LGPD Data Subject Rights
Apart from outlining the obligations that organizations should follow when it comes to the collection and processing of personal data, the Brazilian General Data Protection Law also recognizes in the Article 18 the data subject rights regarding personal data usage.
1. Confirmation of the existence of data processing. The data subject has the right to know if an organization holds and processes their data this way gaining insights into the methods, purposes, storage and overall use of their data.
2. Access to data. The data subject has the right to gain access to the personal data collected from them and stored by the organization.
3. Correction of incomplete, inaccurate or outdated data. The data subject has the right to ask for changing and/or updating their personal data.
4. Anonymization, blocking or deletion of unnecessary, excessive or processed data in violation of the provisions of the LGPD. The data subject has the right to request that specific parts or all of the data they have provided be anonymized, blocked or deleted should the information be deemed unnecessary, excessive or processed data in violation of the provisions of the law.
5. Portability of data to another service or product provider, upon express request, in accordance with the regulations of the national authority, subject to commercial and industrial secrets. The data subject has the right to solicit that his data be transferred to another service or product provider providing they comply with the regulations imposed by the National Data Protection Authority.
6. Deletion of personal data processed with the consent of the data subject. The data subject has the right to request the deletion of their data providing that the data is subject to national laws that mandate its storage for a definite period of time.
7. Information on public and private entities with which the controller made shared use of data. The data subject has the right to be informed over the organizations with which their data was shared.
8. Information about the possibility of not giving consent and about the consequences of the refusal. The data subject has the right to inquire the organization about the possibility of them not sharing their data and at the same time to receive information regarding the possible outcome of their refusal.
9. Revocation of consent. The data subject has the right to withdraw their consent for the processing of the data collected from them by any organization.
While the LGDP recognizes data subject rights to the processing of data, it is fundamental to specify that exceptions can apply, however, only in unusual circumstances.