Portuguese Data Protection Authority Agenda for 2021

In an atypical year like 2020, the Portuguese National Data Protection Commission (henceforth 'CNPD') has made every effort to fulfil its role. In fact, despite the postponement of its enforcement actions and conclusion of procedures, the Portuguese supervisory authority has played a very active role in its advisory task, in particular on matters raised in the context of teleworking, distance learning and health data processing.

For 2021, despite the constraints resulting from the epidemiological context, the CNPD has published its "plan of activities", which contents will be highlighted below.

In 2021, the CNPD proposed to review the requirements and procedures for the adoption of codes of conduct, as well as the measures and procedures to ensure Privacy by design and Privacy by default, and to study European case law on the protection of personal data and privacy. This year, we will also expect special attention from CNPD in the processing of personal data using artificial intelligence technologies.

Alongside the above, the Portuguese supervisory authority undertakes to monitor, inter alia, developments in the European legislative process for the revision of the regime on privacy in electronic communications, as well as the processing of personal data by the electoral administration in the context of the presidential elections.

In addition, and following a year highly marked by the pandemic caused by COVID-19, the CNPD undertakes to monitor the processing of personal data carried out in the context of teleworking, as well as the transition to the new Schengen Information System, which will become operational in 2021. 

• Within the framework of its guidelines, the Portuguese supervisory authority intends to address and further develop the topics of data processing of children, cookies, and privacy policies (in this case in order to support data controllers). With regard to its role as a supervisory body, the CNPD is committed to continue carrying out actions to verify compliance with the legal framework on data protection, as it is required to do under the GDPR. The latter also emphasizes its intention to state its standpoint on the activity of Call Centres, TVDEs, as well as on video surveillance in public space.
• Lastly, the CNPD is adopting new objectives for its internal organization and functioning. In this regard, special emphasis is placed on improving interaction with citizens and data controllers, by implementing electronic procedures, which will certainly make it possible to overcome the shortcomings commonly associated with physical ones.

In view of the pandemic context - which will continue throughout 2021 -, the proactivity of the CNPD will prove indispensable for the protection of the rights of data subjects. The question is whether the CNPD will actually be able to fulfil or enforce all that it set out to do.