skip to content
 

Data Protection Laws and Freedom of Expression: Portugal Flag of Portugal

 

 

Constitutional/Primary Law Background - see also ECHR and EU Charter

The contemporary Portuguese Constitution (1976 as revised 2005) contains many provisions in this area including extensive data protection rights.  Article 37 prohibits censorship and protects the right to express and publicise thoughts and to inform others, themselves and be informed without hindrance or discrimination (subject to infractions being subject to the criminal or administrative law and procedure as applicable).  Article 38 seeks to establish freedom of the press, whilst Article 39 requires regulation of the media through an independent administrative body.   These articles fuse elements of liberal freedom (including unhindered right to found publications, journalists right to gain access to sources of information and their and other staff’s freedom of expression and creativity), codetermination rights (including the right of journalists  to elect editorial boards and generally take part in determining editorial policy) and social direction and control (including public radio and television and licensing other such outputs, preventing concentrating of the media and publicising the finances of media bodies).  Article 42 declares intellectual, artistic and scientific creation to be unrestricted, whilst Article 43 safeguards the freedom to learn and teach.  Turning to data protection and related rights, Article 35 requires legal guarantee of the protection of personal data especially by means of independent administrative body and rules on cross-border data flows.  This article also

  • guarantees citizen’s rights to access, correct, update and be informed on the purpose of especially computerized personal data (as laid down by law),
  • prohibits the unconsented processing of sensitive (including private life) data except for nonidentified statistics or with legal authorization and guarnatees of nondiscrimiantion, and
  • prohibits establishment of a single national identification number for citizens and generally prohibits third-party access to data.

Article 26 guarantees wide-ranging informational personality rights including the private of personal and family life and the right to personal identity, good name and reputation and image/likeness.  Article 34 establishes the inviolability of personal homes (with unconsented entry requiring legal authorized judicial authorization and further restrictions if at night) and the secrecy of private communications (with public authority interference only possible in criminal proceedings under law).  Finally, Article 37(4) guarantees both natural and legal persons an equal and effective right of reply and to make corrections, as well las compensation for any damage suffered.

The 1822 Constitution declared the free communication of thought as one of the most precious rights of man and prohibited the censorship of citizen’s opinion (art 8), declared the domicile of each citizen a sanctuary and prohibited entry except under law or by written order of competent authority (art 5) and declared inviolable the secrecy of letters (art 17).  The 1933 Constitution was the first to establish an explicit right to good name and reputation (art 8(2)).  Otherwise, the basic shape of the rights set out in the previous paragraph was only established under the 1976 Constitution.  The precise formulation of these provisions has changed subsequently.  For example, the original press freedom clause categorically excluded privately-owned television (art 38(6)).  Meanwhile, the right to image was only included in 1982.  The data protection clause (Article 35) has subject to particularly repeated amendment.  Originally data processing involving private life or other enumerated sensitive categories was entirely prohibited except for non-identifiable statistical purposes and in 1982 provisions generally prohibiting both third-party access and cross-border data flows were added.  Liberalisation of cross-border data flows occurred in 1989 and sensitive data in 1997 which also introduced an overarching guarantee of data protection especially through an independent administrative entity.

 

First-Generation Statutory Law

 
Special Expression Derogation
No special provision was adopted.
 
Broad Expression Derogation
According to Art. 1, the processing of data shall be conducted transparently and with complete respect for private and family life and the citizen’s rights, freedoms and fundamental guarantees.
 
Personal Exemption
Pursuant to Art. 3(2)(a), the Law did not apply to personal data files containing only information intended for personal or domestic use.
 
Knowledge Facilitation Framework
Art. 11(2) exempted the processing of data for research or statistical purposes from the prohibition to process sensitive personal data, provided that the persons concerned are not identifiable. The processing of data for statistical purposes was moreover exempted from the requirement to indicate certain information on documents used to collect personal data (art. 22(2)).
Parliamentary Debates
Special Expression Derogation
No relevant debates were recorded.
 
Broad Expression Derogation
In the parliamentary debates, concerned were voiced with regard to cross-border data exchange. It was observed that cross-border data circulation increases as the models of communication become more transnational with the use of satellites and optical fibre and makes the identification or the data that is circulating a very complex and difficult task.[1]
 
Personal Exemption
No relevant debates were recorded.
 
Knowledge Facilitation Framework
Mention was made that the data protection law would constitute a framework for the protection of medical data, statistical and scientific research data, direct marketing, social security, police and employment data. However, the knowledge facilitation derogations were not further discussed.[2]
 

Second-Generation Statutory Law

Portugal implemented the Directive 95/46/EC with Act 67/98 on the Protection of Personal Data on 26 October 1998.
 
Special Expression Derogation
Portugal applied the data quality principles without restriction to the media. However, it unconditionally exempted the media as well as processing for artistic or literary expression from the proactive direct and indirect transparency rule (art. 10(6)). With regard to the retroactive transparency rule, Portugal provided a full exception based on compliance with strict rules, namely, that the controller agrees to allow the Data Protection Authority to access the data vicariously on the data subject’s behalf (art. 11(3) and (4)). No exemption, in contrast, was provided from the sensitive data rules and the legitimating ground, the notification of processing and data export conditions.
 
Broad Expression Derogation
Just as in the first-generation data protection law, Art. 2 of the Act on the Protection of Personal Data provided that the processing of personal data shall be carried out transparently and in strict respect for privacy and for other fundamental rights, freedoms and guarantees.
 
