Art. 23 Processing of personal data by legal entities of public law referred to in sole paragraph of Art. 1 of Law No. 12,527

Art. 23

Processing of personal data by legal entities of public law referred to in sole paragraph of Art. 1 of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”), shall be done in fulfillment of its public purpose, in benefit of the public interest, for the purpose of performing legal capabilities or discharging legal attributions of the public service, provided that:

I – they communicate the situations in which, in the exercise of their regulatory capacities, they carry out the processing of personal data, supplying clear and up-to-date information about the legal base, purpose, procedures and practices used to carry out these activities in an easily accessible media, preferably on their websites;

II – (vetoed); and

III – a data protection officer is appointed when carrying out personal data processing operations, in accordance with Art. 39 of this Law; and (New Wording Given by Law No. 13,853/2019)

IV – (vetoed). (Included by Law No. 13,853/2019)

§1 The national authority may provide for the forms of disclosing information on data processing operations.

§2 The provisions of this Law do not exempt the legal entities mentioned in the lead sentence of this article from establishing the authorities as provided in Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”).

§3 The time periods and procedures for exercising data subjects’ rights before the public authorities shall obey the provisions of specific legislation, especially the provisions stated in Law No. 9,507, of November 12, 1997 (the “Brazilian Habeas Data Law”), of Law No. 9,784, of January 29, 1999 (the “Federal Administrative Procedure Law”), and of Law No. 12,527, of November 18, 2011 (the “Brazilian Access to Information Law”).

§4 Notarial and registry services, carried out under private nature by delegation of public authorities, shall receive the same treatment given to legal entities as provided in the lead sentence of this article, in accordance with the terms of this Law.

§5 Notarial and registry bodies shall provide access to data by electronic means to the public administration in order to fulfill the purposes mentioned in the lead sentence of this article.