CNPD fines National Institute of Statistics 4M euros

Portugal's National Data Protection Commission fined the National Institute of Statistics 4.3 million euros for five violations of the EU General Data Protection Regulation related to the 2021 census. The CNPD determined the INE unlawfully processed personal health and religious data, failed to notify respondents of the 2021 census questionnaire, violated data transfer provisions, failed to conduct a data protection impact assessment and did not meet due diligence in selecting a subcontractor.