PORTUGAL: An Introduction to TMT
1. Main Trends and Legal Challenges of the TMT Sector in Portugal
Portugal has been fruitful in new initiatives in the TMT sector, in line with international trends. For instance, Portugal's privileged geographic location has established the country as a critical landing point for submarine cables, which has allured big tech companies like Meta and Google. The Portuguese government has recently instructed certain authorities to take actions aimed at streamlining the licensing procedures for the installation of submarine cables, which may further increase this industry’s attractiveness.
Furthermore, a procedure for granting individual rights of use for the radio spectrum in the 26 GHz range is expected to be launched soon, which will enable the development of multiple 5G and IoT solutions supported by millimetre-wave bands.
In addition to these trends, the TMT sector faces various legal challenges that can impact operations and profitability of its players. One of the major challenges is the increasing use of emerging technologies – and especially AI - and their regulation, which brings legal and regulatory costs and challenges associated with futureproofing the technology solutions developed. Data and cybersecurity threats have significantly increased, potentially compromising a company's reputation and resulting in high fines and liabilities. Regulators are scrutinising the TMT sector around issues such as compliance, consumer protection, and content moderation. TMT companies must address these legal challenges proactively to protect their interests, maintain their reputation and remain competitive.
2. Electronic Communications Sector
2.1 General legal framework
The legal framework of the sector underwent several changes with the approval of Law 16/2022 (the “Electronic Communications Act”), transposing into national law Directive (EU) 2018/1972. The regulatory framework of the sector is also defined by other Acts, such as Decree-Law 123/2009, which defines the legal regime of construction, access and installation of electronic communications networks and infrastructures.
2.2 Requirements for obtaining a licence/authorisation to provide electronic communications services and networks
Undertakings that wish to provide publicly available electronic communication services and networks in Portugal are required to submit a communication, through a pre-approved form, to ANACOM (the Portuguese regulatory authority for the communications sector) before commencing their activities under the general authorisation regime. Some undertakings, such as operators of number-independent interpersonal communications services, are exempt from this prior communication obligation.
2.3 Framework applicable to operators of interpersonal communications services
The Electronic Communications Act has brought about significant changes to the provision of interpersonal communication services, which were not defined under the previous framework. For instance, operators of number-based interpersonal communications services are now subject to the general authorisation regime, placing them alongside traditional operators in certain matters, such as end-user protection requirements, reflecting their market growth. Number-independent interpersonal communications services have a more light-touch regime.
2.4 Security of electronic communications networks and services
The Electronic Communications Act and ANACOM Regulation no. 303/2019 set forth a series of obligations that electronic communications networks and services providers must comply with regarding the security of electronic communications networks and services. These obligations require undertakings, among others, (i) to implement technical and organisational measures that ensure a security level proportional to the risks posed to the security of networks and services, and (ii) to notify any significant security incidents affecting the operation of networks or services to both ANACOM and the Portuguese Cybersecurity Centre (CNCS) promptly.
2.5 Annual or recurring fees
Under the Electronic Communications Act, undertakings subject to the general authorisation framework are obliged to pay: (i) the annual fee, commonly referred to as the regulatory fee; (ii) radio spectrum and numbering resources fees, if applicable; and (iii) rights of way fee (of up to 0.25% of the total monthly bill issued to end customers within a specific municipality).
2.6 Coverage of “white areas” with very high-capacity networks
In the context of the National Strategy for Connectivity in Very High-Capacity Electronic Communications Networks 2023-2030, a public tender for the installation, operation and maintenance of very high-capacity networks in areas currently without coverage (“white areas”) was recently launched. This tender entails an investment of EUR425 million and aims to enhance network coverage across the white areas. The selected entities are expected to be revealed during 2024.
3. Broadcasting/Media Sector
3.1 General legal framework
Without prejudice the consumer protection panoply, as well as laws related to advertising and unfair commercial practices, the main legal instrument for regulation of the broadcasting sector is TV Law (Law 27/2007). Regarding other media-related activities, Radio Law (Law 54/2010) applies to radio broadcasting, while the press activity is regulated by Law 2/1999.
