No. There are several laws that can be relevant to Software.

However, in Portugal, the main normative source on Software protection is Decree-Law no. 252/94, of 20 October, transposing into national law Directive 91/250/EEC of 14 May (meanwhile repealed by Directive 2000/94/EC) on the legal protection of computer programs.

For legal transactions involving Software (e.g. licenses and purchase and sale), general rules of contract law and copyright law may apply. In fact, for this purpose, the rules of contracts provided for in the Portuguese Civil Code (Decree-Law no. 47344/66, of 25 November), as well as the rules provided for in the Portuguese Copyright and Related rights Code (Decree-Law no. 63/85, of 14 March), will have to be taken into account.

In Portugal, proprietary rights in Software can be protected under Copyright, in particular under the above mentioned Decree-Law no. 252/94, of 20 October.

Article 1 of such diploma confers protection analogous to that conferred on literary works to all computer programs with a creative character, determining for the purposes of this protection that the preliminary design material of the computer program is equivalent to the computer program.

Thus, under Portuguese law, computer programs and its associated preliminary materials will be protected, provided that they have a creative character.

The protection itself for computer programs (software) under Article 2(1) of the referred diploma, is for their expression in any form. The expression of the computer program is understood to be the source code, which is the expression of the program in the form of a text written in a programming language, and the object code, which is a text written in a ‘machine’ language.

Article 2(2) expressly excludes the protection of the ideas and principles underlying any element of the program or its interoperability such as logic, algorithms or programming language.

Under Portuguese Copyright Law, the protection will be automatic from the moment the work, in this case the Software, is created (externalized). Nevertheless, it is possible to obtain a registration on the Software created, which will constitute a presumption of ownership of Copyright in favor of the registrant.

The general rule under Portuguese Copyright Law for works made on hire is that the copyright holder is presumed to be the intellectual creator or author, unless otherwise stipulated.

However, for computer programs, the rule is reversed. Indeed, according to article 3(3) of Decree-Law no. 252/94, in the case of computer programs that are made for hire, the copyright is presumed to be held by the recipient of the program, unless otherwise stipulated or unless something else results from the purposes of the contract.

Thus, in Portugal, if a software is developed by a software developer, consultant or other party for a customer, it will be the customer who will own the copyright of software or computer program (in the absence of any agreed contractual position).

No. Besides the general rules of civil and criminal liability under Portuguese Civil Law, there are no specific laws that govern he harm / liability caused by Software / computer systems in Portugal.

Yes. In Portugal there is Law no. 82/2021, of 30 November which establishes the procedures for monitoring, controlling, removing and preventing access in the digital environment to content protected by copyright and related rights, as well as the administrative procedure to be adopted in the event of unlawful making available of protected content, including the obligations, in this context, of intermediary network service providers, defined in the diploma on electronic commerce in the internal market.

There is also the Cybercrime Law (Law no. 109/2009, of 15 September), transposing into national law Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information systems and adapting domestic law to the Council of Europe Convention on Cybercrime.

No.

Yes. In Portugal, it is very typical for a software vendor to cap its maximum financial liability to a customer in a software transaction.

Even though a standardized market level of cap does not exist, usually vendors tend to cap their financial liability to the total amount paid for the software transaction or the amount so far paid by the customer over a given period of time (e.g.: 12 months).

1. confidentiality breaches – it depends on what is agreed, in particular if there is a specific NDA agreement, but typically it is included in the financial cap on the software vendor´s liability.
2. data protection breaches – it depends on what is agreed, but typically this is excluded from the financial cap on the software vendor´s liability.
3. data security breaches (including loss of data) – it depends on what is agreed, but typically this is excluded from the financial cap on the software vendor´s liability.
4. IPR infringement claims – this is typically excluded from the financial cap on the software vendor´s liability.
5. breaches of applicable law – it depends on what is agreed, but typically this is excluded from the financial cap on the software vendor´s liability.
6. regulatory fines – it depends on what is agreed, but typically this is excluded from the financial cap on the software vendor´s liability.
7. wilful or deliberate breaches – in case general contractual clauses are at stake, under Portuguese Law on general contractual clauses (Decree-Law no. 446/85, of 25 October), clauses excluding or limiting liability for default, delay or defective performance in the event of intent or serious misconduct are absolutely prohibited. This means that wilful or deliberate breaches should always be excluded from the financial cap on the software vendor´s liability.

