Law note · Portugal
CNPD Deliberacao 2019/494, Disapplication of Lei 58/2019 Provisions in Portugal
The CNPD is Portugal's supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. In Deliberacao n.o 2019/494 of 3 September 2019, the CNPD announced it will not apply a defined set of Lei 58/2019's own provisions in its enforcement practice, reasoning that an EU regulation has direct effect and primacy over conflicting national law under Article 288 TFEU and settled CJEU case law.
Three independent secondary paraphrases of the deliberation (Lexology, Garrigues, Recording Law) agree the CNPD disapplies Article 28(3)(a) (restricting employee consent to processing that would grant a legal or economic advantage) and a penalties-framework provision in the Article 37 to 39 range (differentiated fine ceilings by company size, and a prior-warning requirement for negligent infringements); the three sources diverge on the rest of the disapplied list (Articles 61(2), 62(2), and 20(1) are each named by only some of the three), so this document records only what all three corroborate and does not assert a complete article list.
Two direct attempts to read the deliberation's own primary text failed this pass (an HTTP 403 behind bot protection, and unparseable compressed PDF structure at two mirrors). GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
What it asks of an app
- Expect the CNPD to decline to apply Lei 58/2019's own restriction on employee consent (Article 28(3)(a)) in its enforcement practice, treating the General Data Protection Regulation (GDPR) Article 6 and 9(2)(a) consent baseline as controlling instead for a person in Portugal.
- Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor, under GDPR Article 82.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, high_risk_decisions, processes_biometrics, processes_voice
Primary source: Three independent secondary paraphrases of CNPD Deliberacao 2019/494 (Lexology, Garrigues, Recording Law)
the primary Portuguese-language deliberation text was not reachable this pass