[ad_1]
It’s not just Russia. The list of countries where the Lisbon City Council had improperly made the names of protesters public before 2021 included Libya, China, Hungary, Ukraine, Belarus, Colombia, Venezuela, Chile, Brazil, Guinea-Bissau, Angola, India, Pakistan, Cyprus, Turkey, Israel and the United States, in addition to the Palestinian diplomatic mission. The Administrative Court of Lisbon held that the city government, then governed by Fernando Medina, not only had no reason to share this personal data, but also could not do so. And he knew it. In fact, it appears to have been common practice to share the personal data of activists with the countries where they organized protests, at least between 2019 and 2021, despite the fact that the city government, then governed by Fernando Medina, had no reason to share this personal data. And he knew it. GDPR is effective from May 25, 2018which applies to the institutions and entities that make up the public administration. That is why he found CML guilty and willful in the case that later became known as “Russiagate”.
Among the findings of the deliberations obtained by SAPO, there is evidence that the Chamber collected information from protesters and representatives of associations promoting the protests, including name, address, “occupation, telephone contact details, nationality, date of birth, affiliation, marital status, taxpayer and civil identity card numbers, data related to residence permits and sometimes copies of civil identity documents”.
Between 2018 and June 2021, the municipality, then led by Fernando Medina, sent such information on 111 occasions of protests, demonstrations, rallies, processions, assemblies or public gatherings, sharing the personal data of the initiators or protesters not only with different government agencies (mainly the MAI, but also the Prime Minister and other ministries), the Congress of the Republic and the Presidency, as well as the security forces (the PSP, PJ, Municipal Police, Civil Protection, Municipal Offices, etc.) In addition to collecting and sharing them, it also archives them without the processing required by the data protection regime, contrary to the provisions of the Data Protection Law (GDPR).
The Administrative Court of Lisbon considered the arguments of the CML appeal to be without merit and decided to impose a fine of 1 million euros, 222,500 euros less than initially anticipated, taking into account a number of administrative offences that led to the National Commission for Data Protection (CNPD) confirming to SAPO the lawyer Tiago Cabanas Alves who handled the case on behalf of the CNPD. SAPO has been informed that the order notifying the parties of the Court’s decision of July 21 this year was issued yesterday and entered into the CML today.
In several of them, involving more than a hundred people of different nationalities, it was confirmed that the files to which SAPO had access, personal data were sent to representatives of the countries where they protested, without informing them that their identities would be shared with them.
The judgment reads: “The only information transmitted to the prosecutors regarding the operations carried out with the data in their possession is contained in the unified reply confirming the receipt of the notification of performance”, taking into account that it has been proven that the municipality did not inform about the personal data forwarded, but first of all clearly indicating that they only sent information about the protest to the MAI and PSP.
Nevertheless, according to the deliberations obtained by SAPO, it is considered that CML “has carried out a series of operations with information related to natural persons in the context of carrying out a specific public activity, which necessarily has consequences for the privacy and their freedoms”, having failed to comply with the obligation to be aware of the legal framework to which it must comply, thus putting these citizens at risk. “The Lisbon City Council freely, carefully and knowingly sent one hundred and eleven electronic communications to the Lisbon City Council services containing information related to natural persons who subscribed to the notifications of meetings, assemblies, demonstrations and processions, who did not need to know the personal information used for the preparation and performance of a public task, knowing full well that their actions were prohibited and sanctioned by law (…), and sent them to “third parties for specific purposes, not explicit and unlawful, who were well aware that their actions were prohibited and sanctioned by law”.
He therefore concludes from the intention: “It was inferred from the knowledge available to the organization and from the modeling capabilities it possessed regarding the GDPR rules that it could and should have implemented them (as it did, albeit too late)” – placing the blame on the local authorities but absolving those who carried out the procedures. Remember that on July 2, 2021, about a month after the outbreak of the Russiagate scandal, the then CML president, Fernando Medina, decided to remove the person responsible for data protection from the agency. The Court now states that he and other employees are not legally obliged/prohibited to be held responsible for their knowledge of the CML’s responsibilities.
“Similarly, the Lisbon City Council freely, deliberately and consciously retained information relating to the initiators of the aforementioned demonstrations, after the purpose of collecting it had been achieved, knowing full well that their actions were prohibited and sanctioned by the government. The law also reads the document, adding that CML also “freely, deliberately and consciously” did not inform the holders of the information with which it shared and stored the data, nor did it carry out “an assessment of the impact of the processing” of information of highly sensitive personal data, as it could have harmful consequences for the fundamental rights of its holders, knowing full well that their actions were prohibited and sanctioned by the law.
[ad_2]
Source link
