The Portuguese data protection authority ('CNPD') issued, on 1 July 2021, a draft decision following an investigation into the Municipality of Lisbon in relation to demonstrations held since July 2018. In particular, the draft decision notes that the CNPD had initially found that the Municipality processed sensitive data without a legal basis and violated the necessity principle in breach of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') by unlawfully processing protestors' personal data internally and through transfers of the personal data to third parties.

In addition, the CNPD outlined that it had identified several further infringements of the GDPR, including lack of notice and sufficient information to data subjects about the processing of their personal data. Furthermore, the CNPD highlighted that the processing of protestors' personal data by various national and foreign entities allows for the profiling of individuals according to their ideas, opinions, and beliefs in an unlawful manner and one that completely escapes the Municipality's control. Finally, the CNPD outlined that it will issue its final decision in the administrative proceedings, following the Municipality's presentation of its defence to the CNPD's findings.

You can read the press release here and the decision here, both only available in Portuguese.

UPDATE (14 August 2024)

Administrative Court confirms CNPD's decision

The Portuguese data protection authority (CNPD) announced, on 13 August 2024, that the Lisbon Administrative Court confirmed the CNPD's conclusions that the Municipality had violated the GDPR and applied a fine of € 1.02 million, € 222,500 below what the CNPD had applied.

You can read the press release, only available in Portuguese, here.