Portugal's Data Regulator Opened a Fast Lane This Week for Reporting Images of Children Shared Without Consent

Portugal's data protection regulator quietly put a new form on its website on Tuesday, and announced it two days later. The Comissão Nacional de Proteção de Dados (National Data Protection Commission) calls it the Canal Prioritário, a priority channel, and its whole purpose is to move one category of complaint to the front of the queue: the sharing of children's personal data without consent.

Anything filed through it is treated as urgent, provided it falls into one of three buckets the regulator sets out. Improper access to a minor's data. The collection and publication of image or sound with sensitive or violent content, without consent. And advertising directed at minors.

Who can file, and what the regulator can do next

The channel is open to children and young people themselves, and to any citizen who comes across the illicit sharing of that kind of content. Most routes into a regulator assume the complainant is the data subject, or a parent acting for one; this one assumes a bystander may be the first to see the material.

The powers behind the form are the part worth reading. The CNPD says it can adopt urgent measures to limit the illicit circulation on the internet of content that places individual rights and freedoms at grave risk, which in practice means ordering the immediate deletion of material as a precautionary step. It can pass the file to public authorities with competence in the matter, judicial authorities included. And where the processing is cross-border, it can send the information to data protection authorities elsewhere in the European Economic Area through the internal market information system, IMI.

Where it came from

The CNPD is an independent administrative body that operates alongside the Assembleia da República (Assembly of the Republic) under Lei n.º 43/2004 of 18 August. Its seven members are elected by parliament and sworn in before its president, so a change of approach there is the regulator's own planning rather than a government instruction.

The channel is not a response to a single incident. The CNPD traces it to Strategic Action number 3 of its multiannual activity plan for the 2024 to 2026 period, and to its annual plan for 2026, which is to say it has been scheduled for two years. Its president, Paula Meira Lourenço, described it as "one more proactive step" to strengthen the protection of children's and young people's personal data in the digital environment, and said the theme carries into the commission's strategic plan for 2027 to 2029 and its national data protection training plan.

The form runs across several pages, opens with an image-based verification step, and warns that you should move through it using only the Previous and Next buttons rather than the browser's own controls. The legal basis cited at the foot of the page is Lei n.º 58/2019 of 8 August, which implements the General Data Protection Regulation in Portuguese law.

What it does not replace

This is an administrative route to a regulator, not a criminal complaint. Where the material crosses into crime, the CNPD's own description is that it coordinates with the Ministério Público (Public Prosecution Service) and criminal police bodies rather than substituting for them, so a report here does not remove the reason to go to the PSP or GNR as well.

For families, the practical value is speed on a narrow set of cases, and a second door that a teenager can open without an adult. It arrives in a year when Portuguese regulators have been circling children's online exposure from several directions at once, from survey evidence that 52 percent of Portuguese children met online hate speech last year to a stalled attempt to keep under-16s off social media altogether. Our guide to exercising data rights in Portugal covers the regulator's ordinary complaint forms and the one-month reply deadline that governs them.