skip to content
 

Data Protection Laws and Freedom of Expression: Portugal Flag of Portugal

 

 

I. First-Generation Statutory Law

 
Special Expression Derogation
No special provision was adopted.
 
Broad Expression Derogation
According to Art. 1, the processing of data shall be conducted transparently and with complete respect for private and family life and the citizen’s rights, freedoms and fundamental guarantees.
 
Personal Exemption
Pursuant to Art. 3(2)(a), the Law did not apply to personal data files containing only information intended for personal or domestic use.
 
Knowledge Facilitation Framework
Art. 11(2) exempted the processing of data for research or statistical purposes from the prohibition to process sensitive personal data, provided that the persons concerned are not identifiable. The processing of data for statistical purposes was moreover exempted from the requirement to indicate certain information on documents used to collect personal data (art. 22(2)).
Parliamentary Debates
Special Expression Derogation
No relevant debates were recorded.
 
Broad Expression Derogation
In the parliamentary debates, concerned were voiced with regard to cross-border data exchange. It was observed that cross-border data circulation increases as the models of communication become more transnational with the use of satellites and optical fibre and makes the identification or the data that is circulating a very complex and difficult task.[1]
 
Personal Exemption
No relevant debates were recorded.
 
Knowledge Facilitation Framework
Mention was made that the data protection law would constitute a framework for the protection of medical data, statistical and scientific research data, direct marketing, social security, police and employment data. However, the knowledge facilitation derogations were not further discussed.[2]
 

II. Second-Generation Statutory Law

Portugal implemented the Directive 95/46/EC with Act 67/98 on the Protection of Personal Data on 26 October 1998.
 
Special Expression Derogation
Portugal applied the data quality principles without restriction to the media. However, it unconditionally exempted the media as well as processing for artistic or literary expression from the proactive direct and indirect transparency rule (art. 10(6)). With regard to the retroactive transparency rule, Portugal provided a full exception based on compliance with strict rules, namely, that the controller agrees to allow the Data Protection Authority to access the data vicariously on the data subject’s behalf (art. 11(3) and (4)). No exemption, in contrast, was provided from the sensitive data rules and the legitimating ground, the notification of processing and data export conditions.
 
Broad Expression Derogation
Just as in the first-generation data protection law, Art. 2 of the Act on the Protection of Personal Data provided that the processing of personal data shall be carried out transparently and in strict respect for privacy and for other fundamental rights, freedoms and guarantees.
 
Personal Exemption
According to Art. 4(2), the Act did not apply to the processing of personal data carried out by a natural person in the course of a purely personal or household activity.
 
Knowledge Facilitation Framework
Art. 5(2) of the Act exempts the processing of personal data for statistical, historical and scientific research purpose from time limits, if so authorized by the Data Protection Authority. Art. 10(5) of the Act exempts the processing of personal data for statistical, historical or scientific research purposes from the proactive direct and indirect transparency rule, if so provided by law or a decision by the Data Protection Authority, when the provision of information proves impossible or would involve disproportionate effort or if recording or disclosure is expressly laid down by law. Processing of personal data for scientific research purposes or data kept in personal form for a period which does not exceed the period necessary for the sole purpose of creating statistics was, moreover, exempted from the retroactive transparency rule, if there was clearly no risk of breaching fundamental rights, freedoms and guarantees of the data subject, particularly the right to privacy (art. 11(6)). No exemptions were granted from the sensitive data rules and the legitimating ground, the notification of processing and data export conditions.
Parliamentary Debates
Special Expression Derogation
The Secretary of State for Justice, Lopes da Meta, elaborated on the relevant provisions. However, no substantive debates were recorded.[3]
 
Broad Expression Derogation
In the parliamentary debate, the State Secretary for Justice, Lopes da Meta, observed that the implementation of the Directive would allow finding an equilibrium between the evolution of new digital technologies and the protection of fundamental rights of individuals.[4]
 
Personal Exemption
No relevant debates were recorded.
 
Knowledge Facilitation Framework
No relevant debates were recorded.
 

III.Third-Generation Statutory Law

Portugal adopted third-Lei no 58/2019.  A companion law, Lei no 39/2019, was adopted in the area of law enforcement processing.
 
Special Expression Derogation
Art. 24 of the Lei no 58/2019 addresses the relationship between freedom of expression, information and the press and data protection. Pursuant thereto, the protection of personal data does not prejudice the exercise of the freedom of expression, information and the press, including the processing of data for journalistic purposes and for academic, artistic or literary purposes. According to Art. 24(3), the processing of personal data for journalistic purposes must comply with national legislation on access to the journalistic profession. Whilst not providing a specific reference, these special expression provisions do explicitly establish their priority over the knowledge facilitation framework.
 
Broad Expression
Art. 24 stipulates a broad expression derogation, providing that the protection of personal data does not prejudice the exercise of the freedom of expression, information and the press. Pursuant to Art. 24(2), the exercise of the freedom of information, especially where sensitive data pursuant to Art. 9 GDPR and data concerning a deceased person (Art. 17 of the implementing law) are revealed, shall respect the principle of dignity of the human person as provided in the Portuguese Constitution, as well as the personality rights in the Constitution and enshrined in national laws. However, pursuant to Art. 24(3), the exercise of freedom of expression does not legitimize the disclosure of personal data as addresses and contacts, except where such data is widespread knowledge.
 
Personal Exemption – see GDPR, art. 2(2)(c)
 
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Art. 31 regulates the processing of personal data for public interest archival purposes as well as for scientific or historical research and statistical purposes. Pursuant thereto, processing for such purposes should respect the principle of data minimization and include anonymization and pseudonymization, if the respective purposes can still be achieved. Derogations are permitted from the rights to access by the data subject (art. 15 GDPR), to rectification (art. 16 GDPR), to restriction of processing (art. 18 GDPR), and to object (art. 21 GDPR) to the extent necessary if these rights would be likely at least to seriously harm achievement of the purposes. In relation to the processing of personal data for scientific research purposes, Art. 31(4) provides that consent may cover various areas of research or be given solely for specific fields or research projects. Ethical standards generally recognized by the scientific community must thereby be complied with.  No other special provisions for modifying the rules applicable to sensitive data were specified.  Pursuant to Art. 31(5), statistical data should be anonymized or pseudonymized to make an identification of the data subject impossible as soon as the statistical operation is completed.
Parliamentary Debates
Special and Broad Expression Derogation
MP Vânia Dias da Silva asked a question with regard to the relationship between data protection and freedom of expression, noting her concern that there could be ‘constitutional censorship’. In particular she notes that any requirement for preliminary examination[5] by the Data Protection Authority would have to be avoided.[6] MP António Filipe also criticized the relationship between data protection and freedom of expression as regulated in the proposed implementation law as unacceptable. However, he did not elaborate as to why this is so.[7]
No further debates were recorded.
 
Knowledge Facilitation Framework
No relevant debates were recorded.[8]
 

[1] Parlamentares, Diário N°65 (18 April 1990), p. 2226.
[2] Parlamentares, Diário N°65 (18 April 1990), p. 2226.
[3] Parlamentares, Diário N°77 (4 June 1998), p. 2679.
[4] Parlamentares, Diário N°07 (30 September 1998), p. 211.
[5] Most likely in line with Art. 36 GDPR.
[6] Diário da Assembleia da República, Reunião Plenária de 3 de Maio de 2018 https://app.parlamento.pt/webutils/docs/doc.pdf?path=6148523063446f764c3... (last accessed 4 April 2021).
[7] Ibid, p. 14.
[8] Ibid.