Razilian's Protection of Personal Data

...

data stored in one or several locations, in electronic form or not; (iii) treatment: any operation or set of operations performed upon personal data or database, with or without the aid of automatic means, such as collection, storage, planning, conservation, modification, comparison, evaluation, organization, selection, extraction, use, blocking, cancellation and provision to third parties, by means of transfer, communication, interconnection or dissemination.

The article 13 provides that the the processing of personal data can only be accomplished in following assumptions: I - with the express and informed consent of the data subject; II - the execution of a contract or pre-contractual phase of a relationship where the holder is a party; III - when necessary for the fulfillment of legal obligation by responsible; IV - when performed exclusively for a journalistic, historical or scientific research; V - with judicial authorization or when facing the exercise of legitimate defense; VI - when necessary to carry out specific activities legal entities of public law, through motivated decision; VII - when only use data and publicly available information, general and unrestricted; VIII - when necessary for protection of health or safety physical protection of a person.

A data subject needs to provide separate consent to allow the processing of sensitive data and the data owner has the right to revoke the consent at any time. As well as the Bill of Law nº330, it also expressly forbids the processing of sensitive personal data revealing racial, genetic and sexual information, and religious, moral and political convictions (article 15).

There are also restrictions on transferring personal data to countries that do not provide similar levels of data protection. In addition, it provides that minors aged 12 to 18 may be permitted to provide consent for processing of their personal data, subject to certain conditions and their consent may be revoked at any time by the parents or legal representatives of the minor. The treatment of personal data of children below 12 years old requires parental authorization.