Art. 18 The data subject , regarding the data subject’s data being processed by the controller

Art. 18

The data subject , regarding the data subject’s data being processed by the controller, at any time and by means of request, has the right to obtain the following from the controller:

I – confirmation of the existence of the processing;

II – access to the data;

III – correction of incomplete, inaccurate or out-of-date data;

IV – anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the provisions of this Law;

V – portability of the data to another service or product provider, by means of an express request and subject to commercial and industrial secrecy, pursuant to the regulation of the controlling agency;

V – portability of the data to another service provider or product provider, by the means of an express request, pursuant with the regulations of the national authority, and subject to commercial and industrial secrets; (New Wording Given by Law No. 13,853/2019)

VI – deletion of personal data processed with the consent of the data subject, except in the situations provided in Art. 16 of this Law;

VII – information about public and private entities with which the controller has shared data;

VIII – information about the possibility of denying consent and the consequences of such denial;

IX – revocation of consent as provided in §5 of Art. 8 of this Law.

§1 The personal data subject has the right to petition, regarding her/his data, against the controller before the national authority.

§2 The data subject may oppose the processing carried out based on one of the situations of waiver of consent, if there is noncompliance with the provisions of this Law.

§3 The rights provided in this article shall be exercised by means of an express request by the data subject or her/his legally constituted representative to the processing agent.

§4 If it is impossible to immediately adopt the measure mentioned in §3 of this article, the controller shall send a reply to the data subject in which she/he may:

I – communicate that she/he is not the data processing agent and indicate, whenever possible, who the agent is; or

II – indicate the reasons of fact or of law that prevent the immediate adoption of the measure.

§5 The request as mentioned in §3 of this article shall be fulfilled without costs to the data subject, within the time periods and the terms as provided in regulation.

§6 The responsible shall immediately inform the processing agents with which she/he has carried out the shared use of data of the correction, deletion, anonymization or blocking of data, so that they can repeat an identical procedure.

§6 The controller shall immediately inform the processing agents with which she/he has carried out the shared use of data of the correction, deletion, anonymization or blocking of data, so that they can repeat an identical procedure, except in cases in which this action is proven impossible or involves disproportionate effort. (New Wording Given by Law No. 13,853/2019)

§7 The portability of personal data referred to in item V of the lead sentence of this article does not include data that have already been anonymized by the controller.

§8 The right referred to in §1 of this article may also be exercised before consumer-defense entities.