On March 17, 2023, the Brazilian National Data Protection Authority (“ANPD” or “Authority”) – Brazilian autarchy responsible for the regulation and supervision on the processing of personal data – published Technical Report no. 3/2023/CGF/ANPD, in which it states that the Brazilian General Law on Data Protection (“LGPD”) does not apply to the deceased persons’ data.
The Technical Report was issued in response to an Official Letter from the Brazilian Federal Highway Police (“Polícia Rodoviária Federal”), which, aiming at honoring deceased servants by creating a Memorial on the institution’s website, questioned the legality of the data processing involved.
The Authority provided that data relating to a deceased person does not constitute personal data under the LGPD and, therefore, are not subject to the regulation’s scope, presenting as arguments:
- Article 5 of the LGPD, which defines the personal data subject as the natural person to whom the personal data that are subject to processing relate; and
- Article 6 of the Brazilian Civil Code, according to which the existence of the natural person ends with death.
In the document, the ANPD states that the rights of deceased persons are protected by other rules of the Brazilian legal system, indicating especially the protection of personality rights – provided in the Brazilian Civil Code and covering the rights to name and image. In addition, the Authority also emphasizes the protection of inheritance rights, which, in addition to the Civil Code’s provisions, is currently being discussed in a legislative proposal for the regulation of digital inheritance (Brazilian House of Representatives’ Bill no. 3050/2020).
The Technical Report also highlights the distinction between Brazilian and European regulation on the subject, since the preamble of the European Union’s General Data Protection Regulation (“GDPR”) expressly excludes the data of deceased persons from its scope of application – although the Member States may regulate differently in their internal legal systems.
Thus, the National Data Protection Authority has decided that the LGPD is not applicable to the processing of deceased persons’ data.
Our team is available for further clarifications and to assist with questions regarding data protection.
Gustavo Flausino Coelho – gustavo@bastilhocoelho.com.br
Fernando Naegele – fernando@bastilhocoelho.com.br
Larissa Santos Bastos – larissa@bastilhocoelho.com.br