Nearly Free Flowing

On October 9^th, 2024, the Council of Ministers approved the Decree-Law that will implement Regulation (EU) 2018/1807, which created a regime for the free flow of non-personal data in the European Union in the national legal order.

This Regulation was driven by the recognition that the information and communications technology sector is no longer a specific sector, but the basis of all economic systems and all modern and innovative societies.

The European regulation in question is thus designed to make it easier to carry out cross-border data transfers within the European Union and to create a single market for data storage and processing services, such as cloud computing.

Although it is a Regulation (and therefore directly applicable in the national legal system), the European instrument contains provisions that require the adoption of implementing acts by the national legislator (rules that, for example, involve identifying the competent entity as the single national online information point and its powers, adopting mechanisms and procedures for complying with notification obligations, and determining minimum, maximum and ancillary sanction limits).

A draft Decree-Law to implement Regulation (EU) 2018/1807 was submitted to the National Data Protection Commission for consideration by the Ministry of Youth and Modernity at the beginning of 2024 in which, according to the Commission’s Opinion 2024/37, “there is nothing to note” regarding the protection of personal data.

Even after the CNPD gave a positive opinion, and the project was approved by the Council of Ministers, the implementation of the European Regulation (adopted in 2018, 6 years ago) is still some way off. After approval, the statute must be promulgated by the President of the Republic, signed by the Prime Minister, only after which it will be published in the official legal journal of the Portuguese Republic, and the vacatio legis period will then begin.