Against what is provided for in law, the agency sent an email revealing the e-mail address of 547 candidates for regularization in the country. Messages summoned citizens to the mission structure in Porto.
The Agency for Integration, Migration and Asylum (AIMA) leaked personal data of immigrants in Portugal. An email in which 547 citizens summoned the collection of biometric data in the mission structure that operates in Porto was fired, together, for all electronic addresses. The message should be individual, for the sake of secrecy.
The email sent to hundreds of immigrants was inaccurate. It indicated that the people listed should attend the mission structure between 7 p.m. and 9 p.m., but did not specify the date. He also said that the goal was to redo biometrics, but on the list, there were people who had not even collected the biometric data: fingerprints and photography.
The fact that so many people have access to the same e-mail left immigrants worried, given the possibility of the constant information being used in a wrong way. There is, in Portugal, at this moment, a strong anti-immigration movement.
The disclosure of the data without prior authorization of citizens constitutes a violation of the General Data Protection Regulation (GDPR), which, in article 82, specifies: "Any person who has suffered material or material damage due to a violation of this Regulation has the right to be compensated" for the damages suffered. That is, AIMA may have to pay a fine if there is a judicial challenge. Sought by PUBLIC Brazil, the agency did not respond.
Opening of proceedings
According to the president of the Portuguese Bar Association, João Massano, there was an error in the preparation of the email. For him, the fact that AIMA sent a collective message, rather than individual, can characterize "a violation of the personal data protection regime". Massano adds that, in institutional communications, especially with a high number of recipients, this type of message is risky and contradicts the principles of confidentiality provided for in the GDPR.
Because it considers that it was an unauthorized disclosure of personal data, Massano believes in consequences for AIMA, such as notification and a possible opening of proceedings by the National Data Protection Commission (CNPD), with the application of fines. The Portuguese Government has a GDPR Implementation Manual in which it states, on page 5, that the e-mail addresses are data to be protected.
For information technology specialist Gilberto Lima Júnior, president of the Illuminant Institute of Technological Innovation and Social Impact, the dissemination of addresses generates a number of risks for immigrants. “It gives rise to persecution, blackmail and ideological falsehood. The people mentioned in the email may be victims of threats of expulsion from the country or even extortion,” he says.
A strange message
When he received the message from AIMA, the pharmacy technique Pricila Rabelo, 32 years old, thought it was a fraud. “I spoke with a lawyer and she, through the email address, which ended in aima,gov.pt, told me that it was best for me to go to the mission structure as soon as possible to resolve all doubts,” he points out.
Another detail that made Pricila strange the message was the summoning to the mission structure in Porto. “I live in Lisbon. It doesn't make much sense for me to go there. But anyway, I will leave home very early on Tuesday (02/09) and head to Porto to know what is really happening,” she says, hoping to have her residence title in hand.
The Brazilian, who has been in Portugal since 2021, has been trying for years to get legalization in the country. “My case was rejected for not having a rental contract. I live with my partner, who owns the house where we live. We made a lending contract and sent it to AIMA nine months ago, but so far I had no answer, neither a positive nor negative.
The pharmacy technique tried to get help through the official AIMA channels. “I have called dozens of times. In one of them, I was answered, but the answer was that they did not give information by phone. They had me send an email. I have sent dozens of them, but I have never had an answer”, she notes, who, in Brazil, was an administrator and moved to Portugal in search of a better life. Regarding his disclosed e-mail address, Pricila filed a complaint with the National Cybersecurity Center.