No. Doxxing—revealing private personal data without consent—is illegal in Portugal under multiple statutes, including the Penal Code (Art. 192) and GDPR-equivalent provisions enforced by the Comissão Nacional de Proteção de Dados (CNPD). Unauthorized disclosure risks criminal prosecution, fines up to €5M, or imprisonment for up to 3 years, with aggravated penalties if the act incites violence or harassment.
Key Regulations for Doxxing in Portugal
- Penal Code (Art. 192): Criminalizes the dissemination of another’s private data with intent to harm, threatening imprisonment up to 3 years or fines.
- General Data Protection Regulation (GDPR) + Lei 58/2019: Mandates strict consent requirements for personal data processing; unauthorized sharing violates Art. 82, triggering CNPD enforcement.
- Cybercrime Law (Decreto-Lei 36/2018): Addresses digital harassment, including doxxing, with penalties escalating if the act targets vulnerable groups or public figures.
Enforcement prioritizes cases with malicious intent, though even negligent disclosures may incur administrative sanctions. The Polícia Judiciária and Ministério Público actively investigate high-profile incidents, particularly those linked to online harassment campaigns. CNPD’s 2024 guidelines further clarify that “public interest” exceptions are narrowly construed, requiring explicit legal justification. Organizations handling user data must implement technical and organizational measures (Art. 32 GDPR) to prevent leaks, as vicarious liability applies under Lei 58/2019.