PortugalCNPD Deliberacao 2019/494, Disapplication of Lei 58/2019 Provisions in Portugal
CNPD Deliberacao n.o 2019/494, de 3 de setembro de 2019; Regulation (EU) 2016/679, Arts. 82-83
In force since , effective .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Lei 58/2019's Seccao III (Articles 46-54) creates a series of criminal offenses distinct from CNPD's administrative fines: using personal data incompatibly with its collection purpose, unauthorized access, diverting data, falsifying or destroying data, inserting false data, breaching a duty of secrecy, and disobeying a CNPD order, generally punishable by imprisonment up to one year or a fine up to 120 day-fines, doubled (up to two years or 240 day-fines) where the data is a special category under GDPR Articles 9-10, and up to four years for falsifying or destroying data causing particularly serious damage (Article 49).
Penalty structure
Lei 58/2019 Articles 37-38 had attempted a lower, differentiated national fine scale by legal-person status: very serious infringements from EUR 5,000 to 20,000,000 or 4% of turnover for a large company, EUR 2,000 to 2,000,000 or 4% for an SME, and EUR 1,000 to 500,000 for a natural person, roughly halved for serious infringements, plus a mandatory prior CNPD warning (Article 39(3)) before a non-intentional infringement could be fined at all. CNPD Deliberacao 2019/494 disapplied these national provisions as incompatible with GDPR primacy, so the undiluted GDPR Article 83(5) ceiling recorded here controls in practice, with a lower EUR 10,000,000/2% tier (Article 83(4)) for a narrower set of controller and processor obligations.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
CNPD, Comissao Nacional de Protecao de Dados
Enforcement record
CNPD's own Relatorio de Atividades 2025 (approved ): in 2025 the CNPD applied 2 fines totaling EUR 47,000, against a public entity (local administration) and a private entity (unauthorized SPAM advertising). The report's own multi-year fine-count chart shows a sharp decline (90 fines in 2023, 23 in 2024, 2 in 2025), which the report itself attributes largely to insufficient staff resources for handling contraordenacao proceedings; the CNPD instituted 88 such proceedings in 2025 that could have produced up to 90 fines had they concluded that year.
- As of
- Trend
- Falling
- Currency
- EUR
- Source link
- https://www.cnpd.pt/media/v50frkwy/relatorio-atividades-de-2025.pdf
- Fines per year
- 47,000
- Actions per year
- 2
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- Must a controller or a court apply the provisions of Lei 58/2019 that the CNPD has said it will disapply in its future cases, such as Article 39(1) and (3) on the criteria for setting a fine, or only the CNPD itself?
What it makes you log
Logging duty
The deliberation lists provisions of Law 58/2019 that the CNPD will not apply (Articles 2(1) and (2), 20(1), 23, 28(3)(a), 37(1)(a), (h) and (k) and (2), 38(1)(b) and (2), 39(1) and (3), 61(2) and 62(2)). None concerns a log or record, and GDPR Article 82, the other provision the row carries, gives a right to compensation and states no record duty.
- Kind
- None
- As of
What this law does
The CNPD is Portugal's supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. In Deliberacao n.o 2019/494 of , the CNPD announced it will not apply a defined set of Lei 58/2019's own provisions in its enforcement practice, reasoning that an EU regulation has direct effect and primacy over conflicting national law under Article 288 TFEU and settled CJEU case law.
The deliberation lists Article 2(1) and (2), Article 20(1), Article 23, Article 28(3)(a), Article 37(1)(a), (h) and (k) and (2), Article 38(1)(b) and (2), Article 39(1) and (3), Article 61(2) and Article 62(2). It reasons that Article 28(3)(a) restricts the relevance of an employee's consent beyond what GDPR Articles 6(1)(a) and 9(2)(a) allow. It also reasons that national maximum fines below those of GDPR Article 83(4) and (5) violate the Regulation.
GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .