Key Benefits:
CHAIR OF THE COUNCIL OF MINISTERS
1
Proposal for Law No 78 /XII
Exhibition of Motives
The Law No. 41/2004 of August 18 transposes to the national legal order the Directive
n 2002 /58/CE, of the European Parliament and of the Council of July 12 on the
handling of personal data and the protection of privacy in the communications sector
Electrolytic (Directive "Privacy and Electronic Communications"), with the exception of its
article 13, concerning unsolicited communications, which was transposed by Article 22 of the
Decree-Law No. 7/2004 of January 7.
In fulfillment of the fixed in the directives containing the regulatory framework of the networks and
services of electronic communications, which provides for its periodic reassessment, the Commission
European started in 2006 a review of the community framework, a procedure that
became known for "Revision 2006" and that ended with the adoption of the Directive
n. 2009 / 140 of the European Parliament and of the Council of November 25, 2009,
amending Directive No 2002 /21/CE, concerning a common regulatory framework for the
electro-communications networks and services, Directive No 2002 /19/CE, concerning access
and interlocking of electro-communications networks and related resources and the Directive
n. 2002 /20/CE, relating to the authorisation of electronic communications networks and services and
of Directive No 2009 /136/CE of the European Parliament and of the Council of November 25
of 2009, amending Directive No 2002 /22/CE on universal service and rights
of users in the field of electronic communication networks and services, the Directive
n. 2002 /58/CE, relating to the processing of personal data and the protection of privacy in the
sector of the electronic communications, and the Regulation (EC) No 2006/2004, concerning the
cooperation between the national authorities responsible for the implementation of the legislation of
consumer protection.
CHAIR OF THE COUNCIL OF MINISTERS
2
The Law No. 51/2011 of September 13 amending the Electrophic Communications Act (Law
n (5/2004) of February 10), establishes the legal regime applicable to networks and services
related and defines the competences of the National Regulatory Authority in this field,
transposing the Directive paragraphs 2009 /140/CE and 2009 /136/CE, both of Parliament
European and of the Council of November 25, 2009 in the latter case, only on the part
in which it amends the Directive No 2002 /22/CE, concerning the universal service and the rights of the
users in the field of electronic communications networks and services.
It now complies with the said Directive No 2009 /136/CE, in the part where it changes the
Directive No 2002 /58/CE, of the European Parliament and of the Council of July 12, 2002,
on the processing of personal data and the protection of privacy in the sector of
electro communications, through the amendment to Law No. 41/2004 of August 18. Thus, it is
this the purpose of this proposed law.
The changes to the personal data processing regime and the protection of privacy in the
sector of electronic communications translating, essentially, in the enhancement of security
of the processing; in the mandatory notification of violation of personal data to the Commission
National Data Protection (CNPD) and the data holders, in the case of the violation
be able to negatively affect the data in question, so that the data holders can
take the necessary precautions; in the subjection of the data storage to the
consent by its holder and the strengthening of the safeguards of the subscribers against the
invasion of your privacy by unsolicited communications for the purposes of marketing
direct, in the context of the use of electro-communications networks.
For better surveillance and ensuring compliance with the proposed law, it creates still a
obligation to provide information by the entities subject to other obligations,
detailing the regime of default, with the possibility of application of sanctions
compulsory pecuniary, and clarify the competences of the CNPD and the ICP-Authority
National of Communications (ICP-ANACOM) in the framework of the counterordinations and the
processing and application of accessory fines and sanctions.
CHAIR OF THE COUNCIL OF MINISTERS
3
The National Data Protection Commission has been heard, the ICP-National Authority
of Communications (ICP-ANACOM), the National Board of Consumption and the Association of the
Telecom Operators.
Thus:
Under the terms of the paragraph d ) of Article 197 (1) of the Constitution, the Government presents to the
Assembly of the Republic the following proposal for a law, with a request for priority and urgency:
Article 1.
Object
The present diploma:
a) Proceeds to the first amendment to the Act No 41/2004 of August 18, which transposes
for the national legal order to Directive No 2002 /58/CE, of Parliament
European and of the Council of July 12 on the processing of personal data
and to the protection of privacy in the sector of electronical communications.
b) Proceeds to the second amendment to Decree-Law No 7/2004 of January 7, amended
by the Decree-Law No. 62/2009 of March 10, which transposes to the order
legal national a Directive No 2000 /31/CE, of the European Parliament and of the
Council of June 8, 2000 on certain legal aspements of the services of the
information society, in particular of the electronic commerce, on the market
internal.
Article 2.
Amendment to Law No. 41/2004 of August 18
Articles 1, 2, 3, 6, 8, 14, 14, 14, and 15 of Law No. 41/2004 of August 18,
go on to have the following essay:
CHAIR OF THE COUNCIL OF MINISTERS
4
" Article 1.
[...]
1-A This Law transposes to the national legal order the Directive
n. 2002 /58/CE, of the European Parliament and of the Council of July 12,
on the processing of personal data and the protection of privacy in the
sector of electronical communications, with the changes determined by the
Article 2 of Directive No 2009 /136/CE, of the European Parliament and of the
Council, of November 25.
2-A This Law applies to the processing of personal data in the context of the
provision of publicly accessible electronic communications services to the public in
public communications networks, particularly in the public networks of
communications that serve as a support to data collection devices and
identification, specifying and complementing the provisions of the Act
n. 67/98, of October 26 (Personal Data Protection Act).
3-[...].
4-[...].
5-In the situations provided for in the preceding paragraph, the companies that offer
electronic communications services accessible to the public must
establish internal procedures that allow to respond to requests for
access to personal data of users submitted by the authorities
competent judiciary, in accordance with the said special legislation.
Article 2.
[...]
1-[...]:
CHAIR OF THE COUNCIL OF MINISTERS
5
a) "Communication" any information exchanged or sent between a
finite number of parts by the use of a service of
electro-electronic communications accessible to the public;
b) "Electro mail" any textual, vocal, sound message or
graphic sent through a public communications network that
can be stored in the network or in the terminal equipment of the
recipient until this collection;
c) [...];
d) [...];
e) "Location data" any data processed in a network of
electro communications or within the framework of a service of
electronical communications that indicate the geographical position of the
terminal equipment of a user of a service of
electro-electronic communications accessible to the public;
f) [...];
g) "Violation of personal data" a violation of security that
provoke, in an accidental or illicit manner, the destruction, the loss, the
change, disclosure or unauthorized access to personal data
transmitted, stored or otherwise treated in the context of the
provision of accessible electronical communications services to the
public.
2-Is excluded from the point a) of the previous number all the information disseminated to the
public in general, through an electronical communications network, which does not
can be related to the subscriber of a communications service
electro or with any identifiable user receiving the
information.
CHAIR OF THE COUNCIL OF MINISTERS
6
3-Unless specific definition of this Law, definitions are applicable
constants of the Personal Data Protection Act and the Law No. 5/2004, of 10
of February, in the essay that was given to him by the Law No. 51/2011, 13 of
september (the Electrophic Communications Act).
Article 3.
Security of processing
1-Companies that offer accessible electronical communications services
to the public should adopt the appropriate technical and organizational measures
to ensure the safety of your services, if necessary, with regard to the
network security, in conjunction with the provider of the public network of
communications.
2-The provider of public communications network that serves as a support to
services of electronic communications accessible to the public, provided by
another company must satisfy the requests that it presents to it and that they are
necessary for the fulfillment of the scheme laid down in this Law.
3-The measures referred to in paragraph 1 shall be appropriate for the prevention of risks
existing, taking into account the proportionality of the costs of its application
and the state of technological developments.
4-The ICP-National Communications Authority (ICP-ANACOM) shall
issue recommendations on the best practices regarding the level of
security that these measures must achieve.
5-The ICP-ANACOM must, directly or through independent entity,
audit the measures adopted in the terms of the previous figures.
CHAIR OF THE COUNCIL OF MINISTERS
7
6-The ICP-ANACOM shall establish the plan of these audits, so as to
cover, inter alia, the determination of procedures and standards of
reference to be applied to them and the requirements demanded by the auditors.
7-Can you still the ICP-ANACOM, or an independent entity per se
designated, carry out extraordinary safety audits.
8-For the purposes of the application of paragraphs 4 a to 7 of this Article, if they are in
cause measures that may involve data protection subjects
personal, should the ICP-ANACOM request to appear to the CNPD.
9-Without prejudice to the provisions of the Act on the Protection of Personal Data, the measures
referred to in paragraphs 1 a to 3 shall, at a minimum, include:
a) Measures that ensure that only authorised personnel can have
access to personal data, and only for legally authorized purposes;
b) The protection of the personal data transmitted, stored or of
other way treated, against destruction, loss, alteration,
disclosure or unauthorized or accidental access;
c) Measures that ensure the implementation of a security policy in the
treatment of personal data.
10-In the event of a special risk of breach of network security, the companies that
offer accessible electronical communications services to the public must
report free of charge to subscribers of these services from the existence of the risk
and, where the risk is located outside the scope of the measures to be taken by the
service provider, of the possible solutions to avoid it and the costs
likely hence stemming from.
CHAIR OF THE COUNCIL OF MINISTERS
8
Article 5.
[...]
1-The storage of information and the possibility of access to information
stored in the terminal equipment of a subscriber or user only
are permitted if these have given their prior consent, on the basis of
in clear and complete information pursuant to the Data Protection Act
Personal, particularly as to the objectives of the processing.
2-The provisions of this Article and in the preceding article shall not preclude the
technical storage or access:
a) Which has as its sole purpose to transmit a communication through
of an electro-communications network;
b) Strictly necessary to the supplier to provide a service of the
information society requested expressly by the subscriber or
user.
Article 6.
[...]
1-[...].
2-[...].
3-[...].
4-Companies that offer electronical communications services can only
treat the data referred to in paragraph 1 if the subscriber or user to whom the
data relate to you have expressly given your prior consent
and unequivocal, which can be withdrawn at any time, and only in the
measure of the necessary and the time required for the marketing of services
of electro communications or the provision of value services
added.
CHAIR OF THE COUNCIL OF MINISTERS
9
5-[...].
6-[...].
7-[...].
Article 7.
[...]
1-[...].
2-[...].
3-In the same way, the treatment of location data is allowed in the
measure and by the time required for the provision of value services
added, provided that prior and express consent is obtained from the
subscribers or users.
4-[...].
5-[...].
6-[...].
Article 8.
[...]
1-[...].
2-Companies that offer networks and or services of electronic communications
accessible to the public must reconcile the rights of the subscribers they receive
detailed invoices with the right to privacy of the users authors of the
calls and the so called subscribers, notably submitting to the
approval of the proposed National Data Protection Commission (CNPD)
how much means that allow subscribers to have anonymous access or
strictly private to electronical communications services accessible to the
public.
CHAIR OF THE COUNCIL OF MINISTERS
10
3-.The approval by the CNPD, referred to in the preceding paragraph, is subject to
mandatory prior opinion of ICP-ANACOM.
4-[...].
Article 14.
[...]
1-Constituent counterordinate punishable with the minimum fine of € 1500 and
maximum of € 25000, when practiced by natural persons, and with fine
minimum of € 5000 and maximum of € 5000000, when practiced by people
collectives:
a) The failure to comply with the safety rules of the networks imposed by the n.
1, 2, 3 and 10 of Article 3;
b) The failure to comply with the safety rules in the processing of data
personnel imposed by Article 3 (9);
c) The violation of the obligations set out in paragraphs 1, 2, 3, 4, 5 and 10 of the
article 3-A or determined in the terms provided for in the respects
n. ºs 6 and 9;
d) The violation of the duty of confidentiality, the prohibition of interception
or the surveillance of communications and the respective traffic data
provided for in Article 4;
e) The failure to meet the conditions of storage and access to the
information provided for in Article 5;
f) The dispatch of communications for the purposes of marketing direct in violation
of paragraphs 1 and 2 of Article 13;
g) The violation of the obligations imposed in Article 13 (3) of the Article;
CHAIR OF THE COUNCIL OF MINISTERS
11
h) The sending of electro mail in violation of Article 13 (4);
i) The violation of the obligation set out in Article 13 (1) of the Article-B;
j) The violation of the provisions of Article 13 (3)-B by the entities
provided for in respect of paragraph 1;
k) The violation of the obligation to provide information established in the
article 13-And;
l) The failure to comply with orders or deliberations of the CNPD, issued in the
terms of Article 13-D and regularly communicated to your
recipients;
m) The failure to comply with orders or deliberations of the ICP-ANACOM,
issued pursuant to Art. 13-D and regularly communicated to the
your recipients.
2-Constituent counterordinate punishable with the minimum fine of € 500 and maximum
of € 20000, when practiced by natural persons, and with minimal fine
of € 2500 and maximum of € 2500000, when practiced by people
collectives:
a) The violation of the notification requirements provided for in paragraphs 7, 8 and 10
of Article 3-A or determined in the terms provided for in the respect
n. 9;
b) The failure to comply with the conditions of treatment and storage of
traffic data and location data provided for in Articles 6 and
7.
c) The violation of the obligations laid down in Article 8 (1), 2 and 4 and 4
in Articles 9 and 11;
d) The violation of the obligations laid down in Article 10;
CHAIR OF THE COUNCIL OF MINISTERS
12
e) The violation of the provisions of Article 13.
3-Whether the counterordinance consisted in the default of a legal duty, whether
in the failure to comply with an order or deliberation emanating from the CNPD or the
ICP-ANACOM, in the respects areas of competence, the application and the
compliance with the sanctions do not waive the offender of compliance, if
this is still possible.
4-A CNPD or the ICP-ANACOM, in the respective areas of competence,
may order the offender to comply with the duty or order in question, under
penalty of compulsory pecuniary penalty pursuant to Art. 15.-C.
5-A negligence and the attempt are punishable by being the minimum limits and
maximum of the fine reduced to half.
Article 15.
[...]
1-Compete à CNPD the introduction, instruction and archiving of processes
of counterordinance, as well as the application of admostations, fines and
ancillary sanctions, for violation of the provisions of Article 3 (9), in the
article 3, in Articles 5, 6 and 7, in paragraphs 1, 2 and 4 of Article 8, para.
article 10, in Article 13, in paragraphs 1 a to 4 of Article 13-A, in paragraphs 1 and 3 of the
article 13-B, in Article 13-E and point (l) of Article 14 (1).
2-Compete to ICP-ANACOM the introduction, instruction and archiving of
counterordinating processes as well as the application of admostations,
fines and ancillary sanctions, for violation of the provisions of paragraphs 1, 2, 3 and 10
of Article 3, in Article 4, Article 9, Article 11, Article 13-E and
in the paragraph m) of Article 14 (1).
CHAIR OF THE COUNCIL OF MINISTERS
13
3-A the initiation of counterordinance processes and the respect of the application of
fines relating to the iliytes provided for in the preceding paragraph are of the
competence of the ICP-ANACOM board of directors, by the
instruction to the respects services.
4-[ Previous Article No 3 ].
