LGPD Art.11: Art. 11: Processing of sensitive personal data

Sensitive personal data (racial or ethnic origin, religious conviction, political opinion, union membership or membership of a religious, philosophical or political organisation, health or sex life, genetic or biometric data linked to a person) may be processed only with the specific and highlighted consent of the data subject or legal guardian for specific purposes, or without consent where indispensable for: a legal or regulatory obligation; shared processing needed for public policies by the public administration; studies by a research body with anonymisation wherever possible; the regular exercise of rights, including in contracts and proceedings; protection of life or physical safety; health protection by health professionals, services or authorities; or fraud prevention and the data subject's security in identification and authentication processes in electronic systems, unless the data subject's fundamental rights prevail. The rules apply to any processing that reveals sensitive data and may cause harm. Communication or shared use of health data between controllers for economic advantage is prohibited except for the provision of health services, pharmaceutical care and health assistance (including diagnostic and therapy services) in the data subjects' interest, to allow portability requested by the data subject or the resulting financial and administrative transactions; private health plan operators may not use health data for risk selection when contracting or excluding beneficiaries.