Although there are mechanisms for software source codes to be held in escrow, this not a very common practice in Portugal.

Nevertheless, the typical escrow provider in Portugal is ASSOFT (Portuguese Software Association).

Yes, there are.

In Portugal, the export controls on software transactions are made under the “dual-use and technologies” regime provided for in Regulation (EC) 2021/821 and Decree-Law no. 130/2015. According to these diplomas, dual-use goods and technologies are any goods, including software and technology, which can be used for both civil and military purposes, including all goods which can be used for non-explosive purposes or in any way assist in the manufacture of nuclear weapons or nuclear explosive devices.

Operators involved in export transactions of such goods should apply for their Export Licenses, and pay particular attention to any unusual procedures (in international trade transactions) by their customers, as well as to the final destination and end-use of the goods and technologies to be exported.

There are no specific regulations under Portuguese law which govern IT outsourcing transactions in particular.

The outsourcing of services by a company is a reasonable ground for collective dismissal or extinction of the employment position. Specifically, it is part of the concept of structural ground set out in paragraph 2(b) of Article 359 of the Labour Code, i.e. for reasons of “economic and financial unbalance, change of activity, restructuring of the production organization or replacement of dominant products“, as long as it is duly justified and complies with the legally stipulated procedure.

However, with the most recent amendments to the Labor Code, in force since May 2023, Article 338-A has forbidden the outsourcing of services, stating that “it is not allowed to resort to the acquisition of external services from a third party to meet the needs that were ensured by an employee whose contract was terminated in the previous 12 months by collective dismissal or dismissal for termination of employment“, which turns out to be contradictory regarding the existing rules on the grounds for collective dismissal and termination of employment.

In addition, the breach of this provision constitutes a very serious administrative offense imputable to the beneficiary of the acquisition of services, which may lead to a penalty the amount of which varies according to the turnover of the company and degree of guilty.

Since then, the incorporation of this provision in the Labor Code has been subject of discussion, namely regarding its constitutionality, opposing, of course, two principles that collide in this matter: the right to private property and freedom of enterprise against the principle of human dignity and job security, both constitutionally provided.

The main law governing electronic communications is Law no. 16/2022 of 16 August (“Electronic Communications Law”), which resulted from the transposition of Directives 98/84/EC, 2002/77/EC and (EU) 2018/1972 (“European Electronic Communications Code”). This law establishes the legal regime applicable to electronic communications networks and services, associated facilities and services, the management of radio spectrum and numbering resources, as well as certain aspects of terminal equipment, and defines the competences of the national regulatory authority (NRA) and other competent authorities in these areas.

In addition to the Electronic Communications Law, certain matters are regulated by lex specialis, such as, among others, the following:

• Law no. 41/2004, of 18 August, concerning the processing of personal data and the protection of privacy in electronic communications (hereinafter “E-Privacy Law”).
• Decree-Law no. 151-A/2000, of 20 July, which establishes the regime applicable to the licensing of radiocommunications networks and stations and the supervision of the installation of such stations and the use of the radio spectrum, as well as the definition of the principles applicable to radio fees, the protection of exposure to electromagnetic radiation and the sharing of radiocommunications infrastructures.
• Law No. 99/2009, of 04 September, which establishes the regime applicable to administrative offences in the communications sector. This law defines the responsibilities, the factors for determining the applicable sanction, as well as the amounts of the fines depending on the offence in question.
• ANACOM, as the national regulatory authority, issues and approves certain Regulations that should also be considered.

The main SSO in the world is the International Organization for Standardization (ISO), which sets international standards for the telecommunications sector in general, but also for newer connected technologies, such as digital health or autonomous vehicles.

A few examples of relevant standards from this organization for these purposes are class 33 of ISO, which has standards for telecommunication systems, mobile services, integrated services digital network (ISDN), Electromagnetic compatibility (EMC), just to name a few. More information about this can be found here.

