Law No. 14.913 of 2004, consumer privacy and the sharing of personal information without consent
Lei nº 14.913, de 11 de agosto de 2004
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Data subject rights
- Audit expectation
- none
What it requires
- This is a Goiás state consumer-privacy law, and it binds a supplier of products or services as defined in the federal Consumer Defense Code, public or private, a financial institution included, in its dealings with consumers.
- Do not pass on, share, disclose, sell or transfer a consumer's personal information to anyone else, even free of charge, without the consumer's express consent (art. 1).
- Let the consumer revoke that consent at any time, and let the consumer limit the privacy to the items of personal information the consumer chooses (art. 1, §§ 2 and 3).
- When the consent is obtained through an adhesion contract, put it in a clause drafted with emphasis that is easy to understand at once (art. 1, § 4).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Article 1 bars passing on a consumer's personal information without express consent and lets the consumer revoke or limit that consent, and article 2 sets the fine. Neither article requires a log or a record of the consents given or of the disclosures made.
- Kind
- None
- As of
What this law does
A supplier of products or services as defined in the federal Consumer Defense Code, a public or private person, a financial institution included, may not pass on, share, disclose, sell or transfer a consumer's personal information to anyone else, even free of charge, without the consumer's express consent. The consumer may revoke the consent at any time. The consumer may also limit the privacy to particular items of personal information.
Where the consent is obtained through an adhesion contract, it must be given in a clause drafted with emphasis that is easy to understand at once. The Law does not apply to information covered by secrecy, or to the relationship between the supplier and whoever keeps a consumer database or registry under article 43 of the federal Consumer Defense Code.
A breach carries a fine of R$ 1,000 to R$ 500,000, set by the seriousness of the infraction and the number of consumers involved, and paid double on a repeat breach.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .