ARTICLE
13 January 2025

The Free Flow Of Non-Personal Data

P
PLMJ

Contributor

PLMJ is a law firm based in Portugal that combines a full service with bespoke legal craftsmanship. For more than 50 years, the firm has taken an innovative and creative approach to produced tailor-made solutions to effectively defend the interests of its clients. The firm supports its clients in all areas of the law, often with multidisciplinary teams, and always acting as a business partner in the most strategic decision-making processes.
Decree-Law 85/2024 was published on 4 November 2024 to ensure the implementation into Portuguese law of Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018.
Portugal Privacy

Decree-Law 85/2024 was published on 4 November 2024 to ensure the implementation into Portuguese law of Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018. This Regulation aims to ensure the free flow of non-personal data within the European Union, allowing data to be stored and processed in any Member State, except in specific cases of public security or national defence.

The objective is to allow for greater freedom and dynamism of the economy in the provision of data storage and processing services within the EU. Therefore, Member States should repeal any rules, regulations or practices that require non-personal data to be localised in a specific geographical area or national territory in order to restrict the storage and processing of data outside those specific geographical areas or territories.

This Regulation aims to remove unjustified obstacles to the free movement of non-personal data, thereby promoting a more integrated and efficient digital single market.

We would therefore like to highlight a few important points:

i) The AMA as the central authority: The Agency for Administrative Modernisation (AMA) is designated as the national contact point, centralising information on data localisation requirements. The AMA updates and provides information on legislation and facilitates communication between Portugal and other Member States.

ii) Single website for digital services: The AMA must maintain relevant information on data localisation standards on the Single Digital Services Website, providing transparency and access to applicable standards and laws.

iii) Supervision and penalties: The Food and Economic Safety Authority (ASAE) monitors compliance and imposes sanctions, such as minor or serious administrative offences, in cases of non-compliance. In addition, additional sanctions may be imposed in serious cases, with the cooperation of other regulatory bodies to strengthen supervision and enforcement.

iv) Regional Autonomy: The autonomous regions of the Azores and Madeira are free to adapt their inspection and enforcement practices, guaranteeing local alignment with the requirements of the decree. The revenue from fines is divided between the state (60%), AMA (10%) and ASAE (30%).

v) Administrative offences: The Legal Framework for Economic Administrative Offences, approved by Decree-Law 9/2021 of 29 January, will apply, in the alternative, to the administrative offences provided for in this Decree-Law.

Finally, the provisions of this law come into force 60 days after publication, giving organisations time to adjust their operations to the new requirements. This Decree-Law represents a step forward in standardising data processing in Portugal and strengthening digital integration with the European Union.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More