Portugal

Setúbal municipality

180,000 €

GDPR enforcement action by Portuguese Data Protection Authority (CNPD) on 2022-11-02.

Rank · Sector

#31

of 357 in Public Sector and Education

Rank · Portugal

of 7

Rank · All fines

#382

of 3,050

Case details

Authority: Portuguese Data Protection Authority (CNPD)
Date: 2022-11-02
Controller / Processor: Setúbal municipality
Sector: Public Sector and Education
Quoted Articles: Art. 5 (1) e), f) GDPR, Art. 13 (1), (2) GDPR, Art. 37 (1), (7) GDPR
Type of violation: Non-compliance with general data processing principles

Summary

The Portuguese DPA has imposed a fine of EUR 170,000 on Setúbal municipality. The DPA found data protection violations regarding the collection of personal data from Ukrainian refugees. The municipality had asked refugees to fill out a form at the time of their arrival and provide various details on personal data, such as name, date of birth, marital status, etc.
The DPA noted, that the municipality had not sufficiently informed the data subjects about the data processing. In addition, the DPA found that the municipality had failed to implement sufficient technical and organizational to protect personal data, as well as to define a retention period for the data. The municipality had also failed to appoint a data protection officer.

Open original source Links to the regulator's original publication or another source.