GDPR Fines

A public record of GDPR enforcement across Europe — compiled by INPLP members

City Council of Nelas

Country
Portugal
Fine
2,500 EUR
Date
25.07.21(25.07.21)
Sector
Public administration
Articles
Articles 5º/1 a) and 83º/5 GDPR (Regulation UE 2016/679), its implementing portuguese law (Law 58/2919, August 8) and CNPD guidelines.

Disclousure of personal data regarding the health of two citizens on social media.

The Portuguese Data Protection Supervisory has applied a fine of EUR 2.500 to the City Council of Nelas, in light of a series of complaints filled due to the disclosure, on social media, of personal data regarding two people that had been infected with the covid-19 virus on a parish of the municipality. Although the municipality did not mention the specific name or address (indicating only the parish of residence) of the persons concerned, it revealed a circumstance (a trip to a certain country within a specific time interval) that allowed, according to the CNPD, in that small community, to identify to whom the social media post had referred to.