The Data Protection Act (LGPD – Law No. 13.709/2018) addresses personal data processing, including in digital media, by any individual or legal entity under public or private law, to protect the fundamental rights of freedom and privacy and the free development of the individual’s personality. Under the Law, personal data are information related to an identified or identifiable individual (art. 5-I of the LGPD).
According to the LGPD, personal data processing must be under good faith and the following principles:
I – purpose: processing done for legitimate, specific, and explicit purposes of which the data subject is informed, with no possibility of subsequent processing that is incompatible with these purposes;
II – adequacy: compatibility of the processing with the purposes communicated to the data subject, following the context of the processing;
III – necessity: limitation of the processing to the minimum necessary to achieve its purposes, covering data that are relevant, proportional, and non-excessive concerning the purposes of the data processing;
IV – free access: guarantee to the data subjects of facilitated and free-of-charge consultation about the form and duration of the processing, as well as about the integrity of their data;
V – data quality: guarantee to the data subjects of the accuracy, clarity, relevancy, and updating of the data, under the need and for achieving the purpose of the processing;
VI – transparency: guarantee to the data subjects of clear, precise, and easily accessible information about the carrying out of the processing and the respective processing agents, subject to commercial and industrial secrecy;
VII - security: use of technical and administrative measures that can protect personal data from unauthorized accesses and accidental or unlawful situations of destruction, loss, alteration, communication, or dissemination;
VIII – prevention: adoption of measures to prevent the occurrence of damages due to the processing of personal data;
IX – non-discrimination: Prohibition of processing for illegal or discriminatory purposes;
X – accountability: demonstration, by the data processing agent, of the adoption of measures that are efficient and capable of proving compliance with the rules of personal data protection, including the efficacy of such measures.
Furthermore, the LGPD outlines three key roles in safeguarding personal data: the controller, the processor, and the data protection officer.
The controller is an individual or legal entity under public or private law in charge of making decisions on personal data processing.
The processor is an individual or legal entity under public or private law, who performs the personal data processing on behalf of the controller.
Lastly, the data protection officer is someone appointed by the controller and processor to act as a link between the controller, the data subjects, and the National Data Protection Authority (ANPD).
The LGPD guarantees ownership over personal data to data subjects, safeguarding the fundamental rights of freedom, intimacy, and privacy.
In turn, art. 18 provides for the data subject’s rights as follows:
Art. 18. The data subject, regarding the data subject’s data being processed by the controller, at any time and by means of request, has the right to obtain the following from the controller:
I – confirmation of the existence of processing;
II – access to the data;
III – correction of incomplete, inaccurate, or out-of-date data;
IV – anonymization, blocking, or deletion of unnecessary or excessive data or data processed in noncompliance with the provisions of this Law;
V – portability of the data to another service provider or product provider, by means of an express request, pursuant to the regulations of the national authority, and subject to commercial and industrial secrets;
VI – deletion of personal data processed with the consent of the data subject, except in the situations provided in Art. 16 of this Law;
VII – information about public and private entities with which the controller has shared data;
VIII – information about the possibility of denying consent and the consequences of such denial;
IX – revocation of consent as provided in §5 of Art. 8 of this Law.
Paragraph 1. The personal data subject has the right to petition, regarding her/his data, against the controller before the national authority.
Paragraph 2. The data subject may oppose the processing carried out based on one of the situations of waiver of consent, if there is noncompliance with the provisions of this Law.
Paragraph 3. The rights provided in this article shall be exercised through an express request by the data subject or her/his legally constituted representative to the processing agent.
Paragraph 4. If it is impossible to immediately adopt the measure mentioned in §3 of this article, the controller shall send a reply to the data subject in which she/he may:
I – communicate that she/he is not the data processing agent and indicate, whenever possible, who the agent is; or
II – indicate the reasons of fact or law that prevent the immediate adoption of the measure.
Paragraph 5. The request as mentioned in §3 of this article shall be fulfilled without costs to the data subject, within the periods and the terms as provided in a regulation.
Paragraph 6. The controller shall immediately inform the processing agents with which she/he has carried out the shared use of data of the correction, deletion, anonymization, or blocking of data, so that they can repeat an identical procedure, except in cases in which this action is proven impossible or involves disproportionate effort.
Paragraph 7. The portability of personal data referred to in item V of the lead sentence of this article does not include data that have already been anonymized by the controller.
