Habeas Data: The Right to Access Your Personal Information

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Habeas data is the constitutional remedy created to guarantee anyone the right to access, correct, and explain information about themselves held in the databases of government agencies or entities of a public nature. In the digital economy, its importance only keeps growing.

What Habeas Data Is

Habeas data is provided for in Article 5, item LXXII, of the 1988 Federal Constitution and regulated by Law 9.507/1997. It is a constitutional action that allows anyone to learn what personal information is stored in the records or databases of government agencies or public-character entities, and to correct data that is wrong or incomplete. Situations in which people need to challenge information recorded about them are becoming more and more common, especially in systems that directly affect their credit, their reputation, or their access to benefits.

The remedy arose in response to the growing computerization of databases and the need to protect citizens from the misuse of personal information. Before habeas data, Brazil had no specific constitutional mechanism for this purpose. Although it is used less often than other constitutional remedies, habeas data plays a strategic role in matters involving federal revenue records, credit protection systems considered public in character, and social security records.

When Habeas Data Is Available

The Constitution lists three basic purposes for habeas data. The first is to ensure access to information about the petitioner held in records or databases. The second is to allow the correction of that data when it is wrong. The third, added by Law 9.507/1997, is to allow a statement of dispute or explanation to be annotated on data that is accurate but contested. Each of these situations requires specific grounds in the petition.

One important point is that habeas data presupposes that the entity holding the data has refused to act or has failed to respond. Before filing the action, you must submit an administrative request to the agency or entity. If there is an express refusal, an unjustified delay, or no response within a reasonable time, the path to habeas data opens. This requirement of a prior administrative request is a settled rule in the case law of the higher courts.

What Counts as a Public-Character Database?

Law 9.507/1997 itself defines what public-character records or databases are. They are those whose information may be passed on to third parties, whether or not they belong to the State. For this reason, the courts have accepted that the files of credit protection agencies, such as those that record unpaid debts, may be challenged through habeas data, because their information is shared with the market.

Procedure and Standing

Habeas data is free of charge, as Article 5, item LXXVII, of the Constitution provides, and it requires legal representation: it must be filed by a lawyer. Standing is strictly personal. Only the person the data concerns may file, with rare exceptions involving heirs who seek to protect the memory of a deceased person. Legal entities may also file when the data concerns the entity itself.

Habeas data turns the right to information into the right to informational self-determination, allowing citizens to learn and correct what is said about them in the systems that influence their lives.

As for procedure, Law 9.507/1997 establishes a fast-track process modeled on that of the mandado de segurança (a special writ against unlawful acts by public authorities). The initial petition must include proof that the entity holding the data refused or delayed. The judge orders the responding authority to be notified and to provide information within 10 days. The Public Prosecutor’s Office (Ministério Público) then acts as custos legis (guardian of the law), and the judgment must be issued within a short period. A preliminary injunction is available when there are relevant grounds and a risk that the remedy would otherwise be ineffective.

Habeas Data, LGPD (Brazil’s General Data Protection Law), and Data Protection

Since the enactment of the General Data Protection Law (Law 13.709/2018), many of the rights originally associated with habeas data can also be exercised administratively, directly with the controllers of personal data. The LGPD provides rights of access, correction, deletion, and data portability, all of which can be exercised without going to court. Even so, habeas data remains relevant where a refusal is unjustified or where the entity holding the data is a public body whose information falls outside the scope of the LGPD.

In our practice on constitutional law issues, we often see that people are unaware of the two paths available and fail to exercise their rights for lack of guidance. Together, the LGPD and habeas data create a fairly complete system of protection, and the best path depends on who holds the data and how urgent the situation is. For other topics related to the Constitution, we also suggest reading the most recent posts.

The Difference Between Habeas Data and Mandado de Segurança

A common mistake is to use a mandado de segurança in place of habeas data. The rule is simple: when the purpose of the action is to learn, correct, or explain personal information in a public-character database, habeas data is the proper path. If the violated right is something else, not directly related to access to information, and a public authority has acted abusively, a mandado de segurança is the right tool. Choosing the correct remedy helps you avoid having the case dismissed because the procedural vehicle was wrong.

Frequently Asked Questions

Do I need to make an administrative request before filing habeas data?

Yes. The case law of the higher courts requires a prior administrative request to the entity holding the data. Only if the entity refuses, delays without justification, or fails to respond can you turn to the court route of habeas data.

Can habeas data be used against private companies?

Yes, as long as the database is public in character, meaning its information may be passed on to third parties. Credit protection agencies and other records shared with the market fall into this category, according to the understanding established by Law 9.507/1997 and the case law.

Is habeas data free of charge?

Yes. Article 5, item LXXVII, of the Federal Constitution guarantees that habeas data is free, as are habeas corpus and the acts necessary to exercise citizenship. You still need to be represented by a lawyer, however, because the exemption covers court costs, not the requirement of legal representation.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.