Additionally, ISO also holds certifications regarding digital health (ISO/TR 11147:2023), as well as connected and autonomous vehicles (ISO 22737:2021).

For mobile communications, there is also another relevant SSO, which is the European Telecommunications Standards Institute – ETSI (more information can be found here). This SSO has specific standards for Internet of Things (IoT), 5G, eHealth and Smart Grids and Meters.

Finally, another relevant SSO for this purpose is International Telecommunication Union Telecommunication Standardization Sector (ITU-T). This organization has specific standards regarding several telecommunication issues.

Technical standards for this purpose have tremendous impact on the development of connected technologies, since they are seen by end-clients (both companies and consumers) as a quality stamp for this sector.

As a matter of fact, these standards are usually complex to comply with, which means that certification with one of the standards of these 3 SSOs has tremendous market value.

Additionally, meeting these standards can ultimately increase interoperability between devices, which directly impacts the development of connected technologies.

To the extent of our knowledge about this matter, no.

The entity responsible for monitoring the application of the data protection rules and principles in Portugal is Comissão Nacional de Proteção de Dados (“CNPD”)¹, which is the Portuguese Data Protection Supervisory Authority. The organisation and functioning of CNPD is governed by Law 43/2004, of 18 August, and also by the rules laid down in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”). According to the latter the CNPD is entitled to:

• order the Controller and the Processor, and, where applicable, the controller’s or the processor’s representative to provide any information it requires for the performance of its tasks;
• carry out investigations in the form of data protection audits;
• obtain, from the Controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;
• obtain access to any premises of the Controller and the Processor, including to any data processing equipment and means.

Footnote(s):

¹ https://www.cnpd.pt/

The legal framework for personal data protection in Portugal is that resulting from the direct application of the GDPR. In turn, one shall consider Law no. 58/2019, of August 8, which ensures the implementation in Portugal of the GDPR (hereinafter “Portuguese Data Protection Law”).

Apart from the GDPR and the Portuguese Data Protection Law, which set the general framework applicable to the processing of personal data, certain situations are governed by lex specialis, among which we would like to point out:

• Law no. 41/2004, August 18, concerning the processing of personal data and the protection of privacy in electronic communications (hereinafter “E-Privacy Law”). This law covers the processing of personal data for e-marketing purposes, as well as the use of cookies and similar technologies.
• Law no. 7/2009, February 12 (hereinafter “Portuguese Labor Code���), which provides for special rules for the processing of personal within a labor relationship.
• Law no. 59/2019, of 8 August, which transposes into the Portuguese law the Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016). In general this law sets forth the rules on the processing of personal data by competent authorities for the purpose of prevention, detection, investigation or prosecution of criminal offenses or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.

Apart from the above, Controllers/Processors shall also take into consideration cybersecurity laws. In particular, the following shall be observed:

• Law no. 46/2018, of 13 August, which transposes to the Portuguese legal framework Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016, thus establishing the legal framework for cyberspace security applicable to public administration entities, critical infrastructure operators, operators of essential services, digital service providers and other entities using networks and information systems.
• Decree-Law no. 65/2021, of 30 July that regulates the law mentioned in the previous point.

As per article 83 of the GDPR and the Portuguese Data Protection Law, the maximum fine ranges from EUR 10m to EUR 20m or, in the case of an undertaking, 2% to 4% of the total worldwide annual turnover of the preceding financial year, respectively, whichever is higher.

The amount of an administrative fine will vary depending on the circumstances of each individual case and shall be effective, proportionate and dissuasive.

The European Data Protection Board has issued Guidance on the calculation of fines in its Guidelines 04/2022 of 12 May 2022.

Apart from some situations where Data Processing Agreements may refer to other data protection regimes, it is not common to include references to external data protection regimes in technology contracts.

The body responsible for supervising the rules on artificial intelligence has not yet been designated in Portugal.

Once the EU Regulation laying down rules on Artificial Intelligence (“Artificial Intelligence Act”) enters into force, after its publication in the European Union Official Journal, member states will have to designate a competent supervisory authority to oversee the implementation of the Artificial Intelligence Act.

There is currently no local legislation applicable to the deployment and use of artificial intelligence.

