backOn February 23, 2026, in Direct Action of Unconstitutionality No. 7,896, Justice Flávio Dino of the Brazilian Supreme Federal Court issued an interim decision conditioning the privatization of the Paraná State Information and Communication Technology Company on full compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018) and the National Public Security Policy (Law No. 13,675/2018). The injunction, which is subject to confirmation by the Court’s full bench, requires the State of Paraná to retain control over systems and supervisory powers concerning sensitive personal data and data processed for purposes related to public security, national defense and criminal investigations.
The ruling further mandates the preparation of a specific data protection impact report addressing the corporate transition, to be submitted to the National Data Protection Agency for review and recommendations regarding standards and best practices. The action was filed by political parties challenging State Law No. 22,188/2024 on the grounds that it allegedly encroaches upon the Federal Government’s legislative competence over data protection and undermines fundamental rights. In his reasoning, the Justice emphasized that subnational entities must comply with federal data protection legislation and that insufficient safeguards in privatization processes involving sensitive databases may jeopardize constitutional guarantees of privacy and public security. Learn more.
share
