§1 Processing of personal data as provided in Item III shall be governed by specific legislation, which shall provide proportional and strictly necessary measures for fulfilling the public interest, subject to due legal process, the general principles of protection and the rights of the data subjects as provided in this Law.

§2 Processing of the data referred to in Item III of the lead sentence of this article is forbidden for legal entity of private law, except in procedures under the authority of legal entity of public law, of which the national authority shall be specifically informed and which shall observe the limitation imposed in §4 of this article.

§3 The national authority shall issue technical opinions or recommendations regarding the exceptions provided in Item III of the lead sentence of this article, and shall request of the responsible parties impact reports on protection of personal data.

Activities of processing of personal data shall be done in good faith and be subject to the following principles:

Processing of personal data shall only be carried out under the following circumstances:

§1 When the provisions of Items II and III of the lead sentence of this article are applicable, and except in the situations provided in Art. 4 of this Law, the data subject shall be informed of the situations in which processing of her/his data will be allowed.

§3 The processing of publicly accessible personal data shall consider the purpose, the good faith and the public interest that justify its being made available.

§5 The controller who has obtained the consent referred to in Item I of the lead sentence of this article that needs to communicate or share personal data with other controllers shall obtain specific consent from the data subject for this purpose, except when the need for such consent is waived as provided in this Law.

The consent provided in Item I of Art. 7 of this Law shall be given in writing or by another means that demonstrates the manifestation of the will of the data subject.

§4 Consent shall refer to particular purposes, and generic authorisations for processing personal data shall be void.

§6 If there is a change in the information as referred to in Items I, II, III or V of Art. 9 of this Law, the controller shall inform the data subject, with specific highlight of the content of the changes, in which case the data subject, in those cases where her/his consent is required, may revoke it if she/he disagrees with the change.

§1 In situations where consent is required, it shall be considered void if the information provided to the data subject contains misleading or abusive content or was not previously presented in a transparent, clear and unambiguous way.

§2 In the situation when consent is required, if there are changes in the purpose of the processing of personal data that are not compatible with the original consent, the controller shall previously inform the data subject of the changes of purpose, and the data subject may revoke her/his consent if she/he disagrees with the changes.

§3 When the processing of personal data is a condition for the provision of a product or service or for the exercise of a right, the data subject shall be informed with special highlight of this fact and of the means by which she/he may exercise her/his data subject’s rights as listed in Art. 18 of this Law.

§2 The controller shall adopt measures to ensure transparency of data processing based on her/his legitimate interests.

The processing of sensitive personal data shall only occur in the following situations:

§2 When the provisions of lines a and b of Item II of the lead sentence of this article are applied by public agencies and entities, said waiver of consent shall be publicised, pursuant to Item I of the lead sentence of Art. 23 of this Law.

anonymised data shall not be considered personal data, for purposes of this Law, except when the process of anonymisation to which the data were submitted has been reversed, using exclusively its own means, or when it can be reversed applying reasonable efforts.

§1 The determination of what is reasonable shall take objective factors into account, such as cost and time necessary to reverse the process of anonymisation, depending on the available technology, and the exclusive use of its own means.

When carrying out public health studies, research entities may have access to personal databases, which shall be processed exclusively within the entity and strictly for the purpose of carrying out studies and research and shall be kept in a controlled and secure environment, in accordance with security practices provided in specific regulation and that include, whenever possible, anonymisation or pseudonymization of the data, as well as taking into account the proper ethical standards related to studies and research.

§1 Disclosure of the results or of any portion of the study or the research, as mentioned in the lead sentence of this article, shall under no circumstances reveal personal data.

§2 The research entity shall be liable for the security of the information provided in the lead sentence of this article, and it is forbidden, under no circumstances, to transfer the data to a third party.

§3 Access to data as provided in this article shall be the object of regulation by the national authority and of the authorities in the area of health and sanitation, within the scope of their competences.

The processing of personal data belonging to children and adolescents shall be done in their best interest, pursuant to this article and pertinent legislation.

§1 The processing of children’s personal data shall be done with specific and highlighted consent given by at least one of the parents or the legal representative.

§2 When processing data as mentioned in §1 of this article, controllers shall make public the information about the types of data collected, the way it is used and the procedures for exercising the rights referred to in Art. 18 of this Law.

§3 Children’s personal data may be collected without the consent mentioned in §1 of this article when collection is necessary to contact the parents or the legal representative, used one single time and not stored, or for their protection, and under no circumstances shall the data be passed on to third parties without consent as provided in §1 of this article.

§4 Controllers shall not condition the participation of data subjects, as referred to in §1 of this article, to games, internet applications or other activities for providing personal information beyond what is strictly necessary for the activity.

§5 The controller shall use all reasonable efforts to verify that the consent referred to in §1 of this article was given by the child’s representative, considering available technologies.