Law no. 27/2021, of 17 May, which establishes the Portuguese Charter of Human Rights in the Digital Age, refers to the use of artificial intelligence and robots (Article 9), providing that their use must be guided by respect for fundamental rights, ensuring a fair balance between the principles of explainability, security, transparency and accountability, taking into account the circumstances of each specific case and establishing processes aimed at avoiding any prejudice and forms of discrimination. It is further provided that decisions with a significant impact on the sphere of recipients that are taken through the use of algorithms must be communicated to stakeholders, be subject to appeal and be auditable.

The deployment and use of artificial intelligence will be governed by the European Union’s Artificial Intelligence Act, which is expected to be published very soon in the European Union Official Journal.

Currently, no. The European Union’s Artificial Intelligence Act will provide for specific rules governing foundation models, including large language models and generative AI systems.

So far, it has not been very common, in Portugal, for contracts to contain provisions dealing with AI risk. However, taking into consideration the new rules on Artificial Intelligence provided in the AI Act, which is about to enter into force following its publication in the European Union Journal, it will certainly be an issue, where applicable, to be addressed in technology contracts.

With the emergence of generative AI tools such as ChatGPT, DALL-E and others, there has been a growing concern about the risks inherent in the results generated by this type of tool in terms of copyright, as well as the respective attribution of copyright ownership.

However, in Portugal, it is still not very common for technology contracts in general to contain provisions regarding the application or treatment of copyright or other intellectual property rights, or the ownership of outputs in the context of the use of AI systems.

Portugal has implemented the EU Regulation 2022/858 of the European Parliament and of the Council, dated May 30th, 2022 through the Decree-Law 66/2023, published on 8 august and that entered into force on the day following its publication. Under the new regime, the Portuguese Securities Market Commission (“CMVM”) has been designated as the competent national authority for supervising matters related to the Blockchain (distributed ledger technology – DLT).

Moreover, the Bank of Portugal is the Portuguese competent authority responsible for registering entities intending to act as virtual assets service providers and verifying compliance with the legal and regulatory provisions governing the prevention of money laundering and terrorist financing (“AML/CFT”).

Decree-Law No. 67/2021, of 30 July, sets the framework for the creation of “Technological Free Zones (“ZLT”). ZLTs are physical environments for testing, geographically located, in a real or near-real environment, designed for their promoters to test innovative technology, products, services and processes in a safe manner, with the support and monitoring of the respective competent authorities. This decree-law does not create the ZLTs right away, but determines the conditions for their creation with the aim of setting up several ZLTs in Portugal, each of which is specially geared towards certain technologies or sectors and thus contributes to boosting Portugal’s regions by leveraging their specific characteristics.

Furthermore, the European Securities and Markets Authority (referred to as “ESMA”) will assume a pivotal role in ensuring regulatory harmonization and will acquire comprehensive insights into noteworthy cryptocurrency providers in accordance with the implemented MiCA regulation. Lastly, the European Banking Authority (abbreviated as “EBA”) will oversee issuers of noteworthy asset-referenced tokens and substantial stablecoins.

Search engines and marketplaces, in Portugal, are currently regulated by Regulation (EU) 2022/2065 of the European Parliament and of the Council, of 19 October 2022 (“Digital Services Act” or “DSM”), which have become fully enforceable and applicable on 17 February 2024. This Regulation introduces new obligations for online platforms to reduce harm and tackle online risks, introduces solid protection of online users’ rights and establishes a new single transparency and accountability framework for digital platforms.

Search engines are further regulated by Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 (“Digital Markets Act” or “DMA”) which is fully applicable since 2 May 2023. The Digital Markets Act does not apply to all digital platforms, but only to those qualified as “core platform services” (“CPS”), which includes services such as search engines, web browsers, virtual assistants, video sharing platforms, among others. The scope of the Digital Markets Act is further limited to platforms designated as “gatekeepers”. The gatekeeper must (a) have a size that impacts the EU internal market; (b) provide a core platform service which is an important gateway for business users to reach end users; and (c) enjoy an entrenched and durable position in the market. The Digital Markets Act thus establishes a system of prohibitions and multiple positive obligations for gatekeepers.

