Law note · Portugal
GDPR Article 22 and Lei 58/2019, Automated Decisions in Portugal
General Data Protection Regulation (GDPR) Articles 12 to 23 apply, including Article 22 rights against a decision based solely on automated processing, restated by Lei 58/2019 without narrowing per its own summary.
One of the CNPD's disapplied provisions, Lei 58/2019 Article 20(1) (restricting access rights where a confidentiality or secrecy duty applies against the data subject), sits in this dimension: only one of three secondary sources read this pass names Article 20(1) among the disapplied provisions, so this document does not treat that specific finding as settled, and the GDPR Article 12 to 23 baseline is recorded as controlling.
What it asks of an app
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Portugal within one month of receipt.
- Provide a meaningful human review before finalizing any decision based solely on automated processing that produces legal or similarly significant effects for a person in Portugal, under General Data Protection Regulation (GDPR) Article 22.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: Official Journal text, EUR-Lex, Regulation (EU) 2016/679
secondary commentary on Lei 58/2019 Article 20(1), corroborated by only one of three sources read this pass