Right to Privacy and Data Protection Under the Brazilian Constitution (CF/88)

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Privacy and personal data protection now have explicit constitutional status, reinforcing guarantees already set out in Article 5. In an age of data leaks and digital monitoring, knowing these rules has become a matter of legal survival.

Privacy in the Original Text of the Constitution

Since 1988, the Constitution has guaranteed the inviolability of people’s intimacy, private life, honor, and image (Article 5, X), and it provides for compensation for material or moral damages when these rights are violated. Item XI establishes that the home is an inviolable refuge for the individual, and item XII protects the secrecy of correspondence, telegraphic communications, data, and telephone communications. Together, these provisions form the historical core of the right to privacy in Brazil.

Cases in which these provisions are invoked come up frequently, whether to challenge illegal wiretaps, home searches without a court warrant, or the improper exposure of personal information. The case law of Brazil’s Supreme Federal Court reinforces that the secrecy of communications and records may be breached only in strictly defined circumstances, by a reasoned court order and for a limited period.

Constitutional Amendment 115/2022 and Data Protection

On February 10, 2022, Constitutional Amendment 115 was promulgated. It added item LXXIX to Article 5, guaranteeing, as provided by law, the right to the protection of personal data, including in digital media. The same amendment added personal data protection to the exclusive powers of the Union, Brazil’s federal government (Article 22, XXX). This change raised the subject to the level of an autonomous fundamental right, with enormous consequences for companies, public agencies, and individuals.

Before the amendment, the Supreme Federal Court had already recognized, in its judgment of ADI 6387 (a direct action of unconstitutionality), that data protection derived implicitly from the rights to intimacy and private life. Since 2022, the subject has had an express constitutional provision, which reinforces the immediate applicability of the right and supports the creation of specific public policies.

The LGPD (Brazil’s General Data Protection Law) as Implementing Legislation

The General Data Protection Law (Law 13.709/2018) details how personal data must be handled. It sets out principles, data subjects’ rights, the legal grounds for processing, and penalties for noncompliance. The National Data Protection Authority (ANPD) oversees enforcement of the law. In practice, the LGPD works hand in hand with new item LXXIX of Article 5 of the Constitution.

Rights of the Data Subject

The law gives data subjects the right to know what data is collected, for what purpose, how long it will be stored, and with whom it is shared. It also guarantees access, correction, deletion, portability, and the ability to withdraw consent. These rights are directly tied to the constitutional guarantee and give individuals real control over their personal information.

Data protection is no longer a technical detail. It has become an autonomous fundamental right, enforceable in any public or private relationship.

If you believe your data has been mishandled, you should gather evidence, file a complaint with the responsible data controller, and, where appropriate, turn to the ANPD or the courts. Relief may include compensation for moral damages, an order to stop the unlawful processing, and even the complete deletion of the compromised information.

Privacy in the Digital Environment

The massive use of apps, social networks, and cloud services has made privacy a constant topic of debate. The Constitution, supplemented by the LGPD and by the Marco Civil da Internet (Brazil’s Internet Civil Rights Framework), protects users against abusive data collection, unauthorized profiling, and improper data sharing. Each of these instruments operates at a specific layer, and together they form the legal shield for the digital environment.

In day-to-day practice, we see that many violations go unnoticed because data subjects do not know their rights. That is why it is worth following the firm’s constitutional law content, which offers further discussion of privacy, confidentiality, and individual liberties in the digital age.

Applying Data Protection in Everyday Relationships

Raising data protection to constitutional status affects e-commerce, banking services, health plans, and employment relationships. Companies must base every processing operation on one of the legal grounds provided by the General Data Protection Law, avoid indiscriminate collection, and keep records that make it possible to verify the stated purpose. Without these controls, an organization is exposed to administrative sanctions imposed by the National Data Protection Authority, as well as to lawsuits for compensation filed by harmed data subjects.

In the public sector, the express recognition of data protection as a fundamental right strengthens oversight of the databases kept by federal, state, and municipal agencies. Before government databases are integrated to fight fraud or offer digital services, an impact assessment must be carried out, with data minimization mechanisms and active transparency. Individuals now have a direct constitutional basis to challenge unauthorized data sharing or to request the correction of outdated information in official systems.

In court, data subjects can combine constitutional and statutory arguments when addressing a data leak, the improper exposure of information, or commercial use without consent. Compensation covers not only financial losses, such as bank account freezes and fraudulent registrations, but also moral damages caused by the exposure of private life. The courts have established the understanding that the amount of compensation should take into account the sensitivity of the data involved, how long the exposure lasted, and how the controller acted after learning of the incident.

Frequently Asked Questions

Is personal data protection a fundamental right?

Yes. With Constitutional Amendment 115/2022, personal data protection was expressly added to the list of fundamental rights and guarantees through item LXXIX of Article 5 of the Federal Constitution. This gives it immediate applicability and reinforced protection against rollbacks.

What is the difference between privacy and data protection?

Privacy protects intimacy, private life, and control over what is made public. Data protection is a more specific right, focused on how third parties handle personal information, with rules on collection, storage, sharing, and deletion. The two rights complement and reinforce each other.

Can I ask a company to delete my data?

Yes. The General Data Protection Law guarantees the right to have personal data deleted when it was processed based on consent, as well as in other situations provided by law. You simply submit the request to the controller, who has a deadline to respond. If the request is refused without justification, you can file a complaint with the ANPD or bring a lawsuit.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.