Sanction RGPD Portuguese Data Protection Authority (CNPD) — Setúbal municipality : 180 k€ (2022)
- Autorité de contrôle
- Portuguese Data Protection Authority (CNPD)
- Pays
- Portugal
- Entreprise / secteur
- Setúbal municipality
- Montant de l'amende
- 180 k€
- Date de la décision
- 2 novembre 2022
- Fondement juridique
- Art. 5 (1) e), f), Art. 13 (1), (2), Art. 37 (1), (7)
- Manquement
- Non-respect des principes de traitement
Résumé des faits
The Portuguese DPA has imposed a fine of EUR 170,000 on Setúbal municipality. The DPA found data protection violations regarding the collection of personal data from Ukrainian refugees. The municipality had asked refugees to fill out a form at the time of their arrival and provide various details on personal data, such as name, date of birth, marital status, etc. The DPA noted, that the municipality had not sufficiently informed the data subjects about the data processing. In addition, the DPA found that the municipality had failed to implement sufficient technical and organizational to protect personal data, as well as to define a retention period for the data. The municipality had also failed to appoint a data protection officer.