Answer ... The Portuguese courts are not bound by the rule of precedent. Case law may give some indication of how courts tend to enforce the regime; but as discussed below, contradictory decisions on the same theme exist. Moreover, there are no available statistics on cases involving personal data protection. Therefore, a sample of cases decided in the higher courts in recent years is presented below. Please note that all these cases involved the previous regime and not the General Data Protection Regulation.
Case 1: Images collected by a video surveillance system installed in a retail shop to safeguard the security of persons, goods and premises are admissible as evidence in a court of law, as long as there is just cause for their collection (eg, documenting a criminal offence) and the images do not reveal intimate aspects of the private life of the suspect (10 October 2012, High Court of Coimbra).
Case 2: Information on the identity and address of the registered owner of a toll tag for use in a private car, and details of the locations where the tag has been active, are protected as personal data. This data must not be disclosed in the benefit of private interests, such as for repossession of the car in a judicial enforcement (27 March 2014, High Court of Évora).
Case 3: Information on the identity and address of the registered owner of a toll tag for use in a private car, and details of the locations where the tag has been active, are protected as personal data and may be qualified as ‘sensitive’. However, this protection may be waived where the information is needed to enforce the repossession of the car in a judicial enforcement (17 May 2016, High Court of Porto).
Case 4: The simple fact that personal data that was unlawfully processed was already public at the time of processing does not preclude the breach of the data subject’s rights, as the reach of protection goes beyond mere privacy, extending to the right of informational self-determination. The further processing of such personal data (for purposes that are not compatible with those which justified its collection) is unlawful and the data subjects affected are entitled to fair compensation (16 October 2014, Supreme Court of Justice).
Case 5: When installing a video surveillance system in a work area, accessible only to employees of the data controller, a balance must be achieved to ensure that use of the surveillance system is proportionate to, and justified by, a reasonable security risk or a specific danger, not just for the generic purpose of prevention or security. The use of such a system must be appropriate, necessary and proportionate (6 November 2014, Central Administrative Court–South).
Case 6: A person who worked as a hair stylist for a company and subsequently promoted her own business as a hair stylist, using personal data collected by her former employer, committed a criminal offence of failure to fulfil her duties to protect personal data (22 April 2015, High Court of Porto).
Case 7: The plaintiff in a judicial case requested an expert assessment of his psychological condition, which was granted. The expert report was entered into the proceedings of the case. Subsequently, the same plaintiff requested the removal and destruction of all copies of the report, invoking the Personal Data Protection Act, which he deemed applicable due to the sensitive nature of his own data. The request was denied and the plaintiff appealed. The appeal was rejected on the grounds that, regardless of its contents, the report had been entered as means of proof into the proceedings, not as a ‘personal data file’, but rather as an expert report, which was not subject to the regime of protection of personal data (11 February 2016, High Court of Guimarães).