Portugal - Digital Human Rights (27/2021)

Overview

The Carta Portuguesa de Direitos Humanos na Era Digital (Lei n.º 27/2021, de 17 de maio) is a statutory charter that enumerates rights, guarantees and State duties aimed at ensuring that rights, freedoms and guarantees recognised in Portuguese law apply fully in the digital environment. The law covers access to the Internet, freedom of expression and creation online, protections against disinformation, privacy and data protection, rights and safeguards regarding artificial intelligence and automated decision-making, net neutrality, digital skills and education, identity and reputation, the right to be forgotten, platform-user protections, cybersecurity and special protections for children and for interactions with public administration. The text was published in the Diário da República on 17 May 2021 and entered into force 60 days after publication (effective 16 July 2021). The full official text is available from the Diário da República, and consolidated and explanatory material is available on the Assembleia da República and Government pages. Key subsequent adjustments include a Declaração de Retificação (9 June 2021) and an amendment (Lei n.º 15/2022) simplifying the desinformation regime and aligning it with the European Action Plan against Desinformation. For the official (published) law see Diário da República — Lei n.º 27/2021 (PDF) and the parliamentary consolidated entry at Assembleia da República.

Definitions

The Charter uses and defines concepts consistent with Portuguese legal usage and EU law. Key definitions are those embedded in the law: "ambiente digital" (digital environment/cyberspace), "desinformação" (defined as narratives knowingly false or misleading intended to gain economic advantage or to deceive and potentially harming public interests or democratic processes), "plataformas digitais" (platforms enabling communication and information flows), and references to automated decision-making and "algoritmos" with requirements for explainability, auditability and review. The Charter cross-refers to existing national laws and EU instruments for terms such as personal data treatment (as regulated under the GDPR and national implementing law) and for media regulation standards defined in media legislation. The law expressly states that rights, freedoms and guarantees afforded in the Portuguese legal order apply fully in cyberspace; where the Charter invokes EU-level standards (for example on data protection or EU action plans), it defers to the applicable European instruments and their legal regimes.

Governance and Institutional Framework

Governance under the Charter is distributed across existing national institutions rather than creating a single new supervisory authority. Legislative authority and publication were handled by the Assembleia da República and the Diário da República (DR — Lei n.º 27/2021), with promulgation by the President of the Republic. Implementation and enforcement rely on sectoral regulators and public bodies within their statutory competences. For example, complaints relating to disinformation are channelled to the Entidade Reguladora para a Comunicação Social (ERC) under the applicable media law framework; the ERC is mentioned in the Charter as a forum for complaints and for the use of media-regulatory procedures in relevant cases. Data protection aspects remain within the competence of the Comissão Nacional de Proteção de Dados (CNPD), which enforces GDPR-based obligations and has public guidance and enforcement powers. Responsibilities for digital inclusion, connectivity and public access are assigned to the State and to ministries and agencies responsible for digital policies and public services; the Charter requires the State to promote programmes to reduce regional asymmetries in connectivity and to create social tariffs and public access points. The law also foresees that certain administrative procedures and the digital rights in administrative interactions will be regulated by administrative law and implementing measures to be adopted within statutory deadlines (for example provisions to be adopted within 180 days after entry into force). See the parliamentary consolidated page for institutional references and amendments at Assembleia da República and the official publication Diário da República.

Key Focus Areas

The Charter’s substantive provisions cluster around several focus areas. Access and inclusion: Article 3 recognises a universal right of access to the Internet and instructs the State to promote connectivity, public access points (libraries, schools, health centres), a social tariff and measures to reduce regional digital divides. Freedom of expression and content: Articles 4–6 protect freedom of expression and creation online, while establishing State obligations to implement the EU Action Plan on Disinformation and specifying a definition of disinformation (with subsequent simplification through Lei n.º 15/2022). Privacy and data protection: Article 8 recognises the right to electronically communicate using encryption and to exercise control over personal data in line with EU and national data protection law. Identity and reputation: Articles 11–13 address digital identity, the right to the right to be forgotten and restrictions on processing special categories of data in certain formats. AI and automated decision-making: Article 9 prescribes that AI use must be oriented by respect for fundamental rights and sets out principles — explainability, security, transparency and accountability — and requires that significant algorithmic decisions be communicated, auditable and reviewable. Platform governance: Article 14 grants platform users rights to clear privacy information, data access and dispute resolution mechanisms. Cybersecurity: the Charter recognises a right to cybersecurity and requires State action and user protections. Children and vulnerable groups: Article 20 imposes special duties to protect children and to promote digital literacy. Public administration: Article 19 grants rights to digital administrative interactions, data re-use and assistance for digital-only procedures. These elements together form a rights-based, cross-sectoral framework for the digital era. The primary legal text is at Diário da República — Lei n.º 27/2021.

Implementation Framework

Implementation is predominantly the responsibility of the State and of sectoral regulators working within their existing mandates. The Charter requires the adoption of implementing rules in certain areas (for example administrative procedures in digital format to be regulated within 180 days after entry into force). For disinformation, the State must ensure compliance with the European Action Plan against Disinformation and support the development of fact-checking structures and quality seals for trusted entities; after parliamentary debate the disinformation regime was simplified by Lei n.º 15/2022 (11 August 2022) to better align national rules with the European approach. Data protection obligations operate through the existing GDPR regime and the CNPD; media-related complaints and sanctions use ERC procedures under media law. The Charter is therefore operationalised through: (i) State programmes for connectivity, literacy and social tariffs; (ii) sectoral regulation and complaint handling (ERC for media/disinformation; CNPD for data protection); (iii) administrative implementing legislation for digital public services; and (iv) voluntary and supported initiatives (e.g., support for fact-checkers). Official implementation guidance and references to the law and amendments are available at the Assembleia da República consolidated pages and the Diário da República publication (Parlamento — consolidated; DR — PDF).

