This last lesson brings together what is at stake when the rules are not followed and explains what falls to the employer, whether or not there is a course like this one.
The CNPD and its powers
The CNPD monitors and supervises compliance with the GDPR and Lei n.º 58/2019 (Article 4 of the Law) and acts independently. Under Article 58 of the GDPR it can:
- carry out investigations and audits and demand information;
- issue warnings and reprimands;
- order that data subjects' rights be respected or that processing be brought into compliance with the rules;
- restrict or ban processing, temporarily or permanently;
- impose fines.
All public and private entities have a duty to cooperate with the CNPD, giving it the information requested and allowing it to examine systems and documents (Article 8 of Lei n.º 58/2019).
Fines
The GDPR (Article 83) sets fines of up to €10 million or 2 % of worldwide annual turnover and, for the most serious infringements, up to €20 million or 4 %, whichever is higher. Lei n.º 58/2019 classifies the infringements:
- very serious administrative offences (Article 37): for example processing data without a lawful basis, processing special categories of data without an applicable exception, or not allowing or hindering the exercise of data subjects' rights;
- serious administrative offences (Article 38): for example security failures, not notifying breaches, not keeping the record of processing activities, breaching the video surveillance rules of Article 19.
The law also sets fine amounts according to the size of the entity, and rules of its own for determining them. The CNPD has declared that it does not apply those provisions, because it considers them contrary to the GDPR, and applies directly the limits and criteria of Article 83 of the GDPR (Deliberation No. 2019/494). Those criteria include the nature, gravity and duration of the infringement, whether it was intentional or negligent, and the measures taken to mitigate the damage.
Fines apply equally to public and private entities (Article 44(1)). The Law provided that public entities could ask the CNPD to waive fines for three years from its entry into force, but that period has now ended.
Crimes
Lei n.º 58/2019 provides for crimes (Articles 46 to 54). Some examples, with the prison sentence or fine:
- use of data in a way incompatible with the purpose of collection: prison up to 1 year or a fine of up to 120 days;
- unauthorised access, without authorisation or justification: prison up to 1 year or a fine of up to 120 days;
- tampering with or destroying data: prison up to 2 years or a fine of up to 240 days;
- breach of the duty of secrecy, by someone bound by professional secrecy;
- disobedience to orders of the CNPD.
If the data belongs to special categories (Articles 9 and 10 of the GDPR), the penalties are doubled in their limits for several of these crimes. The person who commits the act can be criminally liable, and not only the company.
Civil and disciplinary liability
Anyone who suffers damage from unlawful processing is entitled to compensation (Article 82 of the GDPR and Article 33 of Lei n.º 58/2019). A serious breach of work duties may also lead to disciplinary proceedings under the Código do Trabalho.
What the employer must do
This course is a general introduction. It does not replace the employer's obligations, which include:
- internal policies and instructions, and specific instructions for each job and system;
- informing workers and data subjects about the processing (Articles 13 and 14 of the GDPR);
- a record of processing activities, where mandatory (Article 30);
- contracts with processors (Article 28) and security measures (Article 32);
- procedures for breaches and for requests from data subjects;
- appointing a data protection officer and publishing their contact details, where mandatory. It is mandatory in public bodies (Article 12 of Lei n.º 58/2019) and, in private ones, where the core activity involves regular and systematic monitoring on a large scale or large-scale processing of special category data (Article 13).
It is for the employer to decide whether this course meets the company's training needs.
Summary: use only what you need, protect what you have, warn when something goes wrong, and ask when in doubt.