DPA case Deliberação 548/2021 – €2,500 Fine (Portugal, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Portuguese municipality was fined for sharing Covid-19 patient information on Facebook, which violated privacy laws. This case is important because it shows that sharing sensitive health data without proper safeguards can lead to serious consequences.
What happened
The municipality shared personal health information about Covid-19 patients on social media.
Who was affected
Citizens whose health information was disclosed without consent.
What the authority found
The authority ruled that the municipality violated GDPR by processing sensitive health data unlawfully.
Why this matters
This case highlights the need for organizations to handle sensitive data responsibly. It serves as a reminder that even during a pandemic, data protection laws must be strictly followed.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A Portuguese municipality started to share on its page on Facebook information about Covid 19 contention measures since the beginning of the pandemic. This municipality shared that, in March 2020, a couple of citizens had been diagnosed with Covid 19 after traveling to France, also informing their place of residence and the period of the trip. The information was deleted from social media two months later. The Portuguese DPA (CNPD) launched an investigation on the matter. The municipality was notified about the decision's project involving violation of the GDPR, specifically lawfulness, fairness and transparency principles and the possibility of a subjection to an administrative fines up to €20,000,000 in January. In its defense, the municipality alleged the lack of legitimacy of the original person that brought up of the facts, the lack of guidance from the CNPD on the matter, the conflict between the rights of infected people and the rights of all other people, and the impossibility of identifying the infected holders between all the inhabitants of the place where they live with the information disclosed about the displacement to France. The CNPD concluded that the municipality had violated the GDPR by processing personal data as it did, revealing people's health information, as well as information about the trip taken by the patients and the period in which it occurred. As a controller, the municipality should be aware of how to carry out the respective processing of personal data. The Portuguese DPA considered that the case encompasses the biggest violation that can be made to the GDPR as it violates one of the basic principles of data protection, the principle of lawfulness, and also highlighted the fact that the infringement lasted two months. The authority also highlighted the fact that as the case involved the processing of sensitive data, which constitutes a special category of personal data which processing must be based on one of the legal bases set ou
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Deliberação 548/2021 in PT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
27 April 2021
Authority
Commission Nationale pour la Protection des Données
Fine Amount
€2,500
GDPRhub ID
gdprhub-3653About this data
Cite as: Cookie Fines. DPA case Deliberação 548/2021 - Portugal (2021). Retrieved from cookiefines.eu
Last updated: