Enforcement · Portuguese Data Protection Authority (CNPD) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Portuguese National Statistical Institute: Non-compliance with general data processing principles

The Portuguese DPA has fined the Portuguese National Statistical Institute EUR 4,3 million.

€4,300,000 Fine
Portuguese National Statistical Institute
PORTUGAL
Art. 5 GDPR Art. 9 GDPR Art. 12 GDPR Art. 13 GDPR Art. 28 GDPR Art. 35 GDPR Art. 44 GDPR Art. 46 GDPR
Privacy Shield Controllers Processors DPIA Processing Agreement
Nov 2, 2022 Source cnpd.pt

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline
§

The Portuguese DPA has fined the Portuguese National Statistical Institute EUR 4,3 million. The DPA found numerous violations of the GPDR in connection with the 2021 census in Portugal. The DPA first found that the controller had failed to inform the data subjects that the provision of religious and health data was purely voluntary. The DPA considered this to be an interference with the data subjects' ability to freely express their will regarding data processing. In addition, the DPA found that the controller failed to exercise due diligence in selecting its processor, contrary to its obligation under Art. 28 GDPR. In addition, the order processing contract permitted the transfer of personal data outside the EEA without providing for additional security measures besides the SCCS approved by the European Commission, as required under the Schrems II ruling. The DPA considered this to be a breach of Art. 44 GDPR and Art. 46 (2) GDPR.

Controllers Processors Personal Data applies Art. 46(2)Art. 28Art. 44
§

Finally, the DPA found that the controller failed to conduct a data protection impact assessment regarding the census. GDPR Articles: Art. 5 (1) a) GDPR, Art. 9 (1) GDPR, Art. 12 GDPR, Art. 13 GDPR, Art. 28 (1), (6), (7) GDPR, Art. 35 (1), (2), (3) b) GDPR, Art. 44 GDPR, Art. 46 (2) GDPR Industry: Public Sector and Education

DPIA Controllers Supervisory Authorities applies Art. 5(1)Art. 9(1)Art. 28(1)Art. 35(1)

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 13

Related across sources

C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems C-311/18 (Schrems II) CJEU Jul 16, 2020 Privacy Shield Processing Agreement International Transfer
C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield Supervision IP Address
2022 EDPB Annual Report 2021 Enhancing the depth and breadth of data protection 2 EDPB Annual Report 2021 2 ENHANCING THE DEPTH AND BREADTH OF DATA PROTECTION An Executive Summary of this report, which… May 12, 2022 Privacy Shield Processing Agreement International Transfer
Guidelines 03/2020 processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak Guidelines ·EDPB Apr 21, 2020 Healthcare Health Data Personal Data
Guidelines 2/2018 derogations of Article 49 under Regulation 2016/679 Guidelines on derogations of Article 49 Guidelines ·EDPB May 25, 2018 Privacy Shield Lawful Basis Legitimate Interest
2024 EDPB Annual Report 2023 EDPB Annual Report 2023 1 2023 ANNUAL REPORT SAFEGUARDING INDIVIDUALS' DIGITAL RIGHTS 2 FOREWORD 4 HIGHLIGHTS 2023 6 1. THE EDPB SECRETARIAT 8 1.1. MISSION AND ACTIVITIES IN 2023… Apr 23, 2024 Privacy Shield Privacy by Design & Default Privacy by Design
Related documents