Paragraph 8. The right referred to in §1 of this article may also be exercised before consumer defense entities.
The data subject’s rights may be exercised at: https://portal.tcu.gov.br/ouvidoria/
The Federal Court of Accounts can process personal data in four situations: external control activities, services to society, training actions, and internal administrative activities.
External Control Activities:
External Control Activities refer to the actions performed to fulfill TCU's constitutional and legal responsibilities stated in articles 70-75 of the Federal Constitution, particularly art. 71, as well as in the relevant legislation. According to art. 71 of the Federal Constitution:
Art. 71. External control, incumbent on the National Congress, shall be exercised with the aid of the Federal Audit Court, which shall:
I – examine the accounts rendered annually by the President of the Republic, by means of a prior opinion which shall be prepared in sixty days counted from receipt;
II – evaluate the accounts of the administrators and other persons responsible for public monies, assets, and values of the direct and indirect administration, including foundations and companies instituted and maintained by the Federal Government as well as the accounts of those who have caused a loss, misplacement or other irregularity resulting in losses to the public treasury;
III – examine, for registration, the lawfulness of acts of admission of personnel, on any account, in the direct and indirect administration, including the foundations instituted and maintained by the Federal Government, with the exception of the appointments to commission offices, as well as the granting of civil and military retirement and pensions, except for subsequent improvements which do not alter the legal fundaments of the conceding act;
IV – carry out, on its own initiative or on that of the Chamber of Deputies, of the Federal Senate, or of a technical or inquiry committee, inspection and audits of an accounting, financial, budgetary, operational or property nature in the administrative units of the Legislative, Executive and Judicial Powers and other entities referred to in item II;
V – control the national accounts of supranational companies in whose capital stock the Union holds a direct or indirect interest, as set forth in the acts of incorporation;
VI – control the use of any funds transferred by the Union, by means of an agreement, arrangement, adjustment or any other similar instrument, to a state, the Federal District or a municipality;
VII – render the information requested by the National Congress, by either of its Houses or by any of the respective committees concerning accounting, financial, budgetary, operational and property control and the results of audits and inspections made;
VIII – in case of illegal expenses or irregular accounts, apply to the responsible parties the sanctions provided by law, which shall establish, among other comminations, a fine proportional to the damages caused to the public treasury;
IX – determine a period of time for the agency or entity to take the necessary steps for the strict compliance with the law, if an illegality is established;
X – if not heeded, stop the execution of the impugned act, notifying the Chamber of Deputies and the Federal Senate of such decision;
XI – present a formal charge to the competent Power on any irregularities or abuses verified.
Paragraph 1. In the case of a contract, the restraining act shall be adopted directly by the National Congress, which shall immediately request the Executive Power to take the applicable measures.
Paragraph 2. If the National Congress or the Executive Power, within ninety days, do not take the measures provided for in the preceding paragraph, the Court shall decide on the matter.
Paragraph 3. Decisions of the Court resulting in the imposition of a debt or fine shall have the effectiveness of an execution instrument.
Paragraph 4. The Court shall, quarterly and annually, forward to the National Congress a report on its activities.
Besides the constitutional provisions, the TCU has other duties mandated by legislation, such as Law No. 8.443/1992 (Organic Law of the Federal Court of Accounts).
