## [Portugal: These were the data protection highlights in 2019](/en_GB/new/portugal-these-were-data-protection-highlights-2019) # Portugal: These were the data protection highlights in 2019 Portugal - 01 / 09 / 2020 Portugal Data Protection Commentary - - [](https://www.linkedin.com/sharing/share-offsite/?url=https://www.garrigues.com/en_GB/new/portugal-these-were-data-protection-highlights-2019) - []() - []() Previous Next **Undoubtedly, 2019 was a busy year in the area of privacy. In Portugal, the GDPR Enforcement Law was approved and the Portuguese Authority (CNPD) took the controversial decision of “disregarding” some of the respective rules. The EDPB and the TJUE were also active, issuing several decisions and opinions, some very interesting. At the end of the year, the Advocate General in case Schrems II gave us excellent news by confirming the validity of standard contractual clauses for transferring data outside the EU. Finally, both the CNPD and the other European supervisory authorities have issued the first fines under GDPR.** On our side, we delivered the first Privacy Training Series which included several topics, such as DPIAS, data breaches, data controllers/processors/joint controllers, marketing consent and GDPR implementation law. We benefited from a specialized and participative audience that contributed to an enriching discussion about the cases approached and the success of the sessions. **Here are some of the highlights of the year 2019.** **1. National Legislation** - **Law No. 58/2019 of 8 August,** which ensures the implementation in Portugal of Regulation (EU) 2016/679 of the Parliament and of the Council of 27 April 2016 on the protection of individuals, as regards the processing of personal data and the free movement of such data (GDPR). To consult, click [here.](https://www.cnpd.pt/bin/legis/nacional/Lei_58_2019.pdf) - **Law No. 59/2019 of 8 August,** adopting the rules on the processing of personal data for the purpose of preventing, detecting, investigating or prosecuting criminal offenses or the execution of criminal sanctions, transposing Directive (EU) 2016 / 680 of the European Parliament and of the Council of 27 April 2016. To consult, click [here.](https://www.cnpd.pt/bin/legis/nacional/Lei_59_2019.pdf) - **Law No. 46/2019 of July 8th,** which amends the regime for the exercise of private security activity and self-protection, which makes the first amendment to Law No. 34/2013, of May 16th. To consult, click [here.](https://www.cnpd.pt/bin/legis/nacional/Lei_34_2013_Seguranca_privada.pdf) ****2. European Data Protection Board (EDPB)**** - **January 2019:** Opinion on the legal basis for the processing of personal data in the context of clinical trials, in particular as regards the primary use of data for the clinical trial protocol itself and secondary use for other scientific purposes. To consult, click [here.](https://edpb.europa.eu/our-work-tools/our-documents/avis-art-70/opinion-32019-concerning-questions-and-answers-interplay_en) - **March 2019:** Opinion on the interaction between the ePrivacy Directive and the GDPR. The EDPB points out that the ePrivacy Directive (and its transposition laws) is lex specialis for GDPR, which means that whenever there is a “special rule” regarding the processing of personal data that is more specific than the rule of the GDPR, it takes precedence over the latter. To consult, click[ here](https://edpb.europa.eu/sites/edpb/files/files/file1/201905_edpb_opinion_eprivacydir_gdpr_interplay_en_0.pdf). - **July 2019:** The preliminary version of the guidelines on the processing of personal data through video surveillance systems were published for public consultation, - **October 2019:** The final version of the guidelines on the scope of Article 6 (1) (b) of the GDPR in the context of information society services. The legal grounds for the processing of data for performance of a contract to which the data subject is a party or for pre-contractual diligences, including behavioural advertising, are addressed. To consult, click [here.](https://edpb.europa.eu/sites/edpb/files/consultation/edpb_draft_guidelines-art_6-1-b-final_public_consultation_version_en.pdf) - **November 2019:** The final version of the guidelines on the territorial scope of the GDPR. The guidelines aim to provide a common interpretation to the various Member States to assess whether a particular processing activity falls within the territorial scope of the GDPR. To consult, click [here.](https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en.pdf) - **November 2019:** Published, for public consultation, the preliminary version of Guidelines 4/2019 regarding privacy by design and by default. To consult, click [here.](https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201904_dataprotection_by_design_and_by_default.pdf) - **December 2019:** Following the EDPB opinion (July 2019) on drafting standard contractual clauses (SCCs) for contracts between controller and processor submitted to the Council by the Danish Supervisory Authority, the final text was published by the EDPB. To consult, click [here.](https://edpb.europa.eu/sites/edpb/files/files/file2/dk_sa_standard_contractual_clauses_december_2019_en.pdf) - **December 