters, messages or personal data, or accesses computer or telecommunications systems without permission, and then discloses the information. The premise of the offence is clear: access was unauthorised. The provision covers both private individuals and officials acting outside the scope of their powers.

Article 417 CP, found among the offences committed by officials against constitutional guarantees, starts from a different factual premise: the authority or public official who reveals secrets or information of which they became aware by reason of their office or post. Here the access was entirely lawful; what becomes unlawful is the subsequent disclosure. The offence punishes disloyalty to the duty of confidentiality, not unlawful intrusion.

The key: how access was obtained

In the judgment resolving cassation appeal 3274/2023 (dated 26 March 2026), the Supreme Court draws a precise line between the two offences. The Chamber begins from a simple but consequential premise: two people may disclose the same reserved information and yet face different charges if the way they obtained it differs.

The distinguishing element is exclusively the origin of access:

• Where access was unauthorised — because the person acted outside their competence or without any legal basis — subsequent disclosure falls under Article 197 and, where the author is an official, under the aggravated Article 198 CP.
• Where access was legitimate by reason of their post — because the person had that right of knowledge in the exercise of their duties — improper disclosure falls under Article 417 CP, regardless of whether the content disclosed is identical.

The articles involved and their structure

Articles 197 and 198 CP form the core of the offences against privacy. Article 197 criminalises unauthorised access and the disclosure of personal data. Article 198 aggravates the penalties of Article 197 where committed by an authority or official outside the permitted cases, adding disqualification penalties. Both share an essential premise: access to the information was not authorised.

Article 417 CP operates on a different plane: it presupposes the legitimacy of access and criminalises subsequent disloyalty to the duty of confidentiality. The penalties include special disqualification from public employment or office, which has far-reaching consequences for the career of the official charged. The difference is not merely academic: the penalty, the competent court and the prosecutors involved all vary depending on which offence applies.

Relevance for the classification of leaking cases

Leaks of reserved information are among the most sensitive matters in criminal proceedings involving institutional actors. A classification error may have significant procedural consequences: nullities, inadmissibility of evidence, a change in the competent court or a substantial change in the applicable sentencing framework.

The doctrine set out by the Supreme Court in the judgment discussed serves as a direct reference for:

• Determining whether the prosecution has chosen the correct offence in its provisional charge sheet.
• Building a defence based on the nature of access — legitimate versus unauthorised — where the facts allow it.
• Raising the possible mismatch between the charged offence and the proven facts, and seeking a reclassification that fits the evidence.

Concurrence of provisions and the limits of each offence

A common question is whether Articles 197/198 and Article 417 CP can apply simultaneously to the same facts. The Supreme Court concentrates its analysis on the precise delimitation of each offence, emphasising that they have mutually exclusive premises as regards the origin of access. Articles 197/198 require unauthorised access; Article 417 requires legitimate access. Where, in a single case, an official obtained part of the information legitimately and another part without authorisation, a separate analysis by data block would be required, but simultaneous application of both provisions to the same facts would not be available.

The ruling therefore provides a robust interpretive criterion for refining the classification in complex cases involving leaks of different kinds, which is particularly useful where the facts span several defendants with different levels of authorised access to the information.