5-The amount of the fines reverses to the state in 60% and to the CNPD or
for the ICP-ANACOM, depending on the cases, in 40%. "
Article 3.
Addition to Law No. 41/2004 of August 18
They are deferred to Law No. 41/2004 of August 18, Articles 3, 13-A, 13.-B, 13-C,
13.-D, 13.-And, 13.-F, 13.-G, 15.-A, 15.-B and 15.-C, with the following essay:
" Article 3.
Notification of violation of personal data
1-Companies that offer accessible electronical communications services
to the public should, without unwarranted delay, notify the CNPD of the
occurrence of violation of personal data.
2-When the violation of personal data referred to in the preceding paragraph may
negatively affect the personal data of the subscriber or user, the
companies that offer electronic communications services accessible to the
public shall still, without unwarranted delay, notify the violation to the
subscriber or user, so that these can take the precautions
necessary.
CHAIR OF THE COUNCIL OF MINISTERS
14
3-A breach of personal data negatively affects the data or the
privacy of the subscriber or user whenever it may result,
specifically, in usurpation or identity fraud, physical damage,
significant humiliation or damage to the reputation, when associated with the
provision and use of accessible electro-electronic communications services
to the public.
4-The scheme provided for in paragraph 2 shall not apply in cases where the companies
that offer electro-accessible electronic communications services to the public
prove before the CNPD, and this acknowledges, that they have adopted the measures
proper protection technology and that these measures have been applied
to the data to which the violation relates.
5-The measures referred to in the preceding paragraph shall make the data
incomprehensible to all unauthorized persons to accept them.
6-Without prejudice to the obligation of notification referred to in paragraph 2, when the
company that offers electronic communications services accessible to the
public has not yet notified the violation of personal data to the
subscriber or user, CNPD may require the realization of the same
notification, taking into account the likelihood of adverse effects
stemming from the violation.
7-Constitut minimum elements of the notification referred to in paragraph 2 a
identification of the nature of the breach of personal data and the points of
contact where further information can be obtained, well
as the recommendation of measures to limit any possible effects
adverts of the said violation.
CHAIR OF THE COUNCIL OF MINISTERS
15
8-In the notification to the CNPD provided for in paragraph 1, the company offering services
of electro-accessible communications to the public must, in addition to the
constant elements of the previous number, indicate the consequences of the
breach of personal data and the measures by you proposed or taken for
make face to the violation.
9-A CNPD may, in accordance with the decisions of the European Commission,
issue guidelines or instructions on the circumstances in which the
companies that offer electronic communications services accessible to the
public are required to notify the violation of personal data, well
as on the form and procedure applicable to such notifications.
10-For the verification, by the CNPD, of the fulfilment of the obligations
established in this article, the companies offering services of
electro-accessible communications to the public must constitute and maintain
a record of the situations of personal data breach, with indication of the
facts that concern them, their effects and the measures adopted,
including the notifications effected and the remediation measures taken.
Article 13-The
Unsolicited communications
1-Is subject to express prior consent of the subscriber who is a person
singular, or of the user, the sending of unsolicited communications to
purposes of marketing direct, specifically, through the use of systems
automated call and communication that do not depend on the
human intervention (automatic calling apparatus), from apparatus of
telecopy or electro-mail, including SMS (messaging services
short), EMS (improved messaging services) MMS (services of
multi-media message) and other types of similar applications.
CHAIR OF THE COUNCIL OF MINISTERS
16
2-The provisions of the preceding paragraph shall not apply to subscribers who are
collective persons, being allowed the unsolicited communications for
purposes of marketing direct until subscribers refuse future
communications and enrol in the list provided for in Article 13 (2).
3-The provisions of the preceding paragraphs shall not prevent the supplier from
certain product or service that you have obtained from your customers, in the
terms of the Personal Data Protection Act, in the context of the sale of
a product or service, the electronic coordinated respects of
contact, can use them for purposes of marketing direct from your own
products or services analogous to transactionates, as long as it guarantees to the
customers concerned, clearly and explicitly, the possibility to refuse, from
free and easy form, the use of such coordinates:
a) At the time of the respect collection; and
b) On the occasion of each message, when the customer did not refuse
initially this use.
4-It is prohibited the sending of electro mail for purposes of marketing direct,
concealing or dissimulating the identity of the person in whose name it is
effected the communication, in violation of Article 21 of the Decree-Law
n. 7/2004, of January 7, without the indication of a valid means of contact
to which the recipient can send a request to terminate those
communications, or that encourages recipients to visit sites on the Internet
which violate the provisions of the said article.
CHAIR OF THE COUNCIL OF MINISTERS
17
5-To tutor the interests of your customers, as a part of the respects
business interests, the providers of communications services
electro-accessible to the public have legitimacy to propose actions
judicial proceedings against the author of non-compliance with any of the provisions
constants of this article, as well as of Article 13.-B.
Article 13-B
Lists for the purposes of unsolicited communications
1-To the entities that promote the sending of communications for purposes of marketing
direct with use of automated call and communication systems
that do not depend on human intervention (call apparatus
automatic), of fax or electronic mail devices, including
SMS (short message services), EMS (messaging services
improved) MMS (multi-medium message services) and other types of
similar applications, it is up to you to maintain, by you or by organisms that the
represent, an updated list of people who have expressed
expressly and in a gratuit-free manner consent to the fearage of this
type of communications, as well as of the customers who did not object to their
prescribing under Article 13 (3).
2-Compete to the Consumer General Directorate (DGC) keep an updated one
list of national scope of collective persons who express expressly
object to the receiving of unsolicited communications for the purposes of marketing
direct.
3-By inclusion in the lists referred to in the previous figures cannot be
charged any amount.
4-A The insertion in the list referred to in paragraph 2 depends on the filling of
an electronic form made available through the DGC's Electrophic page.
CHAIR OF THE COUNCIL OF MINISTERS
18
5-The entities that promote the sending of communications for the purposes of marketing
direct are required to consult the list, updated monthly by the DGC,
that makes it available at your request.
Article 13-C
Cross-border cooperation
1-Without prejudice to the competences assigned to other entities, the CNPD and the
ICP-ANACOM can, in the respects areas of competence, approve
measures to ensure effective cross-border cooperation in implementation
of this Law.
2-Where they wish to proceed on the terms provided for in the preceding paragraph,
the CNPD and the ICP-ANACOM present to the European Commission, in time
useful and prior to the approval of the measures in question, a summary of the reasons
for the action, the foreseen requirements and the proposed actions.
Article 13-D
Competences of the CNPD and the ICP-ANACOM
Within the framework of the competences assigned to them by this Law, the CNPD
and the ICP-ANACOM can, in the respective areas of competence:
a) Draw up regulations regarding the practices to be adopted for
compliance with this Law;
b) Give orders and make recommendations;
c) Advertise, on the respected websites on the Internet , the codes of conduct of
who has knowledge;
d) Advertise, on the respected websites on the Internet , other information that
consider relevant.
CHAIR OF THE COUNCIL OF MINISTERS
19
Article 13-And
Provision of information
1-The entities subject to obligations under this Act, shall,
when requested, render to ICP-ANACOM, in their respective area of
competence, all information related to your activity, to
that these authorities can exercise all the skills in that
predicted.
2-The requests for information referred to in the preceding paragraph shall
obey the principles of appropriateness to the end to which they are intended and to
proportionality and shall be duly substantiated.
3-The information requested must be provided within the time limits, in the
form and with the degree of detail required by the ICP-ANACOM, which may
also establish the circumstances and periodicity of your submission.
4-For the purposes of paragraph 1, entities must identify, in a manner
substantiated, the information they consider confidential and must
join, in case if warranted, a non-confidential copy of the documents in
that contain such information.
