PortugalGDPR Articles 12-21 and Lei n.o 58/2019, Data Subject Rights in Portugal
Regulation (EU) 2016/679, Arts. 12-21; Lei n.o 58/2019, de 8 de agosto, arts. 20, 31
In force since .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Portugal within one month of receipt.
- You need not give a person in Portugal information about, or access to, their personal data under General Data Protection Regulation (GDPR) Articles 13 to 15 where a law imposes on you a duty of secrecy that can be invoked against that person, under Lei n.o 58/2019 article 20(1), although the CNPD has announced that it will not apply that article.
- You need not give effect to a person's rights of access, rectification, restriction or objection in Portugal for data you process for archiving in the public interest, scientific or historical research or statistics, to the extent those rights would make that purpose impossible or seriously impair it, under Lei n.o 58/2019 article 31(2).
These lines are LexLint's reading of the law's text. Also read by: Comissão Nacional de Proteção de Dados (CNPD) (guidance, recorded ); Case C-307/22 FT v DW, judgment of the Court of Justice (First Chamber) of (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307
- Guidance link
- https://www.cnpd.pt/cidadaos/direitos/direito-de-acesso-aos-dados/
- Case citation
- Case C-307/22 FT v DW, judgment of the Court of Justice (First Chamber) of
- Guidance body
- Comissão Nacional de Proteção de Dados (CNPD)
- Open questions
- Does the 'prazo legal de 30 dias' that the CNPD names for a reply to an access request replace the one-month period of Article 12(3) of the GDPR for a controller in Portugal?
What record it asks for
Logging duty
Articles 12 to 21 set how and when a controller answers a rights request. They state no duty to create, keep or produce a log or record of the request or the answer. Lei 58/2019 Article 20(1) bars the rights of GDPR Articles 13 to 15 where a secrecy duty can be invoked against the person, and Article 31(2) sets aside access, rectification, restriction and objection for archiving, research and statistics; neither states a record duty.
- Kind
- None
- As of
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Portugal can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. Lei n.o 58/2019 narrows these rights twice.
Article 20(1) bars the information and access rights of GDPR Articles 13 to 15 where a law imposes on the controller or processor a duty of secrecy that can be invoked against the person, and Article 31(2) sets aside access, rectification, restriction and objection, as far as necessary, for archiving, research and statistics that exercising them would make impossible or seriously impair. In Deliberacao 2019/494 the CNPD announced that it will not apply Article 20(1) in the cases it later examines.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .