LGPD, sensitive personal data and children's data

Article 5, II defines sensitive personal data as data about racial or ethnic origin, religious conviction, political opinion, union or religious, philosophical or political association, health or sex life, or genetic or biometric data tied to a natural person, and article 11 confines its processing to specific, highlighted consent or a narrow list of alternative bases: a legal or regulatory obligation, a public-policy purpose, research with anonymization where possible, the exercise of a right, protecting life or physical safety, health treatment, or fraud prevention and authentication safeguards.

Article 11, paragraph 4 bars sharing sensitive health data between controllers for economic advantage, except for data-subject-requested portability or the health-service, pharmaceutical and health-assistance transactions the provision lists, and bars a health-insurance operator outright from using health data to select risks in contracting or excluding beneficiaries.

Article 12 excludes anonymized data from the definition of personal data unless the anonymization can be reversed with the controller's own means or reasonable effort, and treats data used to build an identifiable behavioral profile as personal data again. Article 13 lets a research body access personal data for public-health studies only within a controlled and secure environment, anonymized or pseudonymized where possible, and bars any transfer of that data to a third party.

Article 14 requires a child's or adolescent's data to be processed in their best interest, with specific, highlighted consent from at least one parent or legal guardian, except to contact the parent once without storing the data or to protect the child, bars conditioning participation in a game, application or activity on more personal data than the activity strictly needs, and requires the controller to make reasonable efforts, considering available technology, to verify that the consent came from the responsible adult.