# Setúbal municipality: Non-compliance with general data processing principles

- Type: Enforcement
- Source: Portuguese Data Protection Authority (CNPD)
- Date: 2022-11-02
- Original: https://www.enforcementtracker.com/ETid-1498
- Canonical: https://overview.legal/posts/47613
- Topics: IP Address, Personal Data, Public Authority, Storage Limitation, Processing Agreement, Education, Retention Period, Public Sector, Supervisory Authorities, Processing

## Summary

The Portuguese DPA has imposed a fine of EUR 170,000 on Setúbal municipality. The DPA found data protection violations regarding the collection of personal data from Ukrainian refugees. The municipality had asked refugees to fill out a form at the time of their arrival and provide various details on personal data, such as name, date of birth, marital status, etc. The DPA noted, that the municipality had not sufficiently informed the data subjects about the data processing. In addition, the DPA f

## Full text

The Portuguese DPA has imposed a fine of EUR 170,000 on Setúbal municipality. The DPA found data protection violations regarding the collection of personal data from Ukrainian refugees. The municipality had asked refugees to fill out a form at the time of their arrival and provide various details on personal data, such as name, date of birth, marital status, etc. The DPA noted, that the municipality had not sufficiently informed the data subjects about the data processing. In addition, the DPA found that the municipality had failed to implement sufficient technical and organizational to protect personal data, as well as to define a retention period for the data. The municipality had also failed to appoint a data protection officer.

GDPR Articles: Art. 5 (1) e), f) GDPR, Art. 13 (1), (2) GDPR, Art. 37 (1), (7) GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/47613 · 2026-08-22