Law note · Portugal
Lei n.o 58/2019, Portuguese GDPR Implementation Law (Lei de Execucao do RGPD)
Portugal's private-sector regime is the General Data Protection Regulation (GDPR) plus Lei n.o 58/2019, de 8 de agosto (Lei de Execucao do RGPD, GDPR Implementation Law), in effect from its 8 August 2019 publication.
Portugal is genuinely divergent here: the CNPD, in Deliberacao n.o 2019/494 of 3 September 2019, announced it would decline to apply a set of Lei 58/2019's own provisions in its enforcement decisions, on the ground that those provisions restrict the GDPR's direct effect and full effectiveness contrary to the primacy of EU law.
This is not a repeal (the CNPD has no constitutional-court power to strike a provision down) and it does not bind the courts, which remain free to reach their own view if a disapplied provision is litigated; it is a supervisory authority's own prospective enforcement stance, published for transparency.
What it asks of an app
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Portugal, including data collected by crawling.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: Diario da Republica Eletronico, dre.pt, official text listing
CNPD Deliberacao n.o 2019/494 of 3 September 2019, read via three independent secondary paraphrases (Lexology, Garrigues, Recording Law), not the primary Portuguese-language deliberation text itself