2019:** Publication of the draft guidelines on the right to be forgotten in search engine cases. To consult, click [here.](https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_201905_rtbfsearchengines_forpublicconsultation.pdf) - The EDPB approved, **throughout the year**, the lists of personal data processing activities subject to Data Protection Impact Assessments, pursuant to Article 35 (4) of the GDPR. To see the national list, click [here.](https://www.cnpd.pt/bin/decisoes/regulamentos/regulamento_1_2018.pdf) ******3. European Court of Human Rights (ECHR)****** - **LÓPEZ RIBALDA & others v. SPAIN:** The ECHR's Grand Chamber reversed an earlier decision issued by the Chamber, arguing that the use of CCTV by a Spanish employer to detect workplace theft does not infringe Article 8 of the European Convention on Human Rights. To consult, click [here.](https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-197098%22]}) ********4. CNPD******** - **Deliberation 2019/494:** which disregards some rules of Law No. 58/2019, of 8 August, because they allegedly contradict the provisions of the GDPR. To consult, [click here](https://www.cnpd.pt/bin/decisoes/Delib/DEL_2019_494.pdf). - **Deliberation 2019/495:** interpretative resolution on the exemption from fines of public entities, provided for in Article 44 (2) and Article 59 of Law 58/2019 of 8 August. The CNPD considers that such a reasoned exemption can only be requested after a crime has been committed. To consult, click [here.](https://www.cnpd.pt/bin/decisoes/Delib/DEL_2019_495.pdf) - **Guidelines 1/2019:** Regarding the processing of personal data in the context of election campaigns and political marketing. To consult, click [here.](https://www.cnpd.pt/bin/decisoes/Diretrizes/Diretriz_1_2019_PropagandaPolitica.pdf) - **Guidelines 2/2019:** Regarding the processing of personal data in the context of intelligent electricity distribution networks. To consult, click [here.](https://www.cnpd.pt/bin/decisoes/Diretrizes/Diretriz_2_2019_contadoresInteligentes.pdf) **5. Other Supervisory Authorities** **CNIL (French Authority)** - Updated guidelines on the use of cookies and similar technologies. To consult, click [here](https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000038783337). - Opinion on facial recognition and the legal, technical and ethical aspects that should be taken into account. To consult, click [here.](https://www.cnil.fr/sites/default/files/atoms/files/reconnaissance_faciale.pdf) **ICO (UK Authority)** - Updated guidelines on the use of cookies and similar technologies. To consult, click [here.](https://ico.org.uk/media/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies-1-0.pdf) - Guidelines on the handling of special categories of data. To consult, click [here.](https://ppc.land/wp-content/uploads/special-category-data-1-0-ICO.pdf) - Preliminary version of the updated guidelines regarding data access requests by data subjects. To consult, click [here.](https://ico.org.uk/media/about-the-ico/consultations/2616442/right-of-access-draft-consultation-20191204.pdf) **AEPD (Spanish Authority)** - Updated guidelines on the use of cookies and similar technologies. To consult, click [here.](https://www.aepd.es/sites/default/files/2019-12/guia-cookies_1.pdf) - Guidance on privacy by design. To consult, click [here.](https://www.aepd.es/sites/default/files/2019-11/guia-privacidad-desde-diseno.pdf) **6. Court of Justice of the European Union** - **Fashion ID Judgment (C-40/17):** Established that website operators are joint controllers with Facebook in handling data collected and transmitted to Facebook through a 'like' plug-in, which allows Facebook to collect data from the operator's website. To consult, click [here.](http://curia.europa.eu/juris/document/document.jsf?text=&docid=216555&pageIndex=0&doclang=EN) - **Planet49 Judgment (C-673/17):** This decision confirms that the declaration of consent through a pre-ticked box is not valid as consent for the use of cookies. The controller should provide the user with information about cookies, including the duration of the processing and whether or not it allows access by third parties. To consult, click [here.](http://curia.europa.eu/juris/document/document.jsf;jsessionid=5C1556FEB8C4D26383BB7792668590E1?text=&docid=218462&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=1750364) - **Google Judgment (Right to be Forgotten) (C-136/17):** Clarifies that when accepting a request to de-reference the search engine operators are not required to de-reference the results on all of their search engine’s domain name extensions (i.e., worldwide), but only on the domain names corresponding to the EU Member States’ versions of the search engine To consult, click [here.](http://curia.europa.eu/juris/document/document.jsf;jsessionid=612AEEEEEC012062A19C5E9C22518069?text=&docid=218106&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=941650) - **Buivids judgment (C-345/17):** The CJEU clarifies that the publication, without restriction of access, of a video on YouTube (or in another video internet site) on which users can upload, view and share, and making accessible personal data to an indefinite