backNewsletter (#003/2026) on Privacy and Data Protection by Campos Thomaz Advogados
Alerts, materials, and updates on Privacy, Data Protection, and Cybersecurity.
To subscribe, click here.
Find out more about our DPO as a Service
We have prepared specific material to explain how the external DPO as a Service works. Contact our partners
Brazilian Senate Approves Conversion of ANPD into a Regulatory Agency and Expands Its Digital Oversight Powers
On February 24, 2026, the Federal Senate approved Provisional Measure No. 1,317/2025, converting the Brazilian Data Protection Authority into the National Data Protection Agency, a special federal regulatory entity vested with functional, technical, decision-making, administrative and financial autonomy. The measure formally integrates the entity into the framework of federal regulatory agencies, providing an institutional structure aligned with the scope and complexity of its supervisory and rulemaking responsibilities in the field of personal data protection. A key development is the creation of a dedicated Regulatory and Supervisory Career for Data Protection, including permanent positions for Data Protection Regulation Specialists, thereby enhancing the Agency’s technical and operational capacity. Learn more.
Brazilian Superior Court of Justice Rules That Disclosure of Non-Sensitive Data in Credit Registry Does Not Automatically Trigger Moral Damages
On February 13, 2026, the Fourth Panel of the Brazilian Superior Court of Justice unanimously held that the mere disclosure of non-sensitive personal data within the positive credit registry system does not, in itself, give rise to presumed moral damages. In Special Appeal No. 2,221,650, the Court followed the reporting Justice’s opinion, establishing that compensation depends on evidence of a significant infringement of the data subject’s personality rights. The dispute concerned allegations that personal registration data had been unlawfully commercialized through credit scoring services, in purported violation of the Brazilian General Data Protection Law, the Positive Credit Registry Law and consumer protection rules. Learn more.
Brazil’s Ministry of Justice Releases Report on Age Verification Mechanisms to Support Digital Child Protection Regulation
On February 3, 2026, Brazil’s Ministry of Justice and Public Security released the report “Age Verification Mechanisms: analysis of public consultation contributions and inputs for the regulation of Law No. 15,211/2025,” which established the Digital Statute for Children and Adolescents. The document compiles and analyzes 70 submissions received during a public consultation held between October 15 and November 14, 2025, through the Participa + Brasil platform. The consultation aimed to gather technical input for the definition of mandatory national age verification standards applicable to access to content, products and services restricted to minors. The report was prepared by the National Secretariat for Digital Rights, in cooperation with the Federal University of Ceará, with support from UNESCO, Senacon and the National Data Protection Agency. Learn more.
Brazilian Data Protection Agency Concludes Alignment Stage of AI Regulatory Sandbox and Moves to Supervised Testing Phase
On February 19, 2026, the National Data Protection Agency concluded the alignment stage of its Regulatory Sandbox Pilot on Artificial Intelligence and Data Protection, a mandatory phase under the public call preceding the testing of selected projects. The purpose of this stage was to harmonize the technical, legal and regulatory understanding of participating entities, ensuring a common foundation for the safe and responsible development of technological solutions within the supervised experimental environment. Conducted over a four-month period with institutional support from the University of São Paulo, the program included lectures, practical workshops and assessments addressing the structure and methodology of regulatory sandboxes, as well as comparative international experiences. Learn more.
Brazilian Supreme Court Imposes Data Protection Safeguards on Celepar’s Privatization Process
On February 23, 2026, in Direct Action of Unconstitutionality No. 7,896, Justice Flávio Dino of the Brazilian Supreme Federal Court issued an interim decision conditioning the privatization of the Paraná State Information and Communication Technology Company on full compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018) and the National Public Security Policy (Law No. 13,675/2018). The injunction, which is subject to confirmation by the Court’s full bench, requires the State of Paraná to retain control over systems and supervisory powers concerning sensitive personal data and data processed for purposes related to public security, national defense and criminal investigations. Learn more.
Bill Introduces Mandatory Use of Facial Recognition Systems by Public Security Forces
On February 23, 2026, Bill No. 649/2026 was introduced in the Brazilian Chamber of Deputies, establishing the mandatory use of body-worn and vehicle-mounted cameras equipped with artificial intelligence systems by public security forces. The proposal requires Military and Civil Police forces at the state and Federal District levels to deploy systems capable of automated facial recognition for individuals subject to valid arrest warrants and automatic license plate recognition for vehicles under judicial restriction, with integration limited exclusively to official databases, such as the National Arrest Warrant Database and official vehicle registries. Learn more.
LGPD Infographic
Access the LGPD infographic prepared by our firm. Access here
Explore our series of content on privacy, data protection, and cybersecurity.
Discover our series of content on privacy, data protection, and cybersecurity. Access the full series here.
Produced by Alan Campos Thomaz and João Marcelo de Oliveira
share
