Fines imposed by the CNPD have exceeded 4.8 million Euro in 2022

​published on 23 March 2023 | reading time approx. 3 minutes

In 2022, fines for breaches of legislation on the protection of personal data increased, with the National Commission for Data Protection (CNPD) of Portugal applying 71 fines totalling more than 4.8 million Euro.

Most of these fines were for spam marketing, in violation of legal rules on privacy in electronic communications. The main reason for this high value is due to a fine amounting to 4.3 million Euro imposed on the National Statistics Institute (INE), which is currently under appeal. 

In comparison, in 2021, a total of 1.49 million Euro in fines were applied, mainly due to the fine applied to Lisbon City Council in the case of sending activist data to the Russian embassy, amounting to 1.25 million Euro.

During 2022, a total of 2,688 cases were opened, including requests for opinions under the legislative procedure and administrative regulations or protocols. 

An increase in inquiry procedures is noted, which concerns situations not only covered by the GDPR, but also by any Portuguese Legislation on the protection of Personal Data, particularly in the electronic communications sector and police sectors. 

Inspection activities at data controllers' premises, carried out with the help of criminal authorities, also increased in the year 2022.

A total of 149 cases of "safeguarding of rights" were opened, relating to the exercise of the rights of access and deletion of data, and also, the right to be forgotten exercised on search engines to remove persons names from the list of results when a search is made. 

With regard to notifications of personal data security breaches, (pursuant to Article 33 of the GDPR) 367 cases of personal data breaches were reported in 2022 both by private entities (295 cases) and public entities (72 cases).

The CNPD declared an increasing trend in personal data breaches reports culminating in a clear threat to the principle of confidentiality of information. 

Regarding the origin of the incidents, it is highlighted ransomware attacks (110 cases) and human failure (81 cases) as the causes of most of the personal data breaches reported.

At the end of 2022, the CNPD also registered, a total of 4,643 “Data Protection Officers (DPOs)” with active registration, which translates to an increase of 510 DPOs compared to 2021, culminating in a growing increase of notified DPOs. 

It is considered that this increase is due to the application of a fine to municipality of Setúbal amounting to 170.000 Euro for failing to comply with the obligation to designate a Data Protection Officer and for breaching the principle of the integrity and confidentiality of refugee data from Ukraine.

Over the last four years, the National Police of Portugal has recorded 36,013 reports of digital scams, stressing this is as “a growing criminal phenomenon”. 

Portugal was the third European country with most cyber-attacks reported in the year of 2022 according to IBM Security X-Force Threat. 

As the number of cyber-attacks continues to rise, it is crucial that companies and public entities adapt to the reality of cybersecurity to avoid breaches of personal data and also to comply with GDPR regulations, which requires that personal data be processed securely using appropriate technical and organizational measures in order to manage risks.