Monitoring and Evaluation

Monitoring relies on multiple bodies: sectoral regulators will evaluate compliance within their remits (ERC for media, CNPD for data protection, sector-specific supervisors for telecoms and critical infrastructure). The Charter anticipates State reporting and the use of existing oversight channels to evaluate digital inclusion, connectivity objectives, and effectiveness of measures against disinformation. Additionally, the Charter encourages the creation and support of fact-checking entities and quality labels, which function as part of a broader information ecosystem monitoring. Stakeholder channels, public complaints and administrative review procedures are formalised as available routes for redress and contribute evidence for evaluation. The law’s amendment and clarifications — for example the 2022 revision of the disinformation provisions — demonstrate the use of legislative follow-up to adjust operational approaches in light of monitoring and constitutional review processes. See legislative consolidated records at Assembleia da República and regulatory pages such as the ERC and CNPD for enforcement activity and reports (ERC, CNPD).

Penalties, Liability, and Appeals

The Charter itself is chiefly rights-protective and relies on existing sectoral sanctioning frameworks for enforcement. For disinformation-related complaints, Article 6 expressly provides for complaints to the Entidade Reguladora para a Comunicação Social and applies the procedural and sanctioning mechanisms referenced in existing media legislation (see Law n.º 53/2005 for regulatory reference in the Charter). Data protection violations continue to be subject to the GDPR enforcement regime applied by the CNPD, including fines and corrective measures. Other civil or criminal remedies for illicit conduct online remain under the general legal framework (civil liability, criminal law, consumer protection, intellectual property, and telecoms regulation) and are to be pursued under the relevant statutes. The Charter requires the State to facilitate alternative dispute resolution and administrative complaint channels, and retains judicial and administrative remedies available under Portuguese law. Official references: the published law in the Diário da República and ERC and CNPD enforcement pages provide the links between the Charter and existing sanctioning regimes (DR — Lei n.º 27/2021; ERC; CNPD).

Relationship to Other Instruments

The Charter explicitly situates itself within the national and European legal frameworks. It cross-references and works alongside the GDPR (Regulation (EU) 2016/679) for data protection, media law and regulatory statutes for complaints and sanctions, the European Action Plan against Desinformation (as the national implementation objective for disinformation policy prior to amendment), and ongoing EU-level instruments on platform regulation and AI. The Charter does not replace sectoral legislation; rather it provides a rights-based statement of principles to be applied across sectors and implemented through existing specialised regimes and new implementing measures foreseen in the Charter. Amendment by Lei n.º 15/2022 illustrates legislative interaction where national law is adapted to align with EU strategies on disinformation. For original law text and amendment see the Diário da República publication and the Assembleia da República consolidated page (DR — Lei n.º 27/2021; Assembleia da República — consolidated).

International Alignment

The Charter expressly references European action: Article 6 links national policy on disinformation to the European Action Plan against Disinformation. The Charter’s data protection and AI-related provisions align with EU-level instruments — notably the GDPR for personal data and the EU policy debates and proposals on AI transparency, accountability and rights-preserving safeguards. It therefore functions as a national articulation of digital rights that is harmonised with EU norms and initiatives, and is intended to guide Portugal's participation in international processes on digital rights. Relevant EU legislative and policy instruments (GDPR, EU action plans, proposed AI regulation and Digital Services/Markets Acts) form the transnational context in which the Charter operates. See the national law and official parliamentary material (DR — PDF; Assembleia da República) and EU primary sources for the GDPR and EU action plans (official EU legislative databases such as EUR-Lex).

Implementation Timeline

Event	Date
Approval by Assembleia da República	2021-04-08
Promulgation by President	2021-05-08
Publication in Diário da República (official)	2021-05-17
Declared entry into force (60 days after publication)	2021-07-16
Declaração de Retificação (correction)	2021-06-09
Amendment (Lei n.º 15/2022 simplifying disinformation regime)	2022-08-11

Compliance Checklist

Actor	Checklist Items
State / Ministries	Promote broadband, social tariff, public access points; adopt implementing administrative rules within statutory deadlines; support fact-checkers and public digital literacy programmes.
Platforms	Provide clear privacy information; ensure user data access mechanisms; enable complaint and alternative dispute resolution routes; respect user rights under national and EU law.
Regulators (ERC, CNPD)	Accept and process complaints per mandate; coordinate on cross-cutting issues (disinformation, data protection, media law); publish guidance and decisions.
Public Administration	Ensure digital procedures include assistance, data portability/sharing where lawful, and compliance with rights in Article 19.

Sources and References

Source	Type
Lei n.º 27/2021, de 17 de maio — Diário da República (PDF)	Primary Source
Assembleia da República — Consolidated entry	Primary Source
Secretaria-Geral da Economia — Highlight on Lei n.º 27/2021	Primary Source
Declaração de Retificação n.º 18/2021 — Assembleia da República	Primary Source