Razilian's Protection of Personal Data

Brazilian's Protection of Personal Data Bills of Law

Currently in Brazil there are two Senate Bills of Law ("PLS") which adopts provisions concerning the storage and use of personal data by the government and the private sector: the Senate Bill of Law nº 330/2013 and the Senate Bill of Law 181/2014.

The Bill of Law 330/2013 establishes principles, rights and obligations for the use and treatment of personal data in Brazil, as well as its transmission abroad. This "PLS" law enforcement in case of treatment data held by individuals for private purposes need (2nd article) and mentions that the law will be applied throughout the national territory as well as where force this bill through treaty or convention.

Its 3rd article provides some concepts as: (i) personal data, which is any information that can be stored, processed, or transmitted; (ii) database, meaning the structured set of personal data, centralized or decentralized, accessible according to a specific criteria,no matter the form of management; (iii) sensitive data, as defined by the personal information revealing racial or ethnic origin, political opinions, religious, ideological or philosophical convictions, trade union membership and activity, health status or sexual orientation of the person.

The 6th article establishes that the data considered sensitive may only be collected, stored, processed, transmitted, used, disclosed or provided to users: I - with the express, specific and unambiguous consent of the owner or legal representative; II - for purely statistical, historical or scientific purposes, forbidden the identification of the holder; III - by judicial decision; IV - by express legal provision; V - by relevant public interest, according to the regulations of this “PLS”; VI - in order to preserve the right to life of the data subject.

This Bill of Law also provides the treatment of personal data for law enforcement purposes, criminal or prosecution, administrative or tax, in accord with the focus given to the personal data protection, according to article 6.

In the other hand, the Bill of Law nº 181/2014 applies to individuals and companies that process personal data through automated means. The key provisions contained in this Draft Bill include the requirement to obtain consent from the data subject to process personal data, subject to limited exceptions (for example: no consent is needed in cases where data collected was previously made public or if data has been unrestricted); and the prohibition to process sensitive personal data, with some exceptions.

As the PLS before mentioned, the 5th article of the Bill of Law nº 181 also has some definitions for instance: (i) personal data, meaning any information related to a natural person that allows his/her identification, directly or indirectly, including the identification numbers or element of her/his physical, physiological, mental, economic, cultural or social identity and address of Internet Protocol (IP address) of a terminal used for connection to a a network of computers; (ii) database, defined as any structured and organized set of personal data stored in one or several locations, in electronic form or not; (iii) treatment: any operation or set of operations performed upon personal data or database, with or without the aid of automatic means, such as collection, storage, planning, conservation,