Some local legislation is also applicable to marketplaces, such as:

• Decree-Law no. 84/2021, of 18 October, which regulates consumer rights in the purchase and sale of goods, digital content and services. This Decree-Law provides that the online marketplace provider who, acting for purposes related to his activity, is a contractual partner of the trader who makes the good, digital content or service available is jointly and severally liable to the consumer for the lack of conformity of those under the law (Article 44). This diploma also provides for a special information duty for the online marketplace provider who is not a contractual partner of the trader providing the good, digital content or service, being required to make certain information available to consumers.
• Decree-Law no. 24/2014, of 14 February 2014, on consumer rights in distance and off-premises contracts. This diploma provides for specific additional information requirements for contracts concluded on online marketplaces applicable to online marketplace providers (Article 4a), as well as specific rules applicable to situations where the online marketplace provider offers access to consumer reviews (Article 4b).

In Portugal the main law governing social media is Decree-Law 7/2004, of 7 January (which transposed to the Portuguese legal framework the e-Commerce Directive).

With the entry into force of the DSA, although Decree-Law 7/2004, of 7 January has not been expressly repealed, as far as the Safe Harbor regime is concerned, the DSA applies in full. According to the latter, in order to be exempted from liability and thus benefit from the Safe-Harbor regime, intermediary services providers, in particular hosting service providers shall: (i) not have actual knowledge of illegal activity or illegal content and, as regards claims for damages, is not aware of facts or circumstances from which the illegal activity or illegal content is apparent; or (ii) upon obtain actual knowledge or awareness of illegal activities or content, act fast to remove or disable access to the content (Article 6 of the DSA).

In the event of removal of content or disabling access to content on the grounds of illegal activity or because they do not follow the terms and conditions of the service, the DSA set forth an obligation to providers of hosting services to provide a clear and specific statement of reasons to the affected recipient or user on the ground that the information uploaded by it is illegal or incompatible with the terms and conditions. The same applies when suspension or termination of the recipient of the service´s account is applied (Recital 54 and Article 17 of the DSA).

In addition, with regard to content moderation obligations we must also consider other general provisions, such as the Portuguese Criminal Code, Industrial Property Code, Portuguese Advertising Code.

In respect of copyright-infringing content, Article 175-C (1)(a), (b) and (c) of the Portuguese Copyright and Related rights Code (Decree-Law no. 63/85, of 14 March), which transposes Article 17(4) (a), (b) and (c) of Directive (EU) 2019/790 (“‘DSM’ Directive”), stipulates certain obligations (best efforts, content blocking and stay down) for powerful platforms that host and make available to the public large quantities of copyrighted materials, in order to avoid a direct liability for copyright-infringing user-uploaded content. This means that the “Safe-Harbor” privilege conferred by e-Commerce Directive, no longer applies in copyright matters.

Lastly, on shall also consider the provision of the Digital Markets Act (DMA) which also applies to (large) social networking sites and imposes several obligations on them (please refer to question no. 27).

• The Digital Services Act, which is now fully in force, will be enforced throughout Europe through a partnership between local supervisory authorities and the European Commission. It will be interesting to watch how supervisory authorities intend to enforce the DSA with VLOP’s from the respective Member-State and how exactly the Commission will exercise its powers under this Regulation.

It seems that administrative power can be dispersed or divided between the two entities in each case, which can fragment the positive impact expected from the Regulation.

• The final text of the AI act has been published and has been officially adopted by the Council in May of 2024. It is expected to be applicable from 2026, onwards.
• The eminent transposition of the NIS2 Directive to the Portuguese jurisdiction, which will impact cybersecurity issues.

Not commonly, but it is starting to become a tendency in the Portuguese jurisdiction, also due to ESG legislation from the European Union, such as the ESG Directive (Directive (EU) 2022/2464, of 14 December 2022) and EU Delegated Regulation 2023/2772, of 31 July, 2023.

In any case, we expect the increasing concerns with sustainability issues, as well as the EU’s legislative plan for this sector will impact the inclusion of said clauses in technology contracts, eventually until such clauses become standard in these sorts of contracts.