The Brazilian Freedom of Information Act, privacy, and health research

PERSPECTIVES

The law on access to information, privacy, and health research in Brazil

Lei de acesso à informação, privacidade e a pesquisa em saúde

Ley sobre el acceso a la información, la privacidad y la investigación en salud

Miriam Ventura

Instituto de Estudos em Saúde Coletiva, Universidade Federal do Rio de Janeiro.

Correspondence to

Access to public information in Brazil is a fundamental citizen's right ¹, establishing the public nature and availability of all information produced by the state or in its power ². Brazil's Law on Access to Information only allows restrictions on access to information classified as secret for reasons of security or public health, or to personal information the confidentiality of which guarantees the right to privacy. The recently enacted Law n. 12.527/2011 ³ regulates the comprehensive right of access to public information, providing state duties to efficiently manage government documents or those under government custody, and to make knowledge and consultation thereof available to all ³. Availability, authenticity, and integrity are the main legal attributes of public information.

Health information includes administrative data that relate to the public administration itself and to the healthcare network; epidemiological data pertaining to populations; and clinical data obtained directly from the individual in the sphere of individual care. Law n. 8.080/1990 ⁴, regulating the state's duties vis-à-vis the right to health and the organization and operation of public healthcare services in Brazil, highlights citizens' right to information and the state's duty to base its policies and actions on health information and scientific evidence, thereby acknowledging the importance of information for ensuring the right to health ⁴.

The production and circulation of information involve private and public rights and interests and can interfere in or influence social and political relations and actions ⁵. In political life, freedom of access to public information is considered indispensable for broad participation and social control and for the public administration's accountability ^2,5. Social demand is growing for information on a wide range of issues to make "public or private decisions that can affect individual security or set the limits between public protection, individual choices for prevention or defense, and social conventions” ⁶ (p. 636). The expectation that access to health information will improve quality of life and reduce the risk of illness has lent legitimacy to the collection of personal data and its use in the identification of lifestyles, habits, and other aspects of private life and intimacy as one of the state's duties.

The constitutional provision is clear and applicable to any type of information. Detainers of information owe maximum respect for the individual privacy and maximum transparency of acts involving the public interest. Personal information, even when its collection, storage, and use are authorized by health legislation, does not lose its confidential quality, and access to it requires the person's consent, except in two situations: when "the person is physically or legally incapable, and solely and exclusively for medical treatment” ³ or when the information is necessary "to produce statistics and scientific research of evident public or general interest, as provided by the law, while prohibiting the identification of the person to whom the information refers” ³.

The use of personal data in health research is regulated at the national level by the National Health Council ⁷ and at the international level by the Council for International Organizations of Medical Sciences ⁸, reaffirming the confidentiality of personal data, and only exceptionally authorizing access without individual consent after analysis by a research ethics committee or institutional review board. The ethical review must specify whether the study seeks to answer a relevant public health question, with clear benefits; whether it is unfeasible to obtain consent from the subjects; whether the research offers minimal risks; and whether the rights or interests of the persons will not be violated and their privacy and anonymity will be preserved. Meanwhile, submission for review should also describe the safety measures to be adopted to prevent possible harm to the persons involved and special measures to protect vulnerable groups and avoid discrimination and social stigmatization. Researchers should also be accountable for any and all undue use of the data authorized by the consent.

Law n. 12.527/2011 deals specifically with personal information and establishes an open clause, as described, according to which access to such data can only be authorized without the person's consent in cases of "evident public or general interest” or "as provided by law” ³. The specific requirements for access to personal data have been set by health system administrators ⁹ and by institutional review boards ⁷, and requests for such access are assessed at these two levels. Any refusal to access must be justified, and researchers can appeal through the appropriate legal channels ^3,7.

The emergence of new facts and personal and institutional values related to information in contemporary society has required the law to adapt to and/or reconstruct legal categories. The discussion and legislative output on individual and collective tutorship of information have intensified for at least 30 years. All the initial attention focused on the concept of privacy and individual protection, shifting more recently to the more complete notion of "data protection”, which transcends individual oversight ¹⁰. There has been a reconfiguration of the legal safeguard of inviolability of persons (including their bodies) towards a virtual dimension of protection of the electronic body ¹⁰, as a negative right to freedom, i.e., to not use data from electronic files, and meanwhile of positive freedom, of controlling one's data in such records ⁶. Thus, the safeguard of privacy and protection of electronic personal data have come to be allowed in relatively independent fashion.

Still, the speed of technological progress has rendered various forms of legal tutorship rapidly obsolete, and the more recent strategy has focused less on purely technological data and more on other normative points of reference, such as the subject's nature (public versus private), the purposes of the data collection, and greater attention to new interactive technologies that expand circulation and increase the power of information ¹⁰. Law n. 12.527/2011 and recent administrative measures highlight the adoption of normative points of reference, with the exception of questions on the new interactive technologies, which have still received limited discussion and development under the Brazilian legislation.

The field of public health has extensive experience in the use of information to orient practices and policies. For decades, the Information Technology Department of the Unified National Health System (DATASUS) has maintained open and wide online access to epidemiological and healthcare data and vital statistics, while preserving the confidentiality of personal information. The recent Law on Access to Information ² provides both the legitimacy for this consolidated public information policy and the opportunity to expand the discussions and reflections on public information in health, besides improving mechanisms to ensure such access in this new democratic context with technological advancements.

The international experience suggests that this discussion should consider "the roots of power based on the availability of information and its real detainers” ¹⁰ (p. 19) and not shape regulation on the traditional and insufficient political and legal forms of "counter-power and control” ¹⁰, but to seek alternatives that allow all the potential of information and new information technologies in the protection of real subjects, from a perspective of expanding the possibilities for "redistribution of social and legal powers” ¹⁰ (p. 25), thereby legitimizing and ethically and legally justifying the right to access public information.

• 1.   Brasil. Constituição da República Federativa do Brasil. Brasília: Senado Federal; 1988.
• 2.   Batista CL. Informação pública: controle, segredo e direito de acesso. Intexto 2012; (26):204-22.
• ³
     Brasil. Lei ordinária n^o 12.527, de 18 de novembro de 2011. Regula o acesso a informações previsto no inciso XXXIII do art. 5^o, no inciso II do § 3^o do art. 37 e no § 2^o do art. 216 da Constituição Federal. Diário Oficial da União 2011; 18 nov.
• 4.   Brasil. Lei ordinária n^o 8.080, de 19 de setembro de 1990. Lei Orgânica da Saúde. Diário Oficial da União 1990; 20 set.
• 5.   Gruman M. Lei de acesso à informação: notas e um breve exemplo. Revista Debates 2012; 6:97-108.
• 6.   Dallari S. A justiça, o direito e os bancos de dados epidemiológicos. Ciênc Saúde Coletiva 2007; 12:633-41.
• 7.   Conselho Nacional de Saúde. Resolução CNS n^o 196, de 10 de outubro de 1996. Aprova as diretrizes e normas regulamentadoras de pesquisas envolvendo seres humanos. Diário Oficial da União 1996; 16 out.
• ⁸
     Council for International Organizations of Medical Sciences. International ethical guidelines for biomedical research involving human subjects. Geneva: Council for International Organizations of Medical Sciences; 2002.
• ⁹
     Ministério da Saúde. Portaria SAS/MS n^o 884, de 14 de dezembro de 2011. Estabelece o fluxo para cessão de dados dos bancos nacionais dos sistemas de informação – SI, sob a gestão da Secretaria de Atenção à Saúde – SAS. Diário Oficial da União 2011; 14 dez.
• 10. Rodotá S. A vida na sociedade da vigilância a privacidade hoje. Rio de Janeiro: Renovar; 2008.

Publication Dates

• Publication in this collection
  04 Apr 2013
• Date of issue
  Apr 2013