marketing of its own similar products or services, provided that customers are clearly
and distinctly given the opportunity to object, free of charge and in an easy manner,
to such use of electronic contact details at the moment of their collection and on the
occasion of each message in case the customer has not initially refused such a use
(Article 13-A, section 3).
The practice of sending electronic mail for purposes of direct marketing, which
disguise or conceal the identity of the sender, on whose behalf the communication is
sent, and which do not have a valid address to which the recipient may send a request
that such communications cease, is in any case forbidden (Article 13-A, section).
Article 13-B, under the title of “lists created for unsolicited messages”, establishes the obligation for legal persons that work in the field of direct marketing to
keep an updated list of data subjects that do not want to receive unsolicited messages
for the said purpose and a list of people who did not oppose to being recipients of
those messages.
Data subjects may be freely included in such lists. However, this requires filling
in a form in the web page of Direção Geral do Consumidor.
According to the Portuguese Labour Code (Article 20), personal data obtained by
distance surveillance means may only be kept during the necessary time in order to
achieve its purposes and must be destroyed as soon as the employee concerned is
transferred to another workplace, or upon termination of the employment contract.
The Portuguese Labour Code sets forth that the employee is entitled to confidentiality regarding the contents of private messages and the access to non-professional
information that he or she sends, receives or consults, notably by e-mail (Article 22).
The Portuguese DPA adopted Decision no. 1638/2013
5
—which is mandatory in
administrative field and has been highly influential in court decisions—which
concludes that:
(i) the employer should define in detail the level of tolerance regarding
employees’ use of their telephones and the forms of control adopted, keeping
in mind that a strict ban on personal communications is not allowed;
(ii) in certain areas, confidentiality is necessary in order to perform a professional
activity according to the law (as is the case, e.g., of lawyers, health professionals, and journalists), so it is not possible for the employer to monitor
their communications;
(iii) in cases where a detailed invoice is used, employers should ask the operator to
delete the last four numbers of all communications made;
(iv) notwithstanding the rules adopted by employers, they are not allowed to open
the communications of employees without their knowledge and consent;
(v) getting access to the communications of employees is always a measure of last
resort, even in cases where companies can be affected by the content of
electronic communications; in such cases access may only be allowed in the
presence of the employee or his/her representative;
5 https://www.cnpd.pt/bin/orientacoes/Delib_controlo_comunic.pdf.
Data Protection in the Internet: The Portuguese Case
275
and distinctly given the opportunity to object, free of charge and in an easy manner,
to such use of electronic contact details at the moment of their collection and on the
occasion of each message in case the customer has not initially refused such a use
(Article 13-A, section 3).
The practice of sending electronic mail for purposes of direct marketing, which
disguise or conceal the identity of the sender, on whose behalf the communication is
sent, and which do not have a valid address to which the recipient may send a request
that such communications cease, is in any case forbidden (Article 13-A, section).
Article 13-B, under the title of “lists created for unsolicited messages”, establishes the obligation for legal persons that work in the field of direct marketing to
keep an updated list of data subjects that do not want to receive unsolicited messages
for the said purpose and a list of people who did not oppose to being recipients of
those messages.
Data subjects may be freely included in such lists. However, this requires filling
in a form in the web page of Direção Geral do Consumidor.
According to the Portuguese Labour Code (Article 20), personal data obtained by
distance surveillance means may only be kept during the necessary time in order to
achieve its purposes and must be destroyed as soon as the employee concerned is
transferred to another workplace, or upon termination of the employment contract.
The Portuguese Labour Code sets forth that the employee is entitled to confidentiality regarding the contents of private messages and the access to non-professional
information that he or she sends, receives or consults, notably by e-mail (Article 22).
The Portuguese DPA adopted Decision no. 1638/2013
5
—which is mandatory in
administrative field and has been highly influential in court decisions—which
concludes that:
(i) the employer should define in detail the level of tolerance regarding
employees’ use of their telephones and the forms of control adopted, keeping
in mind that a strict ban on personal communications is not allowed;
(ii) in certain areas, confidentiality is necessary in order to perform a professional
activity according to the law (as is the case, e.g., of lawyers, health professionals, and journalists), so it is not possible for the employer to monitor
their communications;
(iii) in cases where a detailed invoice is used, employers should ask the operator to
delete the last four numbers of all communications made;
(iv) notwithstanding the rules adopted by employers, they are not allowed to open
the communications of employees without their knowledge and consent;
(v) getting access to the communications of employees is always a measure of last
resort, even in cases where companies can be affected by the content of
electronic communications; in such cases access may only be allowed in the
presence of the employee or his/her representative;
5 https://www.cnpd.pt/bin/orientacoes/Delib_controlo_comunic.pdf.
Data Protection in the Internet: The Portuguese Case
275