Article 13-F
Default
1-Without prejudice to other applicable sanctionatory mechanisms, whenever the
CNPD or the ICP-ANACOM, in the respective areas of competence,
check the infraction of any obligation arising from this Law,
they must notify the offender of that fact and give it the possibility of a
term of not less than 10 days to be given and, where appropriate, to end the
default.
CHAIR OF THE COUNCIL OF MINISTERS
20
2-After proceeding to the hearing, in the terms of the preceding paragraph, the CNPD
or the ICP-ANACOM, in the respects areas of competence, may require the
offender who quits the default immediately or within reasonable time
fixed for the purpose.
3-If the offender does not put an end to the default on the deadline referred to us
previous figures, compete with the CNPD or the ICP-ANACOM, in the
respects areas of competence, take appropriate measures and
commensurate with to ensure the observance of the obligations referred to in paragraph 1
of this article, in particular the application of financial penalties
compulsory in the terms provided for in this Law.
Article 13-G
Surveillance
It is incumbent on the CNPD and the ICP-ANACOM, in the respective areas of competence
established pursuant to the provisions of Article 15, the audit of the
compliance with this Law, through, respectively, the vowels and technicians
duly mandated by the CNPD, pursuant to the Protection of Rights Act.
Personal Data and supervisory agents or mandators duly
accredited by ICP-ANACOM under Article 112 of the Law of the
Electrolytic Communications.
Article 15-The
Ancillary sanctions
1-Within the framework of the counterordinations provided for in Article 15 (2), always
that the seriousness of the infraction and the fault of the agent justifies it, the
ICP-ANACOM may apply an incidental loss of loss in favour of the
State of illicit objects, equipment and devices, including the product
of the benefit obtained by the offender through the practice of the counterordinance.
CHAIR OF THE COUNCIL OF MINISTERS
21
2-Who disrespect an ancillary sanction that has been applied to it,
incursion into the crime of qualified disobedience.
Article 15-B
Loss in favour of the State
1-Without prejudice to the provisions of paragraph 1 of the preceding Article, consider
lost in favour of the State the illicit objects, equipment and devices
that have been cautionary or provisionally impounded by the
ICP-ANACOM and which, after notification to those interested in order to
collect, have not been claimed within 60 days.
2-The objects, equipment and illicit devices lost in favour of the State
revert to the ICP-ANACOM, which will give them the fate they judge
suitable.
Article 15-C
Compulsory financial penalties
1-Without prejudice to other applicable penalties, in the event of default of
decisions of the CNPD or the ICP-ANACOM that impose sanctions
administrative or ordering, in the exercise of the powers that lawfully
assists, the adoption of behaviors or measures determined to the
recipients of this Law, may those authorities,
fundamentedly, impose a compulsory pecuniary penalty, in cases
referred to in points a ) a i) and l) a m) of paragraph 1 and a ), d ) and and ) of the Article 2 (2)
14.
2-A compulsory pecuniary penalty consists of the imposition to its addressee
of the payment of a pecuniary amount for each day of delay in the
compliance in addition to the deadline set.
CHAIR OF THE COUNCIL OF MINISTERS
22
3-A compulsory sanction is fixed second criteria of reasonableness and
proportionality, meeting the economic situation of the offender,
in particular to its turnover in the previous calendar year, and to the
negative impact of default on the market and users,
may the daily amount be located between € 500 and € 100000.
4-The amounts set out in the terms of the preceding paragraph may be variable
for each day of default, in a growing sense, and may not
surpass the maximum amount of € 3000000 nor the maximum duration of
30 days.
5-The amount of the sanction applied reverses to the State in 60% and to the
CNPD or for the ICP-ANACOM in 40%.
6-From the acts of the CNPD and the ICP-ANACOM, practiced under the present
article, it is up to appeal, depending on whether they are practiced in the context of a case
of counterordinance or administrative, pursuant to the legislation applicable to
each type of process in question. "
Article 4.
Amendment to Decree-Law No 7/2004 of January 7
Article 37 of the Decree-Law No. 7/2004 of January 7, amended by the Decree-Law
n ° 62/2009 of March 10, it shall have the following essay:
" Article 37.
[...]
1-[...]:
a) The non-provision or provision of information to the recipients
regulated in Articles 10, 13, 21 and in Article 28 (1);
CHAIR OF THE COUNCIL OF MINISTERS
23
b) [ Repealed ];
c) [...];
d) [...];
e) [...];
f) [...].
2-[...].
3-[...].
4-[...].
5-[...]. "
Article 5.
Abrogation standard
They are revoked:
a) Article 12 of Law No 41/2004 of August 18;
b) Article 22 and point (s) b) of Article 37 (1) of the Decree-Law No 7/2004, of
January 7, amended by Decree-Law No. 62/2009 of March 10.
Article 6.
Republication
It is republished, in the annex to the present diploma, of which it is an integral part, the Act
n. 41/2004, of August 18, with the current essay.
CHAIR OF THE COUNCIL OF MINISTERS
24
Article 7.
Entry into force
This diploma shall come into force on the day following that of its publication.
Seen and approved in Council of Ministers of June 21, 2012
The Prime Minister
The Deputy Minister and Parliamentary Affairs
CHAIR OF THE COUNCIL OF MINISTERS
25
ANNEX
(referred to in Article 6)
Republication of Law No. 41/2004 of August 18
CHAPTER I
Object and scope
Article 1.
Object and scope of application
1-A This Law transposes to the national legal order the Directive No 2002 /58/CE, of the
European Parliament and of the Council of July 12 on the processing of data
personal and to the protection of privacy in the sector of the electronic communications, with the
changes determined by Article 2 of the Directive No 2009 /136/CE of Parliament
European and the Council of November 25.
2-A This Law applies to the processing of personal data in the context of the provision of
services of electronic communications accessible to the public in communications networks
public, particularly in the public communications networks that serve as a support to
data collection and identification devices, specifying and complementing the
provisions of Law No. 67/98 of October 26 (the Act on the Protection of Personal Data).
3-The provisions of this Law ensure the protection of the legitimate interests of the
subscribers who are collective persons to the extent that such protection is compatible
with their nature.
4-The exceptions to the application of this Law that show strictly necessary for the
protection of activities related to public safety, defense, security of the
State and the prevention, investigation and prosecution of penal infractions are defined in
special legislation.
CHAIR OF THE COUNCIL OF MINISTERS
26
5-In the situations provided for in the preceding paragraph, the companies offering services of
electro-accessible communications to the public should establish procedures
internal to be able to respond to requests for access to personal data of the
users submitted by the competent judicial authorities, in compliance
with the said special legislation.
Article 2.
Definitions
1-For the purposes of this Law, it is understood by:
a) "Communication" any information exchanged or sent between a finite number
of parts by the use of an electro-communications service
accessible to the public;
b) "Electro mail" any textual, vocal, sound, or graphic message sent
through a public communications network that can be stored in the network
or in the terminal equipment of the consignee until this collection is collected;
c) "User" means any natural person who uses a communications service
electro-accessible to the public for private or commercial purposes, not being
necessarily subscriber of that service;
d) "Traffic data" any data processed for the purposes of sending a
communication through an electronic communications network or for the purposes of the
billing of the same;
e) "Location data" any data processed in a communications network
electro-trophic or in the framework of an electronical communications service that
indicate the geographical position of the terminal equipment of a user of a
accessible electronical communications service to the public;
CHAIR OF THE COUNCIL OF MINISTERS
27
f) "Value added services" all those who require the treatment of
traffic data or location data that are not traffic data, to
in addition to the necessary for the transmission of a communication or the billing of it;
g) "Violation of personal data" a breach of security that provokes, in a manner
accidental or illicit, the destruction, loss, alteration, dissemination or access not
authorized to personal data transmitted, stored or otherwise
treated in the context of the provision of electro-communications services
accessible to the public.
2-Is excluded from the point a) of the previous number all the information disseminated to the public in
general, through an electro-communications network, which cannot be related
with the subscriber of an electro communications service or with any user
identifiable that receives the information.
3-Unless specific definition of this Law, the definitions set out in the Act shall apply
of Protection of Personal Data and of Law No. 5/2004 of February 10 in the essay that
it was given by Law No. 51/2011 of September 13 (Communications Act
Electro-ics).
CHAPTER II
Security and confidentiality
Article 3.
Security of processing
1-Companies that offer accessible electronical communications services to the public
should adopt appropriate technical and organizational measures to ensure safety
of your services, if necessary, with respect to network security, in conjunction with
the provider of the public communications network.
CHAIR OF THE COUNCIL OF MINISTERS
28
2-The provider of public communications network that serves as a support for services of
electronic communications accessible to the public, provided by another company must
satisfy the requests that this presents to you and are necessary for compliance
of the scheme laid down in this Law.
3-The measures referred to in paragraph 1 shall be appropriate to the prevention of existing risks,
taking into account the proportionality of the costs of its application and the state of evolution
technological.
4-The ICP-National Communications Authority (ICP-ANACOM) shall issue
recommendations on the best practices regarding the level of security that these
measures must achieve.
5-The ICP-ANACOM must, directly or through independent entity, audit the
measures adopted in the terms of the previous figures.
6-The ICP-ANACOM shall establish the plan of such audits, so as to cover,
notably, the determination of the procedures and standards of reference to be applied to them
and the requirements demanded of the auditors.
7-Can you still the ICP-ANACOM, or an independent entity per se designated, carry out
extraordinary safety audits
8-P
ara effects of the application of paragraphs 4 a to 7 of this Article, if measured are
that may involve personal data protection matters, should the ICP-ANACOM
request to appear to the CNPD.
9-Without prejudice to the provisions of the Act on the Protection of Personal Data, the measures referred to
in paragraphs 1 a to 3 shall, at a minimum, include:
a) Measures that ensure that only authorised personnel can have access to the
personal data, and only for legally authorized purposes;
CHAIR OF THE COUNCIL OF MINISTERS
29
b) The protection of the personal data transmitted, stored or otherwise
treated, against destruction, loss, alteration, disclosure or access not
authorized or accidental;
c) Measures that ensure the implementation of a safety policy in the treatment of
personal data.
10-In the event of a special risk of breach of network security, the companies that offer
services of electronic communications accessible to the public must inform
free of charge the subscribers of these services from the existence of the risk and, whenever the risk
is located outside the scope of the measures to be taken by the service provider, of the solutions
possible to avoid it and the likely costs arising therefrom.
Article 3-The
Notification of violation of personal data
1-Companies that offer accessible electronical communications services to the public
must, without unjustified delay, notify the CNPD of the occurrence of data breach
personal.
2-When the breach of personal data referred to in the preceding paragraph may affect
negatively the personal data of the subscriber or user, the companies that offer
electronic communications services accessible to the public must still, without delay
unjustified, notify the breach to the subscriber or the user, so that they may
take the necessary precautions.
3-A breach of personal data negatively affects the data or privacy of the
subscriber or user whenever it may result, specifically, in usurpation or
identity fraud, physical damage, significant humiliation or damage to reputation,
when associated with the provision and use of electro-communications services
CHAIR OF THE COUNCIL OF MINISTERS
30
accessible to the public.
4-The scheme provided for in paragraph 2 shall not apply in cases where the companies that offer
services of electronic communications accessible to the public proving before the
CNPD, and this recognize, who have adopted the appropriate protective technological measures
and that such measures have been applied to the data to which the violation relates.
5-The measures referred to in the preceding paragraph shall make the data incomprehensible
for all unauthorized persons to accept them.
6-Without prejudice to the obligation of notification referred to in paragraph 2, when the Company which
offers accessible electronical communications services to the public not yet
notified of the breach of personal data to the subscriber or the user, the CNPD may
require the realization of the same notification, taking into account the likelihood of effects
adverts arising from the violation.
7-Constitut minimum elements of the notification referred to in paragraph 2 a identification of the
nature of the violation of personal data and the points of contact where they may be
obtained supplementary information, as well as the recommendation of measures
intended to limit any adverse effects of the said violation.
8-In the notification to the CNPD provided for in paragraph 1, the company offering services of
accessible electronical communications to the public must, in addition to the constant elements of the
previous number, indicate the consequences of the breach of personal data and the measures
by itself proposed or taken to cope with the violation.
9-A CNPD may, in accordance with the decisions of the European Commission, issue
guidelines or instructions on the circumstances in which the companies that offer
services of electronic communications accessible to the public are required to notify the
breach of personal data, as well as on the form and procedure applicable to
these notifications.
CHAIR OF THE COUNCIL OF MINISTERS
31
10-For the verification, by the CNPD, of the fulfilment of the obligations established in the
this article, the companies offering electronic communication services
accessible to the public shall constitute and maintain a record of the situations of violation
of personal data, with an indication of the facts concerning them, of their effects and
of the measures adopted, including the notifications effectuated and the remedial measures
outlets.
Article 4.
Inviolability of electrolytic communications
1-Companies that offer networks and or services of electronical communications must
guarantee the inviolability of communications and respect traffic data carried out
through public communications networks and electronical communications services
accessible to the public.
2-It is prohibited to listen, the installation of listening devices, storage or other
means of interceition or surveillance of communications and the respect of traffic data
by third parties without the prior and express consent of the users, with the exception of
cases provided for in the law.
3-The provisions of this Article shall not preclude legally authorized recordings of
communications and the respect of traffic data, when carried out in the framework of
licit trade practices, for the purpose of proof of a commercial transaction nor of
any other communication made within the framework of a contractual relationship, provided that the
holder of the data has been informed of this and given your consent.
4-Are authorized the communications recordings of and for public services intended for
provide emergency situations of any nature.
CHAIR OF THE COUNCIL OF MINISTERS
32
Article 5.
Storage and access to information
1-The storage of information and the possibility of access to stored information
in the terminal equipment of a subscriber or user are only allowed if these
have given their prior consent, on the basis of clear and complete information
in the terms of the Personal Data Protection Act, namely as to the objectives
of the processing.
2-The provisions of this Article and in the previous article do not preclude technical storage
or the access:
a) Which has as its sole purpose to transmit a communication through a
network of electro-communications;
b) Strictly necessary to the supplier to provide a service of the society of
information requested expressly by the subscriber or user.
Article 6.
Traffic data
1-Without prejudice to the provisions of the following numbers, traffic data relating to the
subscribers and users treated and stored by the companies that offer networks and or
electro communications services must be eliminated or anonymised
when they cease to be necessary for the purposes of the transmission of communication.
2-The treatment of traffic data necessary to the billing of subscribers and
to the payment of interconnections, specifically:
a) Number or identification, address and type of posting of the subscriber;
b) Total number of units to be charged for the counting period, as well as the
CHAIR OF THE COUNCIL OF MINISTERS
33
type, start time and duration of the calls effectuated or the volume of data
transmitted;
c) Date of call or service and number called;
d) Other information relating to payments, such as advance payments,
payments to benefits, wire cuts and notices.
3-The treatment referred to in the preceding paragraph is only lawful until the end of the period during the
which the invoice can be legally challenged or the payment claimed.
