The Portuguese data protection authority ('CNPD') issued, on 27 April 2021, a decision ordering the National Institute of Statistics ('INE') to suspend within 12 hours any international transfer of personal data, specifically Census 2021 data, to the USA or other third countries without an adequate level of protection. In particular, the decision notes that, following complaints regarding the conditions for collecting data for the Census 2021, the CNPD carried out a brief investigation and concluded that INE engaged Cloudflare, Inc. for the operationalisation of the census survey, which in its contract provides for the transfer of personal data to the USA.

In addition, the decision highlights that Cloudflare is a California-based company and is directly subject to US surveillance legislation for national security purposes, which imposes a legal obligation to grant unrestricted access to any personal data in the companies possession to US authorities without being able to inform other parties such as clients or data subjects. 

Moreover, the decision highlights that the Court Justice of the European Union's ('CJEU') judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('Schrems II') clarified that such US surveillance legislation implies a disproportionate interference in the fundamental rights of data subjects, in light of EU law, thus not ensuring a level of data protection essentially equivalent to that guaranteed in the EU. In addition, the decision adds that the CJEU also considered that data protection authorities are obliged to suspend or prohibit data transfers, even when based on contracts based on the model approved by the European Commission, as is the case with the clauses used by INE, if there are no guarantees that these can be respected in the third country.

Lastly, the decision considers that the personal data, included sensitive data such as those related to religion or health condition. Therefore, the CNPD decided that the transfer of such data to the USA or any other third country without adequate protection should be suspended. 

You can read the press release here and the decision here, both only available in Portuguese.