Lisbon city hall fined €1.2M for sharing protesters’ personal data to Russia
CNPD has fined Lisbon City Council €1.2 million in the case related to the processing of personal data of participants in demonstrations.
The National Commission for Data Protection (CNPD) has fined Lisbon City Council €1.2 million in the case related to the processing of personal data of participants in demonstrations, confirmed an official source of the municipality to Lusa on Friday.
The CNPD had already announced in July 2021 – when the local authority was still led by socialist Fernando Medina – the identification of 225 offences in communications made by the municipality in the context of demonstrations, rallies or parades.
The case was opened due to a complaint – which was filed with the CNPD on March 19 2021 – regarding the communication to the Russian embassy in Portugal and the Russian Ministry of Foreign Affairs of personal data of the promoters of a demonstration held near the embassy.
According to the CNPD’s draft decision, known at the time, 111 offences concern the communication of data to third parties and 111 concern the dissemination of information to municipal services and offices. There is also one communication that violates the “right to information”, another that calls into question the principle of data retention limitation and, finally, one offence for lack of data protection impact assessment which could reach €10 million, while the other 224 could each reach up to €20 million.