4-Companies that offer electronical communications services can only treat the
data referred to in paragraph 1 if the subscriber or user to whom the data relates
has expressly given your prior and unequivocal consent, which may be
withdrawn at any time, and only to the extent necessary and by the time
necessary for the marketing of electronical communications services or the provision of
value-added services.
5-In the cases provided for in paragraph 2 and, before the consent of the subscribers or
users, in the cases provided for in paragraph 4, the companies offering services of
electronical communications must provide them with exact and complete information about the
type of data that are processed, the purposes and the duration of such treatment, as well as on the
your eventual provision to third parties for the purposes of the provision of value services
added.
6-The handling of traffic data should be limited to employees and collaborators
of companies that offer networks and or services of accessible electronical communications
to the public in charge of the billing or management of traffic, the information to
customers, from the detetion of fraud, to the marketing of communications services
electro-accessible to the public, or from the provision of value-added services,
restricting itself to the necessary for the purposes of the said activities.
CHAIR OF THE COUNCIL OF MINISTERS
34
7-The provisions of the preceding paragraphs shall be without prejudice to the right of the courts and the rest
competent authorities to obtain information relating to traffic data, in the
terms of the applicable law, with a view to resolving disputes, in particular from those
relative to interconnections or invoicing.
Article 7.
Location data
1-In cases where location data is processed, in addition to the data of
traffic, relating to subscribers or users of the public communications networks or the
accessible electronical communications services to the public, the treatment of this data is
permitted only if the same are anonymised.
2-The registration, treatment and transmission of location data to organizations is allowed
with legal competence to receive emergency calls for response to
these calls.
3-In the same way, the treatment of location data is permitted in the measure and by the
time required for the provision of value-added services, as long as it is
obtained prior and express consent of the subscribers or users.
4-Companies that offer accessible electronical communications services to the public
should, in particular, inform users or subscribers, before they obtain their
consent, on the type of location data that will be treated, the duration and the
purposes of the processing and the eventual transmission of the data to third parties for the purposes of
provision of value-added services.
5-Companies that offer accessible electronical communications services to the public
must guarantee to subscribers and users the possibility of, through a medium
simple and free:
CHAIR OF THE COUNCIL OF MINISTERS
35
a) Withdraw at any time the consent previously granted for the
treatment of the location data referred to in the previous figures;
b) Temporarily refuse the processing of such data for each connection to the network or
for each transmission of a communication.
6-The treatment of location data shall be limited to employees and
collaborators of companies that offer networks and or services of communications
electro-accessible to the public or from third parties that provide the service of value
added, and should restrict itself to the necessary for the purposes of the said activity.
Article 8.
Detailed billing
1-Subscribers have the right to receive non-detailed invoices.
2-Companies that offer networks and or services of accessible electro-electronic communications
to the public should reconcile the rights of subscribers who receive detailed invoices
with the right to privacy of the users ' users of the calls and subscribers
called, notably submitting to the approval of the National Protection Commission
of Data (CNPD) proposals as to means that allow subscribers to access
anonymous or strictly private to electronically accessible communications services to the
public.
3-A approval by the CNPD, referred to in the preceding paragraph, is subject to prior opinion
mandatory of ICP-ANACOM.
4-The calls provided to the subscriber free of charge, including calls for services
of emergency or assistance, must not appear in the detailed invoicing.
CHAIR OF THE COUNCIL OF MINISTERS
36
Article 9.
Identification of the chamer line and the connected line
1-When the presentation of the caller line identification, the companies are offered
that offer accessible electronical communications services to the public must
guarantee, line the line, to the subscribers who are effecting the calls and, on each call, to the
too many users the possibility of, through a simple and free medium, prevent the
presentation of the identification of the chamer line.
2-When the presentation of the caller line identification, the companies are offered
that offer electronic communications services must guarantee to the subscriber
called the possibility to prevent, by means of a simple and free medium, in the case of
a reasonable use of this function, the presentation of line identification
caller on the incoming calls.
3-In cases where the identification of the champ line is offered before the call
be serviced, companies offering electronic communications services must
guarantee to the subscriber called for the possibility of rejecting, through a simple means,
unidentified incoming calls.
4-When the presentation of the identification of the connected line is offered, the companies
that offer electronic communications services must guarantee to the subscriber
called the possibility to prevent, by means of a simple and free medium, the
presentation of the identification of the line connected to the user who effectuates the call.
5-The provisions of paragraph 1 of this Article shall also apply to the calls for countries
that do not belong to the European Union originated in national territory.
6-The provisions of paragraphs 2, 3 and 4 shall also apply to incoming calls originating in
CHAIR OF THE COUNCIL OF MINISTERS
37
countries that do not belong to the European Union.
7-Companies that offer networks and or services of accessible electro-electronic communications
to the public are obliged to make available to the public, and in particular to subscribers,
transparent and up-to-date information about the possibilities referred to in the figures
previous.
Article 10.
Exceptions
1-Companies that offer networks and or services of accessible electro-electronic communications
to the public should, when this is compatible with the principles of necessity, of the
suitability and proportionality, annul for a period of time not more than 30
days the disposal of the presentation of the calling line, on request, made in writing and
duly substantiated, of a subscriber wishing to determine the origin of
unidentified unidentified calls disturbing family peace or the intimacy of life
private, in which case the telephone number of the caller subscribers who have
eliminated the identification of the line is recorded and communicated to the subscriber called.
2-In the cases provided for in the preceding paragraph, the cancellation of the deletion of the presentation of the
flashy line should be preceded to appear mandatory on the part of the CNPD.
3-The companies referred to in paragraph 1 shall also cancel, on a line-by-line basis, the
elimination of the presentation of the calling line as well as registering and making available the
location data of a subscriber or user, in the case provided for in paragraph 2 of the article
7., in such a way as to make such data available to organizations with legal competence to
receive emergency calls for response effects to these calls.
4-In the cases of the previous figures, it must be compulsorily transmitted
prior to the holder of the said data, on the transmission of the same, to the subscriber who
required them in accordance with paragraph 1 or emergency services pursuant to paragraph 3.
CHAIR OF THE COUNCIL OF MINISTERS
38
5-The duty of information to the data holders shall be exercised by the following means:
a) In the cases of paragraph 1, by the issuance of an automatic recording before the
establishment of the call, which informs the holders of the data that, from
from that moment and by the planned deadline, your telephone number cede no longer
confidential in the calls effected to the subscriber who asked for the identification of the
number;
b) In the cases of paragraph 3, by entering into general contractual clauses in the
contracts to be concluded between the subscribers and the companies that provide networks and or
electro communications services, or upon express communication to the
subscribers in the already concluded contracts, which enable the transmission of those
information to emergency services.
6-A The existence of the Registry and the communication referred to in paragraphs 1 and 3 shall be the object
of information to the public and their use should be restricted to the end for it was
granted.
Article 11.
Automatic reforwarding of calls
Companies that offer networks and or services of accessible electronical communications
to the public should assure subscribers the possibility of, through a medium
simple and free, interrupt the automatic forwarding of calls effected
by third parties for your terminal equipment.
Article 12.
[ Revoked ]
CHAIR OF THE COUNCIL OF MINISTERS
39
Article 13.
Lists of subscribers
1-Subscribers must be informed, free of charge and prior to the inclusion of the respects
data in lists, printed or electronical, accessible to the public or that may be
obtained through listings information services, about:
a) The purposes for which the lists are intended;
b) Any other possibilities for use based on search functions
incorporated in electronical versions of the lists.
