Portugal

Summary

Portugal presents medium risk for commercial web scraping. Lei n.º 109/2009 (Lei do Cibercrime), implementing the Council of Europe Budapest Convention and Directive 2013/40/EU, criminalises illegal access to computer systems (art. 6). The base offence (accessing without authorisation or beyond authorised scope) carries up to 1 year imprisonment or a fine; the aggravated form (bypassing a security measure) carries up to 2 years. This is broader than France's art. 323-1 (which expressly requires a security measure), making Portugal marginally riskier for public-page scraping. Portugal transposed DSM Directive 2019/790 via Decreto-Lei n.º 47/2023 (in force 4 July 2023), amending the Código do Direito de Autor e dos Direitos Conexos (CDADC) to add TDM exceptions aligned with DSM Arts. 3 and 4 — a mandatory research TDM exception and a commercial TDM exception subject to machine-readable opt-out (including robots.txt). Portugal's late DSM transposition resulted in a CJEU ruling (May 2025) ordering Portugal to pay €2.5 million in lump-sum penalties; DL 47/2023 cures the infringement prospectively. Portugal retains the full EU sui generis database right (CDADC arts. 12-A to 12-F). GDPR is enforced by the CNPD, which has not issued dedicated web-scraping guidance but applies general GDPR principles. EU AI Act Art. 53 binds GPAI providers from Aug 2025. No scraping-specific statute or significant published case law on scraping exists; the framework is general EU law applied through national transposition.