Portugal records maximum fines and data breaches in 2021

According to data provided by the CNPD, the major increase occurred in fines, which reached 60 last year with a total value of EUR 1.49 million, including penalties imposed under the GDPR and the law on privacy in electronic communications, which includes rules on spam and call recordings. It should be noted that the largest fine was imposed on Lisbon City Council (EUR 1.25 million) regarding the sensitive case involving the data of Russian activists sent to Moscow.

In the previous year, 15 fines had been applied, amounting to EUR 47,000, and in 2019 there were 34 fines, amounting to around EUR 600,000, with only seven of these sanctions being infringements of the GDPR (EUR 410,000) and the rest applied under previous legislation.

Summing up the sanctioning activity of the CNPD since the GDPR came into force, there were a total of 131 fines, which originated more than EUR 2.54 million. Regarding notifications of personal data breaches, the total was 318 last year under the GDPR, of which 250 in the private sector and 68 in the public sector.

Among the private sector, the highest prevalence occurred in the area of commerce and services (78 notifications), followed by banking and insurance (42). In the public sector, incidents in local administration (27) and in higher education (24) stood out.

In the origin of security incidents, human error comes in first place, with 77 notifications; followed by ransomware, with 70 notifications; phishing, with 38 incidents notified; and application failures, with 32. According to the CNPD, "the principle of confidentiality of data was the most compromised", with 249 cases, ahead of the principle of availability (86) and the principle of integrity (64), although an incident can affect more than one principle at the same time

The 318 personal data breaches in 2021 also had an increase from 301 notified in 2020, 240 in 2019 and 161 between 25 May and 31 December 2018. In total, the post-GDPR period accounts for 1,020 personal data breach notifications.

There were also 1,232 enquiry proceedings opened in 2021, among which are investigations at the CNPD's own initiative and denunciations from other entities, such as PSP, GNR, ASAE, MP or ACT (security forces and supervisory authorities). This represents an increase of 11.6% compared to the 1,104 cases of 2020 and is even higher than the records of 2019 (936) and the period of the GDPR in 2018 (610), resulting in a total of 3,882 over these years.

These processes cover not only situations covered by the GDPR, but also by any legislation on personal data protection, in particular in the electronic communications sector.

Regarding requests for opinions on draft legislation, regulations, protocols or video surveillance systems - whether in the sphere of the GDPR or the law on data protection for the purposes of criminal investigation and prosecution of criminal offences - the CNPD received 135 requests in 2021, more than was recorded in 2020 (105), 2019 (81) or 2018 (29), which makes 350 requests after May 2018.​