2-Subscribers have the right to decide on the inclusion of their personal data in a list
public and, if so, decide which data to include, to the extent that these
data is pertinent to the purposes for which the lists are intended, as stipulated by the
supplier.
3-Must be guaranteed to subscribers the possibility of, without additional costs, to check,
correct, amend or withdraw the data included in the said lists.
4-The additional express consent of the subscribers to any
use of a public list that does not consist in the search for coordinates of the people
on the basis of the name and, if necessary, at a minimum of other identification elements.
Article 13-The
Unsolicited communications
1-Is subject to prior and express consent of the subscriber who is a natural person, or
of the user, the sending of unsolicited communications for the purposes of marketing direct,
specifically, through the use of automated call systems and
communication that do not depend on human intervention (call apparatus
automatic), of fax or electronic mail devices, including SMS (services
of short messages), EMS (improved messaging services) MMS (services of
CHAIR OF THE COUNCIL OF MINISTERS
40
multi-media message) and other types of similar applications.
2-The provisions of the preceding paragraph shall not apply to subscribers who are collective persons,
being permitted unsolicited communications for the purposes of marketing direct until the
subscribers refuse future communications and sign up to the list provided for in paragraph 2 of the
article 13 .º-B.
3-The provisions of the preceding paragraphs shall not prevent the supplier from the particular
product or service that you have obtained from your customers, pursuant to the Protection Act
of Personal Data, in the context of the sale of a product or service, the respects
contact electrolytic coordinates, can use them for purposes of marketing direct from the
your own products or services analogous to those transacted, as long as it guarantees to the
customers concerned, clearly and explicitly, the possibility to refuse, free of charge
and easy, the use of such coordinates:
a) At the time of the respect collection; and
b) On the occasion of each message, when the customer did not refuse
initially this use.
4-It is prohibited the sending of electro mail for purposes of marketing direct, hiding or
dissimulating the identity of the person on whose behalf the communication is effected, in
violation of Article 21 of the Decree-Law No. 7/2004 of January 7, without the indication of
a valid means of contact for which the recipient can send a request to put
term to such communications, or that encourages recipients to visit sites on the Internet
which violate the provisions of the said article.
5-To tutor the interests of its customers, as part of the respective interests
commercials, the providers of electronic communications services accessible to the public
have legitimacy to propose lawsuits against the author of the default of
any of the provisions set out in this Article as well as of Article 13.
CHAIR OF THE COUNCIL OF MINISTERS
41
Article 13-B
Lists for the purposes of unsolicited communications
1-To the entities that promote the sending of communications for purposes of marketing direct with
use of automated call and communication systems that do not depend on the
human intervention (automatic calling apparatus), telecopying apparatus or
of electro mail, including SMS (short message services), EMS (services of
improved messages) MMS (multimedia message services) and other types of
similar applications, it is up to you to maintain, by you or by organisms that represent them, a
updated list of people who have expressly and gratuitfully expressed the
consent to the fearage of this type of communications, as well as from customers who
did not object to your prescribing under Rule 13 (3).
2-Compete to the Consumer General Directorate (DGC) keep updated a list of scope
national of collective persons who expressly object to the recetion of
unsolicited communications for the purposes of marketing direct.
3-By inclusion in the lists referred to in the preceding paragraphs may not be charged any
amount.
4-A The insertion in the list referred to in paragraph 2 depends on the filling of an electro form
made available through the DGC's Electrophic page.
5-The entities that promote the sending of communications for the purposes of marketing direct are
required to consult the list, updated monthly by the DGC, which makes it available to
your request.
CHAIR OF THE COUNCIL OF MINISTERS
42
Article 13-C
Cross-border cooperation
1-Without prejudice to the competences assigned to other entities, the CNPD and the ICP-
ANACOM may, in the respects areas of competence, approve measures to ensure
an effective cross-border cooperation in the implementation of this Law.
2-Where they wish to proceed in the terms provided for in the preceding paragraph, the CNPD and the
ICP-ANACOM present to the European Commission, in good time and prior to the approval
of the measures in question, a summary of the reasons for the action, the foreseen requirements and the
proposed actions.
Article 13-D
Competences of the CNPD and the ICP-ANACOM
Within the framework of the competences assigned to them by this Law, the CNPD and the ICP-
ANACOM can, in the respects areas of competence:
a) Elaborate regulations regarding the practices to be adopted for compliance with the
present law;
b) Give orders and make recommendations;
c) Advertise, in respect of websites on the Internet, the codes of conduct that you have
knowledge;
d) Advertise, on your respective websites ' websites, other information you consider
relevant.
CHAIR OF THE COUNCIL OF MINISTERS
43
Article 13-And
Provision of information
1-The entities subject to obligations under this Act shall, when requested,
provide the ICP-ANACOM, in its respective area of competence, all information
related to their activity, so that these authorities can exercise all the
competencies in that forecast.
2-The requests for information referred to in the preceding paragraph shall comply with
principles of appropriateness to the end to which they are intended and proportionality and shall be
duly substantiated.
3-The information requested must be provided within the time limits, in the form and with the
degree of detail required by the ICP-ANACOM, which may also establish the
circumstances and the periodicity of your submission.
4-For the purposes of paragraph 1, the entities shall in a reasoned manner identify the
information that they consider confidential and should piece together, if warranted, a copy
non-confidential of the documents in which they contain such information.
CHAPTER III
Sanctionatory regime
Article 13-F
Default
1-Without prejudice to other applicable sanctionatory mechanisms, whenever the CNPD or
the ICP-ANACOM, in the respects areas of competence, check the infringement of
any obligation arising from this Act, must notify the offender of that fact and
CHAIR OF THE COUNCIL OF MINISTERS
44
give you the possibility of a time limit not less than 10 days to be pronount and, if any
of this, put an end to the default.
2-After proceeding to the hearing, in the terms of the preceding paragraph, the CNPD or the
ICP-ANACOM, in the respects areas of competence, may require the offender to
cesse the default immediately or within the reasonable period fixed for the purpose.
3-If the offender does not put an end to the default on the deadline referred to in the figures
previous, compete with the CNPD or the ICP-ANACOM, in the respective areas of
competence, take appropriate and proportional measures to ensure compliance
of the obligations referred to in paragraph 1 of this Article, in particular the application of
compulsory financial penalties under the terms set out in this Law.
Article 13-G
Surveillance
It is incumbent on the CNPD and the ICP-ANACOM, in the respective areas of established competence
pursuant to the provisions of Article 15, the surveillance of compliance with this Law,
through, respect, the vowels and technicians duly mandated by the CNPD, in the
terms of the Personal Data Protection Act and the supervisory agents or of
mandated duly accredited by the ICP-ANACOM, pursuant to Article 112 para.
of the Electrophic Communications Act.
Article 14.
Counterordinance
1-Constituent counterordinate punishable with the minimum fine of € 1500 and maximum of
€ 25000, when practiced by natural persons, and with a minimum fine of € 5000 and
maximum of € 5000000, when practiced by collective people:
a) The failure to comply with the safety rules of the networks imposed by the n. ºs 1, 2, 3 and 10
CHAIR OF THE COUNCIL OF MINISTERS
45
of Article 3;
b) The failure to comply with the rules of safety in the processing of personal data
imposed by Article 3 (9);
c) The violation of the obligations set out in paragraphs 1, 2, 3, 4, 5 and 10 of Article 3 or
determined in the terms provided for in the respects n. ºs 6 and 9;
d) The violation of the duty of confidentiality, the prohibition of interception or the
surveillance of communications and the respective traffic data provided for in the article
4.
e) The failure to meet the conditions of storage and access to the information provided for
in Article 5;
f) The dispatch of communications for the purposes of marketing direct in violation of the n. ºs 1 and 2 of the
article 13-The;
g) The violation of the obligations imposed in Article 13 (3) of the Article;
h) The sending of electro mail in violation of Article 13 (4);
i) The violation of the obligation set out in Article 13 (1) of the Article-B;
j) The violation of the provisions of Article 13 (3) of the Article-B by the entities provided for in the
respect for para. 1;
k) The violation of the obligation to provide information set out in Article 13-
And;
l) The failure to comply with orders or deliberations of the CNPD, issued pursuant to the
article 13-D and regularly communicated to its recipients;
m) The failure to comply with orders or deliberations of the ICP-ANACOM, issued in the
terms of Article 13-D and regularly communicated to its recipients.