§6 Information on the processing of data referred to in this article shall be provided in a simple, clear and accessible manner, taking into account the physical-motor, perceptive, sensorial, intellectual and mental characteristics of the user, using audiovisual resources when appropriate, in order to provide the necessary information to the parents or the legal representative and that is appropriate for the children’s understanding.

The processing of personal data shall be terminated under the following circumstances:

Personal data shall be deleted following the termination of their processing, within the scope and technical limits of the activities, being their storage authorised for the following purposes:

§3 The rights provided in this article shall be exercised by means of express request by the data subject or her/his legally constituted representative to the processing agent.

§4 If it is impossible to immediately adopt the measure mentioned in §3 of this article, the controller shall send a reply to the data subject in which she/he may:

§5 The request as mentioned in §3 of this article shall be fulfilled without costs to the data subject, within the time periods and under the terms as provided in regulation.

§6 The responsible shall immediately inform the processing agents with which she/he has carried out the shared use of data of the correction, deletion, anonymisation or blocking of data, so that they can repeat an identical procedure.

Confirmation of the existence of or access to personal data shall be provided by means of request by the data subject:

§1 Personal data shall be stored in a format that facilitates the exercise of the right to access.

§1 Whenever requested to do so, the controller shall provide clear and adequate information regarding the criteria and procedures used for an automated decision, subject to commercial and industrial secrecy.

Processing of personal data by legal entities of public law referred to in sole paragraph of Art. 1 of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”), shall be done in fulfillment of its public purpose, in benefit of the public interest, for the purpose of performing legal competences or discharging legal attributions of the public service, provided that:

§3 The time periods and procedures for exercising data subjects’ rights before the public authorities shall obey the provisions of specific legislation, especially the provisions of Law No. 9,507, of November 12, 1997 (the “Brazilian Habeas Data Law”), of Law No. 9,784, of January 29, 1999 (the “Federal Administrative Procedure Law”), and of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”).

§4 Notarial and registry services, carried out under private nature by delegation of public authorities, shall receive the same treatment given to legal entities as provided in the lead sentence of this article, in accordance with the terms of this Law.

§5o Notarial and registry bodies shall provide access to data by electronic means to the public administration, in view of the purposes mentioned in the lead sentence of this article.

Public companies and mixed-capital companies that operate in the competing market, subject to the provisions of Art. 173 of the Federal Constitution, shall receive the same treatment given to private legal entities of private law, under the terms of this Law. Sole paragraph. Public and mixed-capital companies, when they are carrying out public policies and within the scope of their execution, shall receive the same treatment given to the bodies and entities of the public authorities, under the terms of this Chapter.

Data shall be kept in an interoperable format and structured for shared use intended for the execution of public policies, provision of public services, decentralization of public activity, dissemination and access to information by the general public.

The shared use of personal data by public authorities shall fulfill the specific purposes of execution of public policies and legal attributions by agencies and public entities, subject to the principles of personal data protection listed in Art. 6 of this Law. §1 It is forbidden for public authorities to transfer to private entities personal data contained in databases to which they have access, except: I – in cases of decentralized execution of public activity that requires transfer, exclusively for this specific and distinct purpose, subject to the provisions of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”); II – (vetoed); and II – in cases in which the data are publicly accessible, subject to the provisions of this Law. §2 Contracts and agreements as mentioned in §1 of this article shall be communicated to the national authority.

Communication or shared use of personal data from a legal entity of public law to a legal entity of private law shall be communicated to the national authority and shall rely on the consent of the data subject, except: I – in situations in which consent is waived as provided in this Law; II – when there is shared use of data, which will be publicized pursuant to Item I of the lead sentence of Art. 23 of this Law; or III – in the exceptions contained in §1 of Art. 26 of this Law.

VII – when the transfer is necessary for the execution of a public policy or legal attribution of public service, which shall be publicised pursuant to Item I of the lead sentence of Art. 23 of this Law;

The level of data protection in the foreign country or international organisation referred to in Item I of the lead sentence of Art. 33 of this Law shall be evaluated by the national authority, which shall take into consideration:

§3 The national authority may designate certification entities to carry out the provisions of the lead sentence of this article, which shall remain under their inspection subject to the terms defined in regulation.

§5 Guarantees sufficient for compliance with the general principles of protection and data subject’s rights referred to in the lead sentence of this article shall also be analysed in accordance with the technical and organisational measures adopted by the processor, according to the provisions of §§1 and 2 of Art. 46 of this Law.

Changes to guarantees presented as sufficient for compliance with the general principles of protection and of the data subject’s rights referred to in Item II of Art. 33 of this Law shall be communicated to the national authority.

The controller and the processor shall keep records of personal data processing operations carried out by them, especially when based on legitimate interest.

The processor shall carry out the processing according to the instructions provided by the controller, which shall verify the obedience of the own instructions and of the rules governing the subject.

