CNPD Flags Legal Gaps in Portuguese Bill Criminalizing Digital Identity Theft

Key Takeaways

• The Portuguese Data Protection Commission (CNPD) issued an opinion raising significant concerns about Bill 697/XVII/1, which would create a new criminal offense for "digital identity usurpation" under the Cybercrime Law.
• CNPD finds the proposed definition of "digital identity" overly broad and indeterminate, and highlights substantial overlap with existing offenses (computer forgery, computer fraud, illegitimate access), questioning the necessity and proportionality of the new crime.
• Compliance teams monitoring Portuguese cybercrime and data protection legislation should track the bill's evolution, as its current drafting could create overlapping liability frameworks and interpretive uncertainty.

Deep Dive

This CNPD opinion responds to a legislative request from the Assembly of the Republic's Committee on Constitutional Affairs regarding Bill 697/XVII/1, which proposes adding Article 7-A to Portugal's Cybercrime Law (Law No. 109/2009) to criminalize "usurpation of digital identity." While not binding regulation, this guidance is influential in shaping the final legislative text and signals how CNPD will interpret related data protection and criminal law matters going forward—relevant for financial institutions operating in Portugal that manage digital identity, authentication, and fraud-related risk.

The core concern is the Bill's definition of "digital identity," which CNPD finds excessively broad, aggregating disparate concepts (personal data, access credentials, profiles, pages, usernames) into a single undifferentiated category. CNPD stresses that identification elements, authentication mechanisms, and representational identity serve different legal functions and should not be conflated in a criminal provision, given the constitutional requirement for precision (determinability) in criminal law. This has indirect implications for how financial institutions describe and classify "digital identity" elements in their own policies, especially where such terms intersect with KYC, authentication, and fraud-prevention frameworks that may eventually need to align with statutory definitions.

Separately, CNPD highlights substantial overlap between the proposed crime and existing offenses—computer forgery, computer fraud, illegitimate access, privacy intrusion, and unlawful data processing under Law No. 58/2019—citing extensive case law where similar conduct (fake profiles, phishing, fraudulent credential use) is already prosecuted under current statutes. CNPD recommends the legislature identify any genuine "protection gap" before creating a new offense, given the ultima ratio principle of criminal law and risks of inconsistent sanctioning frameworks, duplicative liability, and interpretive uncertainty if the law passes in its current form.

No final enactment date is confirmed; the Bill's own text states it would enter into force 30 days after publication, but this is contingent on legislative revision following CNPD's input. Compliance and legal teams with Portuguese operations should monitor further developments, particularly any amendments narrowing the "digital identity" definition or clarifying the relationship with existing cybercrime and fraud provisions. Institutions should also review internal incident-response and fraud-reporting taxonomies to ensure readiness for potential new reporting obligations if the law is enacted, and flag this bill for periodic tracking given its relevance to identity theft, account takeover, and synthetic identity fraud risk typologies common in financial services.

Source: Portuguese Data Protection Commission (Comissão Nacional de Proteção de Dados)