Art. 26 The shared use of personal data by public authorities shall fulfill the specific purposes of execution of public policies

Art. 26

The shared use of personal data by public authorities shall fulfill the specific purposes of execution of public policies and legal attributions by agencies and public entities, subject to the principles of personal data protection listed in Art. 6 of this Law.

§1 It is forbidden for public authorities to transfer to private entities personal data contained in databases to which they have access, except:

I – in cases of decentralized execution of public activity that requires transfer, exclusively for this specific and distinct purpose, subject to the provisions of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”);

II – (vetoed);

III – in cases in which the data are publicly accessible, subject to the provisions of this Law.

IV – when there is a legal provision or the transfer is grounded on contracts, agreements or similar instruments; or (Included by Law No. 13,853/2019)

V – in the event that the transfer of data is exclusively intended to prevent fraud and irregularities, or to protect and safeguard the data subject’s security and integrity, provided that processing is forbidden to be carried out for other purposes.” (Included by Law No. 13,853/2019)

§2 Contracts and agreements as mentioned in §1 of this article shall be communicated to the national authority.