is considered as treatment of sensitive data and their use must be authorized by
the CNPD.
There are some examples of case law in the field of “personal data processed by
electronic means”.
According to Article 5 of Law no. 41/2004, as amended by Law no. 46/2012, of
29 August 2012, the storage of data in the equipment of a user is only allowed in the
case of a previous consent, based on full and clear information given in compliance
with Law no. 67/98, notably identifying the purposes of the data processing.
This provision was approved basically in order to regulate the use of “cookies”.
The requirement of a previous consent is not applicable: (1) when the storage is
based on the purpose of sending a message through a network or (2) when it is
necessary in order to provide an information society service (Article 5/2).
In respect of minors, the Court of Appeal (Tribunal da Relação) of Évora decided
in 2015
4 that parents should not post photos or images in social networks that could
identify sons or daughters. According to the court, this was the only proportional
way to safeguard children’s rights of privacy and data protection in cyberspace.
One of the reasons invoked by the court in order to justify its decision was that
children driven by curiosity are especially vulnerable to sexual exploitation, due to
their acting without the necessary awareness as to the consequences of their behaviour online.
Insofar as the right to be forgotten is concerned, the CNPD ruled in its decision
no. 536/2016 (not publicly available) that a search engine must erase search results
related to a person that had been accused and was a target of public attention 8 years
earlier for the reason of being a suspect of committing a crime. However, in that case
the data subject was not convicted for the practice of any crime. The decision of
Portuguese DPA was adopted in on the basis of rules applicable to public
personalities.
In the field of marketing, Law no. 41/2004 is applicable with the amendments
introduced by Law no. 46/2012.
Article 13-A of Law no. 41/2004, introduced by Law no. 46/2012, enshrines an
opt-in system for unsolicited electronic messages sent for the purposes of direct
marketing. A previous consent by subscribers or users is required, especially for
messages sent in the context of systems without human intervention (section 1).
In what concerns legal persons, an opt-out system is applicable, whereby subscribers may object to future communications once they are enrolled in a list updated
by Direção Geral do Consumidor (General Directorate for Consumer Affairs)
(Article 13-B, section 2).
In spite of Article 13-A/1, where a natural or legal person obtains from its
customers their electronic contact details for electronic mail, in the context of the
sale of a product or service, in accordance with the Portuguese Data Protection Act,
the same natural or legal person may use these electronic contact details for direct
4 http://www.dgsi.pt/jtre.nsf/134973db04f39bf2802579bf005f080b/
7c52769f1dfab8be80257e830052d374?OpenDocument.
274
A. S. Pinheiro
the CNPD.
There are some examples of case law in the field of “personal data processed by
electronic means”.
According to Article 5 of Law no. 41/2004, as amended by Law no. 46/2012, of
29 August 2012, the storage of data in the equipment of a user is only allowed in the
case of a previous consent, based on full and clear information given in compliance
with Law no. 67/98, notably identifying the purposes of the data processing.
This provision was approved basically in order to regulate the use of “cookies”.
The requirement of a previous consent is not applicable: (1) when the storage is
based on the purpose of sending a message through a network or (2) when it is
necessary in order to provide an information society service (Article 5/2).
In respect of minors, the Court of Appeal (Tribunal da Relação) of Évora decided
in 2015
4 that parents should not post photos or images in social networks that could
identify sons or daughters. According to the court, this was the only proportional
way to safeguard children’s rights of privacy and data protection in cyberspace.
One of the reasons invoked by the court in order to justify its decision was that
children driven by curiosity are especially vulnerable to sexual exploitation, due to
their acting without the necessary awareness as to the consequences of their behaviour online.
Insofar as the right to be forgotten is concerned, the CNPD ruled in its decision
no. 536/2016 (not publicly available) that a search engine must erase search results
related to a person that had been accused and was a target of public attention 8 years
earlier for the reason of being a suspect of committing a crime. However, in that case
the data subject was not convicted for the practice of any crime. The decision of
Portuguese DPA was adopted in on the basis of rules applicable to public
personalities.
In the field of marketing, Law no. 41/2004 is applicable with the amendments
introduced by Law no. 46/2012.
Article 13-A of Law no. 41/2004, introduced by Law no. 46/2012, enshrines an
opt-in system for unsolicited electronic messages sent for the purposes of direct
marketing. A previous consent by subscribers or users is required, especially for
messages sent in the context of systems without human intervention (section 1).
In what concerns legal persons, an opt-out system is applicable, whereby subscribers may object to future communications once they are enrolled in a list updated
by Direção Geral do Consumidor (General Directorate for Consumer Affairs)
(Article 13-B, section 2).
In spite of Article 13-A/1, where a natural or legal person obtains from its
customers their electronic contact details for electronic mail, in the context of the
sale of a product or service, in accordance with the Portuguese Data Protection Act,
the same natural or legal person may use these electronic contact details for direct
4 http://www.dgsi.pt/jtre.nsf/134973db04f39bf2802579bf005f080b/
7c52769f1dfab8be80257e830052d374?OpenDocument.
274
A. S. Pinheiro