Art. 7 Processing of personal data shall only be carried out under the following circumstances

Art. 7

Processing of personal data shall only be carried out under the following circumstances:

I – with the consent of the data subject;

II – for compliance with a legal or regulatory obligation by the controller;

III – by the public administration, for the processing and shared use of data necessary for the execution of public policies provided in laws or regulations, or based on contracts, agreements or similar instruments, subject to the provisions of Chapter IV of this Law;

IV – for carrying out studies by research entities, ensuring, whenever possible, the anonymization of personal data;

V – when necessary for the execution of a contract or preliminary procedures related to a contract of which the data subject is a party, at the request of the data subject;

VI – for the regular exercise of rights in judicial, administrative or arbitration procedures, the last pursuant to Law No. 9,307, of September 23, 1996 (the “Brazilian Arbitration Law”);

VII – for the protection of life or physical safety of the data subject or a third party;

VIII – to protect health, in a procedure carried out by health professionals or by health entities;

VIII – to protect the health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities; (New Wording Given by Law No. 13,853/2019)

IX – when necessary to fulfill the legitimate interests of the controller or a third party, except when the data subject’s fundamental rights and liberties which require personal data protection prevail; or

X – for the protection of credit, including as provided in specific legislation.

§1 (Revoked). (New Wording Given by Law No. 13,853/2019)

§2 (Revoked). (New Wording Given by Law No. 13,853/2019)

§3 The processing of publicly accessible personal data shall consider the purpose, the good faith and the public interest that justify it being made available.

§4 The consent requirement provided in the lead sentence of this article is waived for data manifestly made public by the data subject, safeguarding the rights of the data subject and the principles provided in this Law.

§5 The controller who has obtained the consent referred to in item I of the lead sentence of this article that needs to communicate or share personal data with other controllers shall obtain specific consent from the data subject for this purpose, except when the need for such consent is waived as provided in this Law.

§6 Any eventual waiver of the consent requirement does not release processing agents from the other obligations provided in this Law, especially that of obeying the general principles and guarantees of the data subject’s rights.

§7 The subsequent processing of the personal data referred to in paragraphs 3 and 4 of this article may be carried out for new purposes, provided that legitimate and specific purposes to the new processing and the preservation of the rights of the data subject are observed, as well as the grounds and principles set forth in this Law.” (Included by Law No. 13,853/2019).