- Enforcing jurisdiction
- Portugal · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
Setúbal municipality – €180,000 Fine (Portugal, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
Setúbal municipality was fined EUR 180,000 for mishandling personal data of Ukrainian refugees. The municipality failed to properly inform the refugees about how their data would be used, which is crucial for protecting their privacy.
What happened
Setúbal municipality collected personal data from Ukrainian refugees without providing adequate information about the data processing.
Who was affected
Ukrainian refugees who were asked to provide personal information upon arrival.
What the authority found
The Portuguese DPA found that the municipality violated GDPR by not informing refugees about data processing and failing to implement necessary data protection measures.
Why this matters
This ruling emphasizes the importance of transparency and data protection for organizations handling sensitive information. Municipalities and similar entities should strengthen their data handling protocols to protect vulnerable populations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Review needed — 6 March 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Portuguese DPA has imposed a fine of EUR 170,000 on Setúbal municipality. The DPA found data protection violations regarding the collection of personal data from Ukrainian refugees. The municipality had asked refugees to fill out a form at the time of their arrival and provide various details on personal data, such as name, date of birth, marital status, etc. The DPA noted, that the municipality had not sufficiently informed the data subjects about the data processing. In addition, the DPA found that the municipality had failed to implement sufficient technical and organizational to protect personal data, as well as to define a retention period for the data. The municipality had also failed to appoint a data protection officer.
Related Enforcement Actions (0)
No other enforcement actions found for Setúbal municipality in PT
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
2 November 2022
Authority
Comissão Nacional de Proteção de Dados
Fine Amount
€180,000
About this data
Cite as: Cookie Fines. Setúbal municipality - Portugal (2022). Retrieved from cookiefines.eu
Last updated: