Cybersecurity Policy Report, Portuguese Court Upholds Fine Against Lisbon Over Unlawful Data Processing, (Aug 15, 2024)

By Tony Foley

The Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), announced on Tuesday that the Lisbon Administrative Court had upheld a 2021 administrative decision in which the agency fined the municipality of Lisbon for its disclosure of the personal data of political activists to third parties in violation of the European Union’s General Data Protection Regulation (GDPR).

CNPD initiated an investigation following a complaint by two citizens regarding the transmission of their personal data to the Russian embassy, and at the conclusion of the investigation, fined the municipality 1.5 million euros ($1.65 million). In a news release announcing the court decision, CNPD said the court agreed with the CNPD ruling. But the court reduced the proposed fine to 1.03 million euros ($1.13 million), excluding the infringements that expired between the CNPD’s 2021 decision and the date of the court decision.

The text of the CNPD’s original ruling may be accessed from the news release but is available only in Portuguese.

News: LitigationEnforcement DataPrivacy GDPR