in the context of sales and promotions when this required by costumers (right of
opposition). Companies should keep an updated a list of costumers who oppose to
direct marketing activities.
As a result of the described legal framework, personal data processing is generally
governed by the GDPR in Portugal. Law no. 58/2019 has, however, set out some
specific provisions in this respect, which seek to complement the provisions of that
EU Regulation. These include the following: (1) Minors’ consent for the processing
of personal data is only lawful when they have at least 13 years of age (Article 16);
(2) Personal data of deceased persons is also subject to protection (Article 17);
(3) Portability of data as provided for in Article 20 at the GDPR only comprises data
provided by their holders (Article 18); (4) Video-surveillance may not take place in
certain areas, such as public roads, ATM digitization zones or reserved areas in
which the privacy of users should by respected (Article 19); (5) Employers may
process data of employees for the purposes provided for in the Labour Code, the
employee’s consent not being required insofar as the processing results in a legal or
economic advantage for him or is covered by Article 6 (1) (b) of the GDPR (Article
28); (6) The processing of health and genetic data is governed by the “need to know”
principle (Article 29); and (7) Any person who has suffered damage due to the
unlawful processing of data or any other act in breach of the GDPR or national Law
on data protection is entitled to compensation from the controller or processor of
such data, unless they demonstrate that the fact that has caused the damage is not
attributable to them (Article 33).
Some of the provisions of Law no. 58/2019 triggered a heated debate and met
with opposition from the Portuguese supervisory body, the CNPD. On September
3, 2019, the CNPD approved Decision no. 494/2019, which declares the inapplicability of several provisions of Law no. 58/2019 on the ground that they are manifestly incompatible with European Union law and, in particular, with the GDPR. The
CNPD stated that, taking into account the principle of the primacy of European
Union law, in future cases it will not apply those specific provisions. These include
rules concerning the scope of Law no. 58/2019, the restriction of the access right,
and the powers of the CNPD to apply administrative sanctions.
2 Personal Data Processed by Electronic Means
In Portugal, the processing of personal data by electronic means is also generally
governed by the GDPR, which is complemented in this respect by some of the
provisions of Law no. 58/2019 and other specific laws, such as the Labour Code.
The Labour Code (approved by Law no. 7/2009, of 12 February 2009, and
subsequently amended) states that an employer cannot use distance surveillance
means—like CCTV cameras—at the workplace by using technological equipment,
which envisages the control of the professional performance of the employee
(Article 20). Only reasons of safety regarding people or goods, or special demands
connected to the specific activity may justify such a control. The use of these means
Data Protection in the Internet: The Portuguese Case
273
opposition). Companies should keep an updated a list of costumers who oppose to
direct marketing activities.
As a result of the described legal framework, personal data processing is generally
governed by the GDPR in Portugal. Law no. 58/2019 has, however, set out some
specific provisions in this respect, which seek to complement the provisions of that
EU Regulation. These include the following: (1) Minors’ consent for the processing
of personal data is only lawful when they have at least 13 years of age (Article 16);
(2) Personal data of deceased persons is also subject to protection (Article 17);
(3) Portability of data as provided for in Article 20 at the GDPR only comprises data
provided by their holders (Article 18); (4) Video-surveillance may not take place in
certain areas, such as public roads, ATM digitization zones or reserved areas in
which the privacy of users should by respected (Article 19); (5) Employers may
process data of employees for the purposes provided for in the Labour Code, the
employee’s consent not being required insofar as the processing results in a legal or
economic advantage for him or is covered by Article 6 (1) (b) of the GDPR (Article
28); (6) The processing of health and genetic data is governed by the “need to know”
principle (Article 29); and (7) Any person who has suffered damage due to the
unlawful processing of data or any other act in breach of the GDPR or national Law
on data protection is entitled to compensation from the controller or processor of
such data, unless they demonstrate that the fact that has caused the damage is not
attributable to them (Article 33).
Some of the provisions of Law no. 58/2019 triggered a heated debate and met
with opposition from the Portuguese supervisory body, the CNPD. On September
3, 2019, the CNPD approved Decision no. 494/2019, which declares the inapplicability of several provisions of Law no. 58/2019 on the ground that they are manifestly incompatible with European Union law and, in particular, with the GDPR. The
CNPD stated that, taking into account the principle of the primacy of European
Union law, in future cases it will not apply those specific provisions. These include
rules concerning the scope of Law no. 58/2019, the restriction of the access right,
and the powers of the CNPD to apply administrative sanctions.
2 Personal Data Processed by Electronic Means
In Portugal, the processing of personal data by electronic means is also generally
governed by the GDPR, which is complemented in this respect by some of the
provisions of Law no. 58/2019 and other specific laws, such as the Labour Code.
The Labour Code (approved by Law no. 7/2009, of 12 February 2009, and
subsequently amended) states that an employer cannot use distance surveillance
means—like CCTV cameras—at the workplace by using technological equipment,
which envisages the control of the professional performance of the employee
(Article 20). Only reasons of safety regarding people or goods, or special demands
connected to the specific activity may justify such a control. The use of these means
Data Protection in the Internet: The Portuguese Case
273