BrazilPositive Credit Registry Law, credit-history databases and their managers
In force since .
A data brokers rule binding private bodies.
- Obligation class
- Licensing, Disclosure, Consent, Retention
What it requires
- Store in a credit-history database only objective, clear, true and easily understood information needed to assess the registered person's economic situation, and never excessive information or sensitive information (social and ethnic origin, health, genetic information, sexual orientation, political, religious or philosophical convictions).
- Notify the registered person, at no cost, within 30 days after opening the registry and state the channels for cancelling it, unless the person already has a registry in another database.
- Give enquirers the credit history only with the registered person's specific prior authorization, and keep procedures that prove that the authorization is authentic and valid.
- Use the information held only to analyze the registered person's credit risk or to support credit, a sale on credit or another transaction that carries financial risk to the enquirer, and let only enquirers that keep or intend to keep a commercial or credit relationship with the person access it.
- Do not keep payment-performance information in a database for more than 15 years.
- Do not require exclusivity from the sources of information.
- Publish on your website, in clear and accessible form, your policy for collecting and using personal data to prepare credit-risk analyses.
- Do not use in a credit score information unrelated to credit risk, information on origin, health, genetic information, sex or political, religious or philosophical convictions, information on persons who are not first-degree relatives or economic dependents of the registered person, or information on the registered person's exercise of the right of access.
These lines are LexLint's reading of the law's text.
What this law does
Law 12,414 governs the formation of and consultation to databases of payment-performance information on individuals and legal entities, which build a credit history. A manager is a legal entity responsible for administering a database and for collecting, storing and analyzing the data and giving third parties access to the data stored.
A manager may give enquirers a credit score built from the stored information, and the credit history only with the specific prior authorization of the registered person. The manager must notify the registered person within 30 days after the registry is opened, at no cost, and must state the channels for cancelling the registry.
Entries of excessive information and of sensitive information, meaning social and ethnic origin, health, genetic information, sexual orientation and political, religious and philosophical convictions, are prohibited. The information in the databases may be used only to analyze the credit risk of the registered person or to support credit, a sale on credit or another transaction that carries financial risk to the enquirer.
Only enquirers that keep or intend to keep a commercial or credit relationship with the registered person may access the information held. Payment-performance information may not remain in a database for more than 15 years. Institutions authorized by the Central Bank of Brazil supply information on their credit operations only to managers registered with the Central Bank.
Complementary Law 166 of 2019 rewrote or added many provisions of Law 12,414, in force 91 days after its publication in the Diário Oficial da União of . The Law took effect on the day of its publication.
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .