Município de Setúbal – €170,000 Fine (Portugal, 2022)

The Portuguese DPA started an investigation into the Municipality of Setubal (controller) after a journalistic article from the newspaper Expresso was published titled Ukrainians welcomed in CDU Chamber by Pro-Putin Russians' ("Ucranianos recebidos em Câmara CDU por russos Pró-Putin"). This article contained anonymous accounts of Ukrainian refugees. According to the Article, Russian citizens were present in the same room where Ukrainian refugees' personal data was stored (such as copies of identification documents). These Russian citizens - allegedly part of an Eastern European Immigrants' Association (EDINSTVO), an organisation for the support of eastern European migrants - also asked the refugees questions about the whereabouts of their relatives and what they were doing in Ukraine. In total, two members of the EDINSTVO were integrated by the controller into the Setúbal Office of Ethnicities and Immigration (SEI) in order to provide assistance, counselling and help to the refugees. According to the author of the article, these Russian citizens were accused in the article of sharing this personal data with the Russian Government. This all happened in the framework of a Municipal Refugee Helpline (LIMAR), which was created in March 2022. The controller was responsible for the processing done by this helpline. The Helpline used two rooms of the controller's building in order to offer their services, one for the customer service and the other for archiving. Both rooms were only accessible for members of the helpline. The helpline used two forms in order to collect the data from refugees seeking attendance: an assistance form and telephone assistance form. Using these forms, personal data was collected by the controller. Among other things, the controller collected the name, address, date of birth, marital status, information on the support network (identifying the places and people they might stay with and their respective households) and information on the p