Portugal
I II.2 Statutory exemptions Data protection laws often provide for exemptions or exceptions to the processing of personal data in certain circumstances. For example, certain legal obligations may require the processing of personal data without the consent of the data subject (i.e., to meet tax obligations, conduct criminal investigations, or comply with court orders). In addition, data protection legislation may provide exemptions for the processing of personal data for journalistic, artistic, scientific, or cultural purposes, provided that it is carried out in accordance with ethical principles and fundamental rights. There may also be exemptions for the processing of personal data for reasons of public interest in areas such as public health, public security, crime prevention, or protection against threats to public security. However, the data controller, within the scope of these exemptions, is still required to ensure that the processing of personal data is fair, transparent, and proportionate to the specific purposes (in other words, subject to appropriate and specific measures to protect the rights and freedoms of natural persons). III. 3 Territorial and extra-territorial application As a general rule, the GDPR applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place www.mgra.pt
in the Union or not (Article 3(1) GDPR). It should be noted that the GDPR may also apply to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union (Article 3(2) GDPR) and/or to the processing of personal data by a controller not established in the Union (Article 3(3) GDPR). In its turn, the PDPL applies to the processing of personal data conducted within Portugal, regardless of the public or private nature of the controller or processor, even if the processing of personal data is carried out in fulfilment of legal obligations or in the pursuit of public interest missions, with all the exclusions provided for in Article 2 of the GDPR applying. Regarding the extra-territorial application, the PDPL also applies to the processing of personal data carried out outside Portugal when: It is carried out within the scope of the activity of an establishment located in Portugal; or It affects data subjects who are in Portugal when the processing activities are subject to Article 3(2) of the GDPR; or It affects data registered in the consular offices of Portuguese nationals residing abroad.
Made with FlippingBook - PDF hosting