DPA case Deliberação 2019/494 – Violation Found (Portugal, 2019)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Portuguese data protection authority found that a new law could violate EU privacy rules. They pointed out that some provisions in the law might conflict with the General Data Protection Regulation (GDPR). This is important because it shows that national laws must align with EU regulations to protect individuals' privacy rights.
What happened
The authority identified potential conflicts between a new national law and EU privacy regulations.
Who was affected
Individuals whose privacy rights could be affected by the new national law.
What the authority found
The authority expressed concerns that the national law might not comply with EU privacy standards.
Why this matters
This opinion highlights the need for national laws to align with EU regulations, ensuring consistent protection of privacy rights across member states.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In its Opinion 20/2018 concerning the draft of [https://diariodarepublica.pt/dr/detalhe/lei/58-2019-123815982 Law 58/2019] which ensures the implementation of the GDPR in the portuguese national legal framework, the DPA drew the attention of the national legislator to a set of provisions that could potentially violate EU law, particularly the GDPR. The DPA emphasized the primacy of EU law as outlined in the EU treaties, particularly reflecting on Article 288 of the Treaty on the Functioning of the European Union (TFEU) and reinforced by the jurisprudence of the CJEU, which has consistently stated that national laws cannot obstruct the direct applicability of EU regulations and must comply with EU law to ensure uniform implementation across the Member States. However, [https://diariodarepublica.pt/dr/detalhe/lei/58-2019-123815982 Law 58/2019] came into force without incorporating all of the DPA's recommendations. The DPA explains that the decision to not apply some of its provisions aims to ensure legal certainty, reinforcing the importance of consistent GDPR application without being hindered by conflicting national rules. The DPA has decided to disapply the following provisions of Law 58/2019, in cases of personal data processing under its review due to their conflict with the GDPR: * Article 2(1)(2): This article broadens the territorial scope of the GDPR to encompass all personal data processing within national territory and processing linked to national establishments outside the territory. The DPA believes this contradicts Article 3 and Article 56 of the GDPR, which outlines the applicable law in cross-border situations. Additionally, it undermines the one-stop-shop mechanism and fails to address instances where the GDPR applies, such as in Portuguese embassies, consulates, ships, and aircraft. * Article 20(1): This article states that the right to be informed and the right of access cannot be exercised when a duty of secrecy is imposed on the data controll
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case Deliberação 2019/494 in PT
This is the only recorded action for this entity in this jurisdiction.
Details
Decision Date
3 September 2019
Authority
Commission Nationale pour la Protection des Données
GDPRhub ID
gdprhub-8331About this data
Cite as: Cookie Fines. DPA case Deliberação 2019/494 - Portugal (2019). Retrieved from cookiefines.eu
Last updated: