PortugalLei n.o 58/2019, Portuguese GDPR Implementation Law (Lei de Execução do RGPD)
Lei n.o 58/2019, de 8 de agosto
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Portugal, including data collected by crawling.
These lines are LexLint's reading of the law's text. Also read by: Comissão Nacional de Proteção de Dados (CNPD) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.cnpd.pt/umbraco/surface/cnpdDecision/download/121704
- Guidance body
- Comissão Nacional de Proteção de Dados (CNPD)
- Open questions
- Must a controller or a court apply the provisions of Lei 58/2019 that the CNPD has said it will disapply in its future cases, such as Article 39(1) and (3) on the criteria for setting a fine, or only the CNPD itself?
What it makes you log
Who may demand the log
Data subject
What the log must hold
Access record
Logging duty
For health and genetic data the controller must give the data subject a mechanism that notifies them of any access to their data, and the technical rules to be set by ministerial order are to cover an electronic record of accesses and of the data accessed. The Law states no retention period for that record. The audit expectation comes from Article 11(a), the data protection officer's function of ensuring periodic and unscheduled audits, which fixes no interval.
- Kind
- Explicit
- As of
- Provision
- Lei 58/2019, Art. 29(6) and (7)(c)
- Trigger
- personal_data_processing
What this law does
Portugal's private-sector regime is the General Data Protection Regulation (GDPR) plus Lei n.o 58/2019, de 8 de agosto (Lei de Execucao do RGPD, GDPR Implementation Law), in force from , the day after its publication (Article 68(1)).
Portugal is genuinely divergent here: the CNPD, in Deliberacao n.o 2019/494 of , announced it would decline to apply a set of Lei 58/2019's own provisions in its enforcement decisions, on the ground that those provisions restrict the GDPR's direct effect and full effectiveness contrary to the primacy of EU law.
The CNPD presents this as a decision to disapply the listed provisions in the future cases it examines, which it made public for the transparency of its future decision-making and for legal certainty.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .