In its Decision no. 79/2014, the CNPD applied a fine to an electronic communication company, in the amount of €4,503,000, because it did not ensure the compliance with the security rules imposed by Law no. 41/2004.
9
The main powers of the Autoridade Nacional de Comunicações are set out in Law
no. 5/2004, of 10 February 2004, as amended, and comprise the following:
(i) Obtaining the necessary information in order to exercise its powers: “Entities
subject to obligations pursuant to the present law shall submit to ANACOM all
information, including financial information, in respect of their activity, in
order that ANACOM may exercise all its competences provided for in the
law (Article 108/1)”;
(ii) ANACOM may adopt interim measures whenever it has evidence of any
breach of the requirements set out in Articles 27, 28, 32 and 34 which represent
an immediate and serious threat to public policy, public security or public
health or which may create serious economic or operational problems to
other providers or users of electronic communications networks or services,
in which case it may take urgent interim measures to remedy the situation prior
to reaching a final decision, setting the period during which the measures shall
be in force (Article 111);
(iii) ANACOM is charged with monitoring compliance with the provisions of the
said law and its implementing regulations, through its monitoring agents or
representatives duly certified by the Board of Directors, without prejudice to the
competences conferred upon other entities, including the Inspectorate General
of Economic Activities (IGEA), the Directorate General of Customs (DGC),
the National Commission for Data Protection (NCDP), the Consumer Institute
and competent authorities in competition matters (Article 112);
(iv) Article 113 defines breaches and their respective fines. The breaches provided
for in this law are punishable with a fine from €500 to €3740 and from €5000 to
€5,000,000, depending on whether they concern natural or legal persons,
respectively (section 1). When the breach results from failure to comply with
a legal duty or an order of the National Regulatory Authority (the “NRA”), the
application of sanctions or the compliance therewith does not exempt the
offender from complying with the duty or order, where such compliance
remains possible (section 3).
(v) Additional sanctions (provided for in Article 114) are: (a) Loss in favour of the
State of objects, equipment and illicit devices, in the event of breaches provided
for in subsections qqq) and rrr) of section 1 of Article 113; (b) Prohibition from
the exercise by the offender of its activity for up to 2 years, for breaches
provided for in subsections a), h), l), n), p), x) and z) of section 1 of Article
113; (c) Forfeiture of the right to participate in tenders or auctions promoted
under the scope of the present law for up to 2 years, for breaches provided for in
subsections l), p), x) and z) of Article 113.
9 Processo n.
o 13112/2/20191.
Data Protection in the Internet: The Portuguese Case
279
9
The main powers of the Autoridade Nacional de Comunicações are set out in Law
no. 5/2004, of 10 February 2004, as amended, and comprise the following:
(i) Obtaining the necessary information in order to exercise its powers: “Entities
subject to obligations pursuant to the present law shall submit to ANACOM all
information, including financial information, in respect of their activity, in
order that ANACOM may exercise all its competences provided for in the
law (Article 108/1)”;
(ii) ANACOM may adopt interim measures whenever it has evidence of any
breach of the requirements set out in Articles 27, 28, 32 and 34 which represent
an immediate and serious threat to public policy, public security or public
health or which may create serious economic or operational problems to
other providers or users of electronic communications networks or services,
in which case it may take urgent interim measures to remedy the situation prior
to reaching a final decision, setting the period during which the measures shall
be in force (Article 111);
(iii) ANACOM is charged with monitoring compliance with the provisions of the
said law and its implementing regulations, through its monitoring agents or
representatives duly certified by the Board of Directors, without prejudice to the
competences conferred upon other entities, including the Inspectorate General
of Economic Activities (IGEA), the Directorate General of Customs (DGC),
the National Commission for Data Protection (NCDP), the Consumer Institute
and competent authorities in competition matters (Article 112);
(iv) Article 113 defines breaches and their respective fines. The breaches provided
for in this law are punishable with a fine from €500 to €3740 and from €5000 to
€5,000,000, depending on whether they concern natural or legal persons,
respectively (section 1). When the breach results from failure to comply with
a legal duty or an order of the National Regulatory Authority (the “NRA”), the
application of sanctions or the compliance therewith does not exempt the
offender from complying with the duty or order, where such compliance
remains possible (section 3).
(v) Additional sanctions (provided for in Article 114) are: (a) Loss in favour of the
State of objects, equipment and illicit devices, in the event of breaches provided
for in subsections qqq) and rrr) of section 1 of Article 113; (b) Prohibition from
the exercise by the offender of its activity for up to 2 years, for breaches
provided for in subsections a), h), l), n), p), x) and z) of section 1 of Article
113; (c) Forfeiture of the right to participate in tenders or auctions promoted
under the scope of the present law for up to 2 years, for breaches provided for in
subsections l), p), x) and z) of Article 113.
9 Processo n.
o 13112/2/20191.
Data Protection in the Internet: The Portuguese Case
279