The controller shall appoint an officer to be in charge of processing personal data. §1 The identity and contact information of the officer shall be publicly disclosed, in a clear and objective manner, preferably on the controller’s website. §2 Officer’s activities consist of: I – accepting complaints and communications from data subjects, providing explanations and adopting measures; II – receiving communications from the national authority and adopting measures; III – orienting entity’s employees and contractors regarding practices to be taken in relation to personal data protection; and IV – carrying out other duties as determined by the controller or set forth in complementary rules. §3 The national authority may establish complementary rules about the definition and the duties of the officer, including situations in which the appointment of such person may be waived, according to the nature and the size of the entity or the volume of data processing operations.

II – controllers who are directly involved in the processing from which damages resulted to the data subject shall jointly answer, except in cases of exclusion as provided in Art. 43 of this Law.

Processing agents shall only not be held liable when they prove that:

Processing of personal data shall be irregular when it does not obey the legislation or when it does not provide the security that its data subject can expect of it, considering the relevant circumstances, among which are:

III – the techniques for processing personal data available at the time it was done. Sole paragraph. The controller or the processor who neglect to adopt the security measures provided in Art. 46 of this Law shall be held liable for the damages caused by the violation of the security of the data that caused the damage.

When there is violation of data subject’s right in the scope of consumer relations, the rules of liability provided in the pertinent legislation shall apply.

Processing agents shall adopt security, technical and administrative measures able to protect personal data from unauthorised accesses and accidental or unlawful situations of destruction, loss, alteration, communication or any type of improper or unlawful processing.

§2 The measures mentioned in the lead sentence of this article shall be complied with as from the conception phase of the product or service through to its execution.

§1 The communication shall be done in a reasonable time period, as defined by the national authority, and shall contain, as a minimum:

§2 The national authority shall verify the seriousness of the incident and may, if necessary to safeguard the data subjects’ rights, order the controller to adopt measures, such as:

The systems used for processing personal data shall be structured in order to meet the security requirements, standards of good practice and governance, general principles provided in this Law and other regulatory rules.

§1 When establishing rules of good practice, the controller and the processor shall take into consideration, regarding the processing and the data, the nature, scope, purpose and probability and seriousness of the risks and the benefits that will result from the processing of data subject’s data.

§3 Rules of good practice and governance shall be published and updated periodically and may be recognised and disclosed by the national authority.

The national authority shall encourage the adoption of technical standards that facilitate data subjects’ control of their personal data.

§1 The sanctions shall be applied following an administrative procedure that will provide opportunity for a full defence, in a gradual, single or cumulative manner, in accordance with the peculiarities of the particular case and taking into consideration the following parameters and criteria:

The national authority shall define the methodologies that will be used for the calculation of the base value for fines, by means of its own regulations concerning administrative sanctions for violations of this Law, which must be the object of a public consultation.

§1 The methodologies referred to in the lead sentence of this article shall be previously published, for the information of the processing agents, and shall objectively present the forms and methods for calculating the base value of the fines, which shall contain detailed grounds for all its elements, demonstrating obedience to the criteria provided in this Law.

§2 The regulation of sanctions and corresponding methodologies shall establish the circumstances and conditions for adopting simple or daily fines.

The amount of daily fines applied to infractions of this Law shall be subject to the severity of the infraction and the extent of the damage or losses caused, and with grounded reasoning by the national authority. Sole paragraph. The notice of imposition of a daily fine shall contain, as a minimum information, the description of the obligation being imposed, the reasonable timeframe stipulated by the body for compliance and the amount of the daily fine to be applied for non-compliance.

Law No. 12,965, of April 23, 2014 (the “Brazilian Internet Law”), shall henceforth contain the following alterations: “Art. 7 … X – permanent deletion of personal data that has been provided to an internet application, upon request, at the termination of the relationship between the parties, except in the situations in which storage of records is obligatory, as provided in this Law and in that which governs personal data protection;…”(New Wording) “Art. 16… II – from personal data that are excessive in relation to the purpose for which consent was given by the data subject, except in situations provided in the Law that governs personal data protection.”(New Wording)

The foreign company shall be notified and summonsed of all procedural acts provided in this Law, irrespective of power of attorney or contractual or statutory provisions, in the person of the agent or representative or person responsible for its subsidiary, agency, branch, establishment or office located in Brazil.

The national authority and the Anísio Teixeira National Institute for Educational Studies and Research (Inep), within the scope of their competences, shall enact specific regulations for accessing data processed by the Union for compliance with the provisions of §2 of Art. 9 of Law No. 9,394, of December 20, 1996 (the “Directive and Bases of National Education Act”), and those relating to the National Higher Education Evaluation System (Sinaes), as provided in Law No. 10,861, of April 14, 2004.

The national authority shall establish rules on the progressive suitability of databases established up to the date this Law comes into force, taking into account the complexity of the data processing operations and the nature of the data.

This Law shall come into force eighteen (18) months following its official publication.