Secrecy, Publicity, and Data Protection in Public Administration Proceedings

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Brazilian public administration lives with a constant tension. On one side is the constitutional duty to make its acts public. On the other is the obligation to protect the personal data of the citizens who appear in its proceedings. Knowing when a proceeding may be kept confidential, who has access to the case file, and how far the disclosure of sensitive information may go has become a central question in contemporary administrative law.

Publicity as the Rule and Secrecy as the Exception

The Federal Constitution lists publicity among the express principles of public administration. Article 37 requires that government action be, as a rule, open to citizens’ scrutiny, and Article 5 guarantees everyone the right to receive information from public bodies, whether it concerns their own interests or the collective interest. The rule is therefore clear: what the government does must be open to view.

The Access to Information Law (Law 12.527/2011) gave concrete form to that mandate. It established that access is the rule and secrecy the exception, and it set maximum classification periods for information designated as restricted, secret, and top secret. More than that, it shifted to the administration the burden of justifying why a given piece of information cannot be disclosed. This reversed the earlier logic, under which citizens had to prove their interest before obtaining any data at all.

This framework creates an important starting point for any analysis. When someone requests information or access to an administrative proceeding, openness is presumed. A public official who refuses must identify the specific legal basis for the refusal, or risk liability for breaching the duty of transparency.

When a Proceeding May Be Kept Confidential

Secrecy, although exceptional, is legitimate in well-defined situations. In the courts, the Code of Civil Procedure (Article 189) allows segredo de justiça (sealed proceedings, similar to a case filed under seal) in cases involving public or social interest, family law, data protected by the right to privacy, or arbitration that requires confidentiality. In those cases, access is limited to the parties and their attorneys.

In the administrative sphere, the logic is similar, although it is applied to procedures such as preliminary inquiries, disciplinary proceedings, and internal investigations. The administration may temporarily restrict access when disclosure could compromise the fact-finding process, expose innocent third parties, or reveal sensitive personal data without need. Secrecy, however, cannot be indefinite or generic. It requires a legal basis, a time limit, and a purpose.

There is also a distinction that often causes confusion. Confidentiality is not the same as absolute inaccessibility. A sealed case remains fully accessible to those who are directly involved in it, and its acts continue to produce legal effects. What is restricted is outside publicity: the ability of anyone at all to look at the contents.

The rule is therefore clear: what the government does must be open to view.

The Parties’ Access to Their Own Case File

One of the most delicate points on this topic is a party’s right to access the proceeding in which they are involved. This access flows directly from the guarantees of adversarial process and full defense in Article 5 of the Constitution. No one can defend against what they do not know, so anyone with an interest in the proceeding cannot be surprised by documents or evidence that were kept from them.

Court decisions have firmly settled this understanding. Even in investigations conducted under seal, the party and their attorney are entitled to see the material already documented in the file. The only exception is for ongoing investigative steps whose effectiveness depends on the subject not knowing about them in advance. When a restriction exists, it applies to the general public, not to the person being investigated or prosecuted.

This arrangement protects two values at once. It ensures that citizens can mount a full defense, and at the same time it prevents the premature public exposure of a proceeding from causing irreversible reputational harm before any conclusion has been reached. An administration that denies a party access to their own file commits a serious violation of the law, which can be corrected through a mandado de segurança (a constitutional writ against unlawful acts of public authorities).

The professional handling these cases must pay attention to how to request access to the file, the administration’s deadline to respond, and whether an internal appeal is available before going to court. Careful documentation of every denied request is what later supports the showing that the denial was unlawful.

The Limits on Disclosing Sensitive Data

The entry into force of the General Data Protection Law (Law 13.709/2018) reshaped the debate. The law expressly applies to the government and requires that any processing of personal data by state bodies have a specific purpose, an appropriate legal basis, and proportionality. The administration is no longer free to disclose everything it holds, even when it acts in the name of transparency.

The law distinguishes ordinary personal data from sensitive personal data. The latter includes information about health, racial origin, religious belief, political opinion, sex life, and genetic or biometric data. Disclosing these details calls for extra caution, because a leak can lead to discrimination and harm a person’s dignity. Publishing an administrative decision does not authorize exposing, along with it, the medical report of the person who prompted it.

In practice, balance is achieved through concrete techniques. The administration should anonymize or redact sensitive data before making a decision public, disclose the outcome without exposing unnecessary intimate details, and restrict access to documents that contain protected information. Transparency does not mean indiscriminate exposure. It means responsible knowledge of what the government decides and why.

When these two duties collide, the answer lies in balancing them. There is no automatic hierarchy between transparency and data protection. The interpreter must determine, in the specific case, what the purpose of the disclosure is, whether it is necessary, and whether a less invasive means exists to reach the same goal. The practical rule is to disclose enough for public oversight while preserving whatever is private and unnecessary to the public interest.

How the Tension Is Resolved in Administrative Practice

For citizens, three approaches tend to make a difference. The first is to make access requests clearly and with supporting reasons, invoking the Access to Information Law and stating the legitimate interest. The second is to demand, whenever a request is denied, the specific legal basis that justifies the denial. The third is to be clear about what you are seeking: access to your own case file, which is an almost unconditional right, or access to third parties’ data, which is subject to stricter filters.

For the administration, the path is equally straightforward. Classify information only when there is a real basis for doing so, set time limits for secrecy, anonymize sensitive data before any publication, and give the parties full access to their own proceedings. An agency that acts this way meets both its duty of transparency and its obligation to protect data, without sacrificing either one.

The result of this design is a system in which public oversight coexists with privacy. The government shows what it decides and how it decides, but safeguards the private sphere of those who take part in its proceedings. Understanding this logic is essential both for citizens seeking information and for professionals defending clients’ interests before the public administration.

Frequently Asked Questions

Can I access an administrative proceeding to which I am a party even if it is confidential?

Yes. Confidentiality restricts outside publicity, meaning access by people who are not part of the proceeding, but it does not remove the right of the party and their attorney to review the file. This access flows from the guarantees of adversarial process and full defense. The only accepted exception concerns ongoing investigative steps whose effectiveness depends on temporary secrecy, and even that restriction must be temporary and supported by stated reasons.

Can the administration deny an information request by citing data protection?

It can, as long as it specifies which personal data would be exposed and why disclosing them would violate the General Data Protection Law. A generic refusal is unlawful. When a request involves information that mixes public and personal data, the correct solution is usually to provide the information with the sensitive elements redacted or anonymized, rather than refusing access altogether.

Are public transparency and data protection incompatible principles?

No. Although they seem opposed, both protect the same citizen from different angles. Transparency makes it possible to oversee the government and curb abuses. Data protection prevents the government itself from improperly exposing people’s private lives. When the two collide, the answer comes from balancing them in the specific case: disclosing what is needed for public oversight and preserving whatever is private and unnecessary to the public interest.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.