Portuguese government can’t give local authorities guidance on data protection

the minister stressed that “the GDPR applies, naturally, to all public and private entities, and therefore also to municipal councils”. [EPA-EFE/ANTONIO PEDRO SANTOS]

The minister of state modernisation Alexandra Leitão said in parliament on Wednesday that it was not up to the government to give guidance to local authorities on the General on Data Protection Regulation (GDPR), assuming the “gravity” of the case of Lisbon City Council.

“The evaluation of the application of the GDPR to local authorities is not a matter for the State’s authority over local authorities, it is a matter for the CNPD [National Commission for Data Protection], as it is public that it has already done in the case of Lisbon City Council,” Leitão said, ruling out any interference in the actions of a regulatory authority.

The minister was speaking during a regular hearing in a parliamentary committee on the case of the sharing of personal data of protesters by Lisbon City Council, raised by social democrat MP Isaura Morais.

“The seriousness of the situation that occurred in Lisbon City Hall has already been referred to by the mayor of Lisbon himself,” the minister said, noting that she had been following the matter.

In this context, the minister stressed that “the GDPR applies, naturally, to all public and private entities, and therefore also to municipal councils”.

“Clarifications have already been given on this matter by the mayor of Lisbon, in the framework of the internal audit that he ordered and whose results he publicly announced”, said Leitão, considering that Fernando Medina (PS) “has already given the clarifications that he should give”.

At the beginning of June, it was made public that the municipality of Lisbon had sent the Russian authorities the names, addresses and contact details of three Russian activists who organised a protest in January outside the Russian embassy in Lisbon for the release of Alexei Navalny, an opponent of the Russian government.

When the case was reported, the mayor of Lisbon, Fernando Medina (PS), made a “public apology” for sharing that data, saying it was “an unfortunate mistake that should not have happened”.

The National Commission for Data Protection (CNPD) identified 225 offences in the communications made by the Lisbon City Council in the context of demonstrations, making the municipality subject to fines, for each one, of up to €10 to €20 million, according to the draft resolution known on Thursday.

Subscribe to our newsletters

Subscribe