BrazilLGPD, sensitive personal data and children's data
Lei nº 13.709, de 2018 (LGPD), arts. 5º, II, 11-14 (sensitive personal data and children's data)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Obtain specific, highlighted consent, or another article 11 legal basis, before processing sensitive personal data such as health, genetic, or biometric data.NIST Privacy FrameworkCT.PO-P1
- Process a child's or adolescent's personal data only with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, and never condition participation in a game, application, or other activity on more personal data than the activity strictly needs.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.DP-P4
- Do not treat anonymized data as personal data unless the anonymization process can be reversed using your own means or with reasonable effort, and treat data used to build an identifiable behavioral profile as personal data again.
- Give a public-health research body access to personal data only within a controlled and secure environment, anonymized or pseudonymized where possible, and never transfer that data to a third party.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkCT.DP-P2
- Do not share sensitive health data between controllers for economic advantage, except for the data subject's requested portability or the listed health-service, pharmaceutical, or health-assistance transactions.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DP-P2Data are processed to limit the identification of individuals (e.g., de-identification privacy techniques, tokenization).
- CT.DP-P4System or device configurations permit selective collection or disclosure of data elements.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 5, item II defines sensitive personal data, Article 11 lists the lawful bases for processing it, and Articles 12 to 14 deal with anonymized data, health research and children's and adolescents' data. Article 14, paragraph 2 requires controllers to keep public the information on the types of data collected, how they are used and how to exercise rights, and paragraph 5 requires reasonable efforts to verify that the parent or guardian gave consent. These are notice and verification duties and none names a log or a record.
- Kind
- None
- As of
What this law does
Article 5, II defines sensitive personal data as data about racial or ethnic origin, religious conviction, political opinion, union or religious, philosophical or political association, health or sex life, or genetic or biometric data tied to a natural person, and article 11 confines its processing to specific, highlighted consent or a narrow list of alternative bases: a legal or regulatory obligation, a public-policy purpose, research with anonymization where possible, the exercise of a right, protecting life or physical safety, health treatment, or fraud prevention and authentication safeguards.
Article 11, paragraph 4 bars sharing sensitive health data between controllers for economic advantage, except for data-subject-requested portability or the health-service, pharmaceutical and health-assistance transactions the provision lists, and bars a health-insurance operator outright from using health data to select risks in contracting or excluding beneficiaries.
Article 12 excludes anonymized data from the definition of personal data unless the anonymization can be reversed with the controller's own means or reasonable effort, and treats data used to build an identifiable behavioral profile as personal data again. Article 13 lets a research body access personal data for public-health studies only within a controlled and secure environment, anonymized or pseudonymized where possible, and bars any transfer of that data to a third party.
Article 14 requires a child's or adolescent's data to be processed in their best interest, with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, bars conditioning participation in a game, application or activity on more personal data than the activity strictly needs, and requires the controller to make reasonable efforts, considering available technology, to verify that the consent came from the responsible adult.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .