Enforcement · Portuguese Data Protection Authority (CNPD) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Setúbal municipality: Non-compliance with general data processing principles

€180,000 Fine
Setúbal municipality
PORTUGAL
Art. 5 GDPR Art. 13 GDPR Art. 37 GDPR
IP Address Personal Data Public Authority Storage Limitation Processing Agreement Education Retention Period Public Sector
Nov 2, 2022 Source

How it connects

Related across sources

Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Case Law GC and Others v CNIL CJEU Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ Spain: Preparations for a New Law on Data Protection to Implement the GDPR European Data Protection Law Review Literature GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR European Data Protection Law Review

Full text

The Portuguese DPA has imposed a fine of EUR 170,000 on Setúbal municipality. The DPA found data protection violations regarding the collection of personal data from Ukrainian refugees. The municipality had asked refugees to fill out a form at the time of their arrival and provide various details on personal data, such as name, date of birth, marital status, etc. The DPA noted, that the municipality had not sufficiently informed the data subjects about the data processing. In addition, the DPA found that the municipality had failed to implement sufficient technical and organizational to protect personal data, as well as to define a retention period for the data. The municipality had also failed to appoint a data protection officer.

Industry: Public Sector and Education

Original document at the source www.cnpd.pt

Similar Content