CHAIR OF THE COUNCIL OF MINISTERS
46
2-Constituent counterordinate punishable with the minimum fine of € 500 and maximum of € 20000,
when practiced by natural persons, and with a minimum fine of € 2500 and maximum of
€ 2500000, when practiced by collective people:
a) The violation of the notification requirements set out in paragraphs 7, 8 and 10 of Article 3.
or determined in the terms provided for in respect of paragraph 9;
b) The failure to comply with the conditions of treatment and storage of data from
traffic and location data provided for in Articles 6 and 7;
c) The violation of the obligations laid down in paragraphs 1, 2 and 4 of Article 8 and Articles 9 and
11.
d) The violation of the obligations laid down in Article 10;
e) The violation of the provisions of Article 13.
3-Whether the counterordinance consisted in the non-compliance of a legal duty, whether in the
non-compliance with an order or deliberation emanating from the CNPD or the ICP-
ANACOM, in the respects areas of competence, the application and compliance of the
sanctions do not waive the offender of compliance, if this is still possible.
4-A CNPD or the ICP-ANACOM, in the respective areas of competence, may order the
infractor who complies with the duty or order in question, under penalty of financial penalty
compulsory under the terms of Article 15-C.
5-A negligence and the attempt are punishable by being the minimum and maximum limits of the fine
reduced to half.
CHAIR OF THE COUNCIL OF MINISTERS
47
Article 15.
Processing and application of fines
1-Compete to CNPD the introduction, instruction and archiving of processes of
counterordinance, as well as the application of admotors, fines and ancillary sanctions,
in violation of the provisions of Article 3 (9), Article 3, Article 5, 6 and 7,
in paragraphs 1, 2 and 4 of Article 8, Article 13, Article 13, paragraph 1 a to 4 of the article
13-A, in Article 13 (1) and (3)-B, in Article 13--E and in the l) of the Article 1 (1)
14.
2-Compete to ICP-ANACOM the introduction, instruction and archiving of processes of
counterordinance, as well as the application of admotors, fines and ancillary sanctions,
in violation of the provisions of paragraph 1, 2, 3 and 10 of Article 3, Article 4, Article 9,
in Article 11, Article 13-E and in the m) of Article 14 (1).
3-A the initiation of counterordinance processes and the application of fines
relative to the illicit ones provided for in the preceding paragraph are the competence of the board of
administration of the ICP-ANACOM, by the end of the instruction to the respects services.
4-The powers provided for in the preceding paragraph may be delegated.
5-The amount of the fines reverses to the State in 60% and to the CNPD or to the ICP-
ANACOM, depending on the cases, in 40%. "
Article 15-The
Ancillary sanctions
1-Within the framework of the counterordinations provided for in Article 15 (2), where the
gravity of the infraction and the fault of the agent justifies it, the ICP-ANACOM can apply
an ancillary sanction of loss in favour of the State of objects, equipment and
CHAIR OF THE COUNCIL OF MINISTERS
48
infringing devices, including the product of the benefit obtained by the offender through the
practice of counterordinance.
2-Who disrespecting an ancillary sanction that has been applied to it, incurs a crime
of qualified disobedience.
Article 15-B
Loss in favour of the State
1-Without prejudice to the provisions of paragraph 1 of the preceding Article, they shall be deemed to be lost in favour of the
State the illicit objects, equipment and devices that have been cautionary or
provisionally seized by the ICP-ANACOM and that, after notification to the
interested in order to collect them, have not been claimed within 60 days.
2-The objects, equipment and illicit devices lost in favour of the State revert
for the ICP-ANACOM, which will give them the destination that they judge appropriate.
Article 15-C
Compulsory financial penalties
1-Without prejudice to other applicable penalties in the event of non-compliance with decisions of the
CNPD or the ICP-ANACOM that impose administrative or ordinance sanctions, on the
exercise of the powers that lawfully assist them, the adoption of behaviors or of
measures determined to the recipients of this Law, may those authorities,
fundamentedly, impose a compulsory pecuniary penalty, in the cases referred to in the
points a ) a i) and l) a m) of paragraph 1 and a ), d ) and and ) of Article 14 (2).
2-A compulsory pecuniary penalty consists of the imposition to your recipient of the
payment of a pecuniary amount for each day of delay in fulfillment beyond
of the deadline set.
3-A compulsory sanction is fixed second criteria of reasonableness and proportionality,
listening to the economic situation of the offender, specifically to its volume of
CHAIR OF THE COUNCIL OF MINISTERS
49
business in the previous calendar year, and to the negative impact of default on the market and
in users, and the daily amount may be located between € 500 and € 100000.
4-The amounts set out in the terms of the preceding paragraph may be variable for each day
of default in a growing sense, and may not surpass the amount
maximum of € 3000000 nor the maximum duration of 30 days.
5-The amount of the sanction applied reverses to the State in 60% and to the CNPD or to
the ICP-ANACOM in 40%.
6-Of the acts of the CNPD and the ICP-ANACOM, practiced under this article It is up to
resource, depending on whether they are practiced in the context of a counterordinance process or
administrative, pursuant to the legislation applicable to each type of process concerned.
Article 16.
Subsidiary legislation
In everything that is not provided for in this Law, the provisions shall apply
sanctionatoriums that appear in Articles 33 to 39 of the Personal Data Protection Act.
CHAPTER IV
Final and transitional provisions
Article 17.
Technical characteristics and standardization
1-Compliance with the provisions of this Law shall not determine the imposition of
specific technical requirements of terminal equipment or other equipment
of electronical communications that may impede the placing on the market and the circulation
of such equipment in the countries of the European Union.
2-Exceed from the provisions of the preceding paragraph the elaboration and issuance of characteristics
specific techniques required for the implementation of this Law, which they must be
CHAIR OF THE COUNCIL OF MINISTERS
50
communicated to the European Commission in the terms of the procedures laid down in the
Decree-Law No. 58/2000 of April 18.
Article 18.
Transitional provisions
1-The provisions of Article 13 shall not apply to the editions of already drawn up lists or
placed on the market, in printed or electronic form out-of-line, before the
entry into force of this Law.
2-In the case of the personal data of subscribers to telephone services accessible to the
fixed or mobile public have been included in a public list of subscribers, in
compliance with the previous legislation and prior to the entry into force of this Law, the
personal data of those subscribers may keep themselves on that public list in their versions
printed or electro-printed.
3-In the case provided for in the preceding paragraph, subscribers shall have the right to decide by
withdrawal of your personal data from the public list in question, and you must receive beforehand
complete information on the purposes and options of the same in accordance with the
article 13.
4-A information referred to in the preceding paragraph shall be sent to subscribers in the
a maximum period of six months from the date of entry into force of this Law.
Article 19.
Repeal
It is repealed the Act No 69/98 of October 28.
Article 20.
Entry into force
This Law shall come into force on the day following that of its publication.