Personal Exemption
According to Art. 4(2), the Act did not apply to the processing of personal data carried out by a natural person in the course of a purely personal or household activity.
 
Knowledge Facilitation Framework
Art. 5(2) of the Act exempts the processing of personal data for statistical, historical and scientific research purpose from time limits, if so authorized by the Data Protection Authority. Art. 10(5) of the Act exempts the processing of personal data for statistical, historical or scientific research purposes from the proactive direct and indirect transparency rule, if so provided by law or a decision by the Data Protection Authority, when the provision of information proves impossible or would involve disproportionate effort or if recording or disclosure is expressly laid down by law. Processing of personal data for scientific research purposes or data kept in personal form for a period which does not exceed the period necessary for the sole purpose of creating statistics was, moreover, exempted from the retroactive transparency rule, if there was clearly no risk of breaching fundamental rights, freedoms and guarantees of the data subject, particularly the right to privacy (art. 11(6)). No exemptions were granted from the sensitive data rules and the legitimating ground, the notification of processing and data export conditions.
Parliamentary Debates
Special Expression Derogation
The Secretary of State for Justice, Lopes da Meta, elaborated on the relevant provisions. However, no substantive debates were recorded.[3]
 
Broad Expression Derogation
In the parliamentary debate, the State Secretary for Justice, Lopes da Meta, observed that the implementation of the Directive would allow finding an equilibrium between the evolution of new digital technologies and the protection of fundamental rights of individuals.[4]
 
Personal Exemption
No relevant debates were recorded.
 
Knowledge Facilitation Framework
No relevant debates were recorded.
 

Third-Generation Statutory Law

Portugal adopted third-Lei no 58/2019.  A companion law, Lei no 39/2019, was adopted in the area of law enforcement processing.
 
Special Expression Derogation
Art. 24 of the Lei no 58/2019 addresses the relationship between freedom of expression, information and the press and data protection. Pursuant thereto, the protection of personal data does not prejudice the exercise of the freedom of expression, information and the press, including the processing of data for journalistic purposes and for academic, artistic or literary purposes. According to Art. 24(3), the processing of personal data for journalistic purposes must comply with national legislation on access to the journalistic profession. Whilst not providing a specific reference, these special expression provisions do explicitly establish their priority over the knowledge facilitation framework.
 
Broad Expression
Art. 24 stipulates a broad expression derogation, providing that the protection of personal data does not prejudice the exercise of the freedom of expression, information and the press. Pursuant to Art. 24(2), the exercise of the freedom of information, especially where sensitive data pursuant to Art. 9 GDPR and data concerning a deceased person (Art. 17 of the implementing law) are revealed, shall respect the principle of dignity of the human person as provided in the Portuguese Constitution, as well as the personality rights in the Constitution and enshrined in national laws. However, pursuant to Art. 24(3), the exercise of freedom of expression does not legitimize the disclosure of personal data as addresses and contacts, except where such data is widespread knowledge.
 
Personal Exemption – see GDPR, art. 2(2)(c)
 
Knowledge Facilitation Framework – see also GPDR, art. 5(1)(b) (compatibility), art. 5(1)(e) (time limits) and art. 89(1) (appropriate safeguards)
Art. 31 regulates the processing of personal data for public interest archival purposes as well as for scientific or historical research and statistical purposes. Pursuant thereto, processing for such purposes should respect the principle of data minimization and include anonymization and pseudonymization, if the respective purposes can still be achieved. Derogations are permitted from the rights to access by the data subject (art. 15 GDPR), to rectification (art. 16 GDPR), to restriction of processing (art. 18 GDPR), and to object (art. 21 GDPR) to the extent necessary if these rights would be likely at least to seriously harm achievement of the purposes. In relation to the processing of personal data for scientific research purposes, Art. 31(4) provides that consent may cover various areas of research or be given solely for specific fields or research projects. Ethical standards generally recognized by the scientific community must thereby be complied with.  No other special provisions for modifying the rules applicable to sensitive data were specified.  Pursuant to Art. 31(5), statistical data should be anonymized or pseudonymized to make an identification of the data subject impossible as soon as the statistical operation is completed.
Parliamentary Debates
Special and Broad Expression Derogation
MP Vânia Dias da Silva asked a question with regard to the relationship between data protection and freedom of expression, noting her concern that there could be ‘constitutional censorship’. In particular she notes that any requirement for preliminary examination[5] by the Data Protection Authority would have to be avoided.[6] MP António Filipe also criticized the relationship between data protection and freedom of expression as regulated in the proposed implementation law as unacceptable. However, he did not elaborate as to why this is so.[7]
No further debates were recorded.
 
Knowledge Facilitation Framework
No relevant debates were recorded.[8]
 

[1] Parlamentares, Diário N°65 (18 April 1990), p. 2226.
[2] Parlamentares, Diário N°65 (18 April 1990), p. 2226.
[3] Parlamentares, Diário N°77 (4 June 1998), p. 2679.
[4] Parlamentares, Diário N°07 (30 September 1998), p. 211.
[5] Most likely in line with Art. 36 GDPR.
[6] Diário da Assembleia da República, Reunião Plenária de 3 de Maio de 2018 https://app.parlamento.pt/webutils/docs/doc.pdf?path=6148523063446f764c3... (last accessed 4 April 2021).
[7] Ibid, p. 14.
[8] Ibid.