in general terms,
1 was almost a reproduction of what the Constitution itself provides
for, and did not mention the specific problem of personal data protection. The
Brazilian Civil Rights Framework for the Internet (Federal Law 12.965/2014)
provided for personal data protection as one of its principles in Article 3, item III,
but also did not enter into much detail regarding the subject. The Brazilian Consumer
Code (Federal Law 8.078/1990) provided for specific rules regarding consumers’
data banks in its articles 43 and 44, but did not grant a wide protection to personal
data. The Habeas Data Law (Federal Law 9.507/1997) provided for a writ for access
to information, but dealt more specifically with the procedural rules applicable to
that remedy. Additionally, Brazil signed in 2003 the Declaration of Santa Cruz de la
Sierra, which encourages personal data protection by its signatory countries.
Due to the notorious insufficiency of these legal provisions, the burden to
construct a system of personal data protection in Brazil fell for several years on
legal doctrine.
2 Such efforts led to a Bill of Law that was discussed for a long time,
finally resulting in the Federal Law 13.079/2018, Brazilian Personal Data
Protection Law.
2.2 The Notion of Personal Data
The new Brazilian Personal Data Protection Law recognizes the specific right to
personal data protection. Article 5, item I, of this Law defines personal data as “data
related to a natural person identified or identifiable”. The limitation of the protection to natural person related data confirms the tight connection between data
protection, privacy and human dignity, as advocated by Brazilian legal doctrine.
2.2.1 Sensitive Data
The Brazilian Personal Data Protection Law provides for a special protection of the
so-called sensitive data, i.e. information related to the most intimate aspects of the
human person, defined by law as “personal data concerning racial or ethnic origins,
religious beliefs, political opinions, membership of unions or religious, philosophical, and political organizations, data relating to health or sexual life, and genetic or
biometric data, when related to a natural person” (Article 5, item II). The Law
conditions the processing of this data to a specific and underlined consent by the
holder, linked to specific purposes. Such consent can only be waived in
pre-established circumstances listed by the Law, such as when the data is indispensable to “health protection” or to “studies by research institute” (Article 11).
1 “Article 21. Private life is inviolable, and the judge, at the request of any interested person, will
adopt the measures necessary to cease any act contrary to this rule.”
2 Worth to mention the writings of Doneda (2006) and Schertel Mendes (2014).
46
A. Schreiber
1 was almost a reproduction of what the Constitution itself provides
for, and did not mention the specific problem of personal data protection. The
Brazilian Civil Rights Framework for the Internet (Federal Law 12.965/2014)
provided for personal data protection as one of its principles in Article 3, item III,
but also did not enter into much detail regarding the subject. The Brazilian Consumer
Code (Federal Law 8.078/1990) provided for specific rules regarding consumers’
data banks in its articles 43 and 44, but did not grant a wide protection to personal
data. The Habeas Data Law (Federal Law 9.507/1997) provided for a writ for access
to information, but dealt more specifically with the procedural rules applicable to
that remedy. Additionally, Brazil signed in 2003 the Declaration of Santa Cruz de la
Sierra, which encourages personal data protection by its signatory countries.
Due to the notorious insufficiency of these legal provisions, the burden to
construct a system of personal data protection in Brazil fell for several years on
legal doctrine.
2 Such efforts led to a Bill of Law that was discussed for a long time,
finally resulting in the Federal Law 13.079/2018, Brazilian Personal Data
Protection Law.
2.2 The Notion of Personal Data
The new Brazilian Personal Data Protection Law recognizes the specific right to
personal data protection. Article 5, item I, of this Law defines personal data as “data
related to a natural person identified or identifiable”. The limitation of the protection to natural person related data confirms the tight connection between data
protection, privacy and human dignity, as advocated by Brazilian legal doctrine.
2.2.1 Sensitive Data
The Brazilian Personal Data Protection Law provides for a special protection of the
so-called sensitive data, i.e. information related to the most intimate aspects of the
human person, defined by law as “personal data concerning racial or ethnic origins,
religious beliefs, political opinions, membership of unions or religious, philosophical, and political organizations, data relating to health or sexual life, and genetic or
biometric data, when related to a natural person” (Article 5, item II). The Law
conditions the processing of this data to a specific and underlined consent by the
holder, linked to specific purposes. Such consent can only be waived in
pre-established circumstances listed by the Law, such as when the data is indispensable to “health protection” or to “studies by research institute” (Article 11).
1 “Article 21. Private life is inviolable, and the judge, at the request of any interested person, will
adopt the measures necessary to cease any act contrary to this rule.”
2 Worth to mention the writings of Doneda (2006) and Schertel Mendes (2014).
46
A. Schreiber