1. Legal Framework

The Portuguese Health Regulatory Authority (ERS) Data Protection and Privacy Policy is fully aligned with the provisions set forth in the Constitution of the Portuguese Republic (CRP), the General Data Protection Regulation (GDPR)[1], the Data Protection Law (LPD), and other applicable legislation concerning the protection of personal data.

The protection of privacy and personal data constitutes a fundamental commitment of ERS towards all individuals with whom it interacts, including service users, healthcare providers and establishments, as well as its own staff members.

Recognising privacy as a fundamental value of natural persons, ERS bears responsibility for ensuring its protection, within the scope of its activities and in the pursuit of its mission, the fulfilment of its tasks and the exercise of its competences.

To this end, ERS has adopted this Privacy Policy, which sets out the personal data it processes, the purposes of such processing, and any possible transfers thereof.

ERS is an independent regulatory authority of a public nature. Accordingly, the processing of personal data in general, and of special categories of personal data—such as health data—carried out by the ERS is based, respectively, on the necessity for the performance of a task carried out in the public interest (Article 6(1)(e), first subparagraph, of the GDPR), and on grounds of substantial public interest (Article 9(2)(g) of the GDPR).

Additional legal bases for the processing of personal data may also apply, including the data subject’s consent, given in accordance with the GDPR, in respect of personal data or special categories of personal data.

2. Purposes

The processing of personal data by ERS takes place for the overarching purpose of fulfilling the tasks and functions assigned to it under its statutory mandate.

The purposes of the processing operations carried out by ERS, which must be specific, explicit and legitimate, are as follows:

• Handling of administrative, sanctioning and dispute resolution proceedings;
• Reorganisation of the ERS Archive and design of a new Document Management System;
• Responding to requests for information;
• Identification of the parties to proceedings;
• Communication with the participants involved in proceedings;
• Identification of contact persons within the scope of regulatory interventions in healthcare providers;
• Verification of compliance with operational requirements by healthcare providers;
• Mandatory communications and reporting;
• Preparation of studies and opinions;
• Assessment of healthcare providers within the framework of the National Health Assessment System (SINAS);
• Monitoring of quality processes and procedures;
• Conducting satisfaction surveys;
• Distribution of newsletters;
• Organisation and management of events within ERS's remit;
• Issuance of certificates of participation;
• Protection of persons and property;
• Preparation, follow-up and management of contracts;
• Accounting management;
• Attendance and punctuality control;
• Organisation and management of individual staff files;
• Recruitment and selection.

3. Data sharing

In accordance with the provisions of the GDPR and the LPD, ERS may transmit personal data to external entities, generally of public nature, including sovereign bodies, central and local government authorities and services, independent administrative entities, regional and municipal administrations, professional public associations, and other organisational structures of various natures and scope.

4. Subcontractors

Personal data may be processed by ERS subcontractors, who are likewise subject to the rules established under the GDPR and the LPD.

5. Data subject rights

5.1. Enumeration and Description of Rights

Data subjects are granted a set of rights, enshrined in the GDPR, among which the following are particularly noteworthy:

Notwithstanding the data subject’s entitlement to the rights set out above, such rights are not absolute and may be subject to limitations, as provided for in Article 23 of the GDPR.

5.2. Form for exercising certain data subject rights

To facilitate the exercise of certain rights afforded to the data subject, we provide a form to be submitted to ERS via one of the channels listed below, preferably by e-mail. ERS will process received requests with the highest level of security to ensure the fulfillment of the data subject’s rights.

Submission of a request requires verification of the requester’s identity. ERS is responsible for the protection of personal data under its processing activities. The exercise of the aforementioned rights may not be immediate, but will be carried out within the time limits established by the GDPR (one month, which may be extended in cases where the processing of the request entails significant complexity for ERS).

6. Data retention periods

ERS complies with the legally imposed data retention periods, which vary according to the category of the data.

7. Security

ERS has designed and maintains a rigorous information security policy, both organizationally and technically.

This is intended to ensure, among other objectives, the strict security of personal data for which ERS is responsible, preventing any form of unlawful or abusive processing. This requirement also applies to subcontractors who may process personal data on ERS’s behalf.

8. Updates

This Privacy Policy may be subject to updates. It is recommended that it be consulted regularly.

Personal data of data subjects are processed under the responsibility of the Board of Directors of ERS, in accordance with the GDPR. A Data Protection Officer (EPD) has also been appointed.

For any questions regarding personal data at ERS, please contact us through any of the following channels, preferably by email:

Email: protecaodedados@ers.pt

Phone: +351 222 092 350

Postal Address: Rua S. João de Brito, 621 L 32, 4100-455 Porto

_____________________________________________________________________________________
¹ [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data. Law No. 58/2019 of 8 August 2019, which ensures the implementation, within the national legal system, of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.