3.2 Requirements for obtaining a licence/authorisation to provide services
Audiovisual service providers, depending on the nature of the services they provide, are subject to (i) licensing, by means of public tender, or (ii) authorisation, or (iii) registration requirements which they should meet prior to starting to provide services in Portugal. The competent authority for this purpose is ERC (the Portuguese regulatory authority for the media sector).
3.3 Restriction on common ownership/limits on participation
TV Law only restricts the common ownership of free-to-air channels with a nationwide coverage to protect and promote plurality. Specifically, the same natural or legal person cannot hold, directly or indirectly, ≥50% of the total licences available in the market for free-to-air channels with a nationwide coverage for similar services with the same coverage.
4. Data Protection and Cybersecurity
4.1 General overview of the current and prospective legal framework
Portugal has a well-established Data Protection Framework based on GDPR and Law 58/2019 and further supported by EU and national guidelines and case law. In recent years, the Portuguese Data Protection Authority (CNPD) has been particularly active with a focus on international data transfers, marketing communications, and data subjects’ rights. In addition, Law 18/2024, which was published and entered into force in the beginning of February 2024, introduces new obligations and requirements on the access to electronic communications metadata for criminal investigation purposes. Furthermore, several EU regulatory initiatives are expected to impact the Portuguese market directly, such as the Data Governance Act or the recently published (but not yet in force) Data Act.
Moreover, the national Cybersecurity Framework consists of Law 46/2018, introducing security requirements and incident notification obligations to various entities, such as operators of essential services, the Cybersecurity Act (Decree Law 65/2021) and Commission Implementing Regulation (EU) 2018/151. Law 46/2018 will soon be revised to transpose Directive (EU) 2022/2555, a matter to be closely followed by electronic communications operators, as they are within the latter’s scope (while also being subject to sector-specific security and integrity obligations, mentioned above).
5. Digital Services
5.1 General overview of the Digital Services Act
The DSA, together with the DMA, marks a new era of regulation in the EU's digital ecosystem. Applicable to a wide range of intermediary services and governed by the principle of “what is illegal offline should be illegal online”, its main goal is to create a secure, predictable and trustworthy online environment, by imposing, for instance, (i) measures to counter illegal content, goods and services online, and (ii) effective safeguards for content moderation. While the establishment of Portugal’s Digital Services Coordinator is not expected to occur until 17 February 2024, the date from which the DSA will become fully applicable, it is unlikely that the DSA’s implementing act will be adopted before such date. In any case, it should occur sometime during 2024.
6. IT Sector
6.1 Blockchain
The adoption of blockchain and smart contract solutions in Portugal has increased across industries, particularly in data, healthcare and the NFT market. The national legislative framework for Technological Free Zones (Decree-Law 67/2021) has boosted interest among foreign entities. Despite the EU FinTech initiatives (ie, DLT Regulation, 5AMLD, MiCA), there is no uniform regulation for DLT, smart contracts and NFTs in Portugal. Nonetheless, the EU Blockchain Strategy aimed at developing a “gold standard” for blockchain and promoting the use of DLT and smart contracts for data security will have an impact on the Portuguese market.
6.2 Artificial Intelligence
The AI market is rapidly expanding, with numerous start-ups and SMEs offering a broad range of AI-based solutions. Recently, the Responsible AI Consortium, comprising 25 local AI-focused entities, including VdA, has been funded by the Portuguese government under the Recovery and Resilience Mechanism, a component of the European Council's Next Generation EU package. This aligns with the AI Portugal 2030 Strategy, which aims to boost innovation and investment in the AI ecosystem, attract and retain talent, and promote AI adoption across various industries. Despite the lack of specific AI laws in Portugal, any EU-wide regulatory or policy initiative would impact the national AI market. On February 2024, the European Council approved the Proposal of the AI Act, and formal approval of the text is expected in the first quarter of 2024. Once finalised, the AI Act will apply directly in Portugal, and an implementing act will be adopted. Additionally, the Portuguese legislator will have to transpose the Liability for Defective Products Directive and the AI Liability Directive.