← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية

Brazil's ANPD sanctions a city for exposing health data: LGPD lessons

A Brazilian city published 1,241 people's diagnoses in its official gazette. See the six LGPD violations ANPD found, the sanctions and lessons for public bodies.

2026-11-01

Brazil's data protection authority, ANPD, has wrapped up its case against the city of Feira de Santana, in Bahia state, which published in its official gazette lists linking the names of 1,241 people to HIV/AIDS, sickle cell anemia and fibromyalgia diagnoses. Because Brazil's LGPD bars fines on public bodies, the outcome is a warning, public disclosure of the violation and a long list of corrective measures.

What happened?

On September 20, 2025, the city published the names of people whose free public-transit pass was being suspended under a court ruling. The data had been collected to grant the benefit, but the gazette listed each name next to the qualifying health condition. According to Portal de Prefeitura, the edition was online for a few hours and pulled the same day. Convergência Digital reports ANPD received a complaint about 48 hours later, and the city never answered ANPD's formal request for information.

Which LGPD rules were broken?

ANPD's investigation report No. 3/2026 identified six serious violations, according to law firm Cescon Barrieu:

LGPD principle	Finding
Purpose limitation	Benefit data was published by name, incompatible with its original purpose
Transparency	No data protection officer and no privacy policy
Security and prevention	No security policy, incident response plan, pre-publication review or anonymization
Breach notification	A website notice replaced individual notice; letters went to only 22 of 1,241 people (1.77%)
Statutory secrecy	Breach of HIV confidentiality under Law 14,289/2022
Cooperation	No reply to ANPD's formal request

Can a Brazilian city be fined under the LGPD?

No. Article 52, §3 exempts public bodies from fines, so the sanctions are a warning, a notice of the violation on the city's homepage for six months, and orders to appoint a DPO, adopt privacy and security policies, build an incident response plan, review privacy risks before publishing in the gazette, train staff and delete data held without a legal basis. Cescon Barrieu notes the report goes to ANPD's Superintendent of Enforcement for a final decision, appealable within 10 business days.

How fast must a breach be reported in Brazil?

Under ANPD Resolution 15/2024, controllers have 3 business days from learning of a high-risk incident to notify ANPD and affected people, and sensitive data is one of the risk triggers, as summarized by Cescon Barrieu. Notice must be direct and individual whenever people can be identified. Brazil's Law 14,289/2022 adds a specific confidentiality duty for HIV, chronic hepatitis, leprosy and tuberculosis, enforced through LGPD sanctions, according to Agência Senado.

What should public bodies do?

Run a privacy check before publishing any act that names individuals.
Minimize: use case numbers or initials instead of names plus diagnoses.
Appoint and publish a DPO contact and a privacy policy.
Keep a breach plan that can deliver individual notices within 3 business days.
Always answer the regulator.

Compare deadlines across jurisdictions in LGPD, GDPR and US laws: fines and notification deadlines, see how ANPD enforces in LGPD in practice, browse Brazil's regulation and follow new cases on the radar.