The vetoed decree was passed by the cabinet on 8 September and sent to the president for his approval on 23 September.

The law implemented an agreement with the United States and transposed community legislation about the automatic Exchange of financial information about non-residents, but the government decided to expand these rules to residents in Portugal, Portuguese or foreign.

In August, the national data protection commission, when it read the draft law, said there was “unnecessary and excessive restriction of fundamental rights to protect personal data and private life, in a clear violation of the Portuguese Constitution".

The Constitution says that “the law can only restrict the rights, freedoms and guarantees in cases expressly foreseen in the Constitution, and restrictions must be limited to the necessary to safeguard the constitutionally protected rights or interests".