The Portuguese supervisory authority fines the Portuguese National Statistics Institute

In its Deliberation 1072 of 2022, the CNPD stated that INE has unlawfully processed personal data related to health and religion. Accordingly, it held that INE has not fulfilled its information obligations regarding the 2021 Census questionnaire, namely by violating the duties of diligence in the choice of the subcontractor, breaching the legal provisions regarding the international transfer of data, and failing to comply with its obligation to conduct a data protection impact assessment on the census operation.

In this connection, the CNPD concluded - as regards special data related to health and religion - that INE did not provide clear, transparent, and complete information on the optional nature of its provision by citizens, thereby disrespecting the legal obligation present in paragraph 4 of Article 4 of the Law on National Statistical Confidentiality. Based on this, the CNPD believes that this infringement did not allow citizens to correctly form their will, which is crucial for the assumptions of legality of the processing of these special categories of data.

The CNPD also considered that the duty of diligence was not complied with in the choice of the subcontractor, considering that the verification of the requirements of Article 28(3) of the GDPR should be substantive and not formal, and not limited to the choice of any standard clauses. In this case, despite the existence of a company office in Lisbon, the contract was made with the company based in the USA, and it was contracted that the forum to settle conflicts between the INE and Cloudflare, Inc. is the Court of California.

This same contract admits the transit of personal data through any of the company's 200 servers and that these may be processed outside the European Economic Area. 

Furthermore, it also includes the standard contractual clauses approved by the European Commission for the transfer of personal data to the USA, without providing for any additional measures preventing access to the data by third country government entities, in line with the Schrems II ruling of the Court of Justice of the European Union. Thus, the CNPD also concluded that INE infringed articles 44 and 46, paragraph 2, of the GDPR, regarding international data transfers.

To determine the amount of the fine applied, the CNPD took into consideration the nature, gravity, and duration of the infringement, as well as the number of data subjects affected. 

To this end, the CNPD concluded that the non-compliance verified assumes a significant degree of gravity, considering the number of personal data subjects concerned, i.e., the entire Portuguese population. In addition, the context in which they were practiced must be considered, i.e., people were convinced that it would be compulsory to answer all the topics in the census.

In fact, the offenses resulted in five fines of up to EUR 6.5 million. However, the CNPD eventually noted INE's lack of prior offenses and imposed a single fine of EUR 4.3 million. 

Finally, it should be said that this process is not yet closed, since INE has already legally contested the sanction applied.