number of persons, constitutes processing of personal data which is not part of the exercise of purely personal or domestic activities. According to the Court, such publication may constitute processing of personal data for purely journalistic purposes, within the meaning of the GDPR, provided that it follows from that video that such recording and publication is for the sole purpose of disclosing information, opinions and ideas to the public. To consult, click [here.](http://curia.europa.eu/juris/document/document.jsf?text=&docid=206183&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1) - **Schrems II (Case C-311/18):** The Advocate General of the Court of Justice of the European Union (CJEU) recommended that the CJEU uphold the validity of the Standard Contractual Clauses (SCCs) as an appropriate mechanism for transfer of personal data outside the EU. To consult, click [here.](https://curia.europa.eu/jcms/upload/docs/application/pdf/2019-12/cp190165en.pdf) ****7. Sanctions**** The fines imposed by the European supervisory authorities on controllers and processors for infringing personal data protection legislation increased exponentially throughout 2019. The increase was noticeably steeper from July 2019. **Here are some of the fines imposed to data controllers and processors in Portugal and in other EU countries in 2019.** [![](/sites/default/files/20200109_ano_nuevo_portugal_en.jpg)](https://www.garrigues.com/sites/default/files/documents/20200109_ano_nuevo_portugal_en.pdf) [Portugal](/en_GB/tags/portugal), [Data Protection](/en_GB/tags/data-protection) ### Related services - [Technology, Communications and Digital ](/en_GB/services/technology-communications-and-digital) ### Related offices - - [Lisbon](/en_GB/office/lisbon) - [Oporto](/en_GB/office/oporto) ## Find a publication - [Administrative and Constitutional Law](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1422) - [Agribusiness and Food](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1417) - [Automotive](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1419) - [Banking and Finance](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1443) - [Corporate and M&A](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1441) - [Corporate Governance and Sustainable Development](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A12823) - [Criminal Law and Internal Investigations](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1434) - [Data Economy, Privacy and Cybersecurity](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A10913) - [Dispute Resolution: Litigation and Arbitration](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1412) - [Energy](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A10916) - [EU and Antitrust Law](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1416) - [Family Business](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1413) - [Fashion Law](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1435) - [Financial Regulation](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A10915) - [G-advisory](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A12821) - [Human Capital Services](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1431) - [Infrastructure](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A10914) - [Insurance](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1438) - [Intellectual Property](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1421) - [Labor and Employment](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1424) - [Life Sciences and Healthcare](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1429) - [Media and Entertainment](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1433) - [Planning, Zoning and Environment](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1444) - [Private Equity](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1439) - [Real Estate](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A10927) - [Restructuring and Insolvency](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1420) - [Securities Markets](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1442) - [Sports](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1430) - [Startups & Open innovation](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1426) - [Sustainability](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A10921) - [Tax](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1425) - [Technology, Communications and Digital](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1436) - [Tourism and Hotels](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1432) - [Transport, Logistics and Shipping](/en_GB/markdownify/node/8158?f%5B0%5D=service%3A1428) Facet Services detail - [Publications](/en_GB/markdownify/node/8158?f%5B0%5D=publication_type%3A794) - [Newsletters](/en_GB/markdownify/node/8158?f%5B0%5D=publication_type%3A107) - [Garrigues collection](/en_GB/markdownify/node/8158?f%5B0%5D=publication_type%3A101) - [Laws: amendments at a glance](/en_GB/markdownify/node/8158?f%5B0%5D=publication_type%3A104) - [News](/en_GB/markdownify/node/8158?f%5B0%5D=publication_type%3A105) Facet Publication type detail Min Max ## News search engine