Art. 1. The Federal Court of Accounts - Brazil (Tribunal de Contas da União – TCU), an external control body, has the following mandates according to the Federal Constitution and as established in this Law:
I – to judge the accounts of managers and other authorities in charge of public moneys, goods and values of the units of the Federal branches, as well as entities of the indirect administration, including foundations and societies established and supported by the federal public power, as well as the accounts of those that cause loss, misappropriation or any other irregularity resulting in damage to the Public Treasury;
II – perform, of its own initiative or upon request by the National Congress, its Houses or respective committees, accounting, financial, budgetary, performance and assets audits of the units of the Federal Government branches and other entities referred to in sub-paragraph I above;
III – analyze the annual rendering of accounts by the President of the Republic, according to Article 36 herein;
IV - monitor collection of revenue under the responsibility of the Federal Government and of the entities referred to in sub-paragraph I above, through inspections and audits, or by examining specific statements as set forth in the Internal Regulation;
V - for the purposes of registration as set forth in the Internal Regulation, analyze the legality of the acts of admission of personnel, in any capacity, in the direct and indirect administration. This includes admissions in foundations established and supported by the federal public power, except for the appointments to at-will positions. Analyze concession of retirement, reforms and pensions, except their further improvements that do not change the legal basis of the concession act;
VI – observing the pertinent legislation, calculate the quotas of the participation funds referred to in the sole paragraph of Article 161 of the Brazilian Federal Constitution, overseeing the delivery of the respective resources;
VII – in accordance with Paragraph 2 of Article 33 of the Brazilian Federal Constitution, issue a preliminary report on the accounts of the Federal Government within sixty days of receiving said report, as set forth in the Internal Regulation;
VIII – report to the competent power any irregularity or abuse observed, stating the wrongful act and defining the responsibilities, including those of the Minister of State or of an authority at equivalent hierarchic level;
IX – apply to the responsible authorities the sanctions provided for in Articles 57 to 61 of this Law;
X – draft and change its Internal Regulation;
XI – elect its President and Vice-President and put them in office;
XII – grant leave, vacation and other legal periods of absences to ministers, auditors and members of the General Public Prosecutor’s Office within the Court. Sick leave will depend on an examination by a medical body if the leave exceeds six months;
XIII – propose to the National Congress the establishment of remuneration for ministers, auditors and members of the General Public Prosecutor’s Office within the Court;
XIV – organize its Secretariat, according to the Internal Regulation, and established its positions and jobs, observing the applicable legislation;
XV – propose to the National Congress the creation, transformation and abolishment of positions, jobs and at-will positions of the staff of its secretariat, and set the respective remunerations;
XVI – make decisions regarding denouncements reported to it by any citizen, political party, association or trade union, as provided for in Articles 53 to 55 of this Law;
XVII – make decisions regarding consultations made by a competent authority that has doubts regarding application of legal and regulatory provisions concerning any matter under its mandate, as established in its Internal Regulation.
In addition to the constitutional provisions of the Organic Law of the TCU, other laws can impose responsibilities on the TCU.
The TCU processes personal data in external control activities solely to achieve its public purpose and fulfill its constitutional and legal duties; consent from the data subject is not required, as per the Data Protection Act, Article 7-III and Article 23-I.
The General Secretarial of External Control (Segecex) is in charge of planning and executing the External Control activities at the TCU.
The data processing duration is uncertain since the TCU's mission and duties must not be disrupted.
The processing practices and procedures utilize audit techniques, including document examination, data extraction, data matching, and interviews.
Services Offered to Society
The TCU provides various services to the public, all of which require authentication. These services include:
-
Access the portal content with a subscription
-
Electronic protocol
-
Support systems for external control
-
Registration of accountable agents in external control procedures
-
Registration of legal representatives in external control procedures
-
Registration of stakeholders in external control procedures
-
Access to case files (for attorneys)
-
Requests to the Office of the Ombudsman
Electronic registration with the Court is required to access these services and obtain information. To ensure proper authentication, users are requested to provide information such as name, email, Individual Taxpayer Identification Number (CPF), address, telephone number, professional qualification, and copy of identification document, among others. Once provided, users are given a login and password.
Foreign citizens are required to provide information registered in their country of origin. Additionally, there may be a need to provide academic curriculum vitae information for selective processes, to collaborate or participate in courses and events. Some information may be obtained from sources available in other governmental registers and made available to the Court following the applicable legislation. However, if the user wishes, he or she may access, edit, and rectify those data whenever they are incomplete, out-of-date, or inaccurate (art. 18 of the Data Protection Act – LGPD).
Our purposes in collecting data
Personal data usage always follows current legislation and prioritizes safe delivery of services to citizens, strictly aligned with their requests. Hence, the data is used in accordance with the following purposes.
-
Keeping citizens informed about the topics they registered for, such as session agendas, case updates, and responses to Ombudsman Office requests, information on the participation in educational activities and events promoted by the Serzedello Corrêa Capacity Development Institute (ISC), among others
-
Access log, attendance, and activities control within educational environments, to assess participation and learning;
-
Compliance with legal determinations, such as the exercise of external control (art. 71 and following of the Federal Constitution), compliance with requests made under the Access to Information Act (Law No. 12.527/2011), as well as the guarantee of participation, protection, and defense of public service users’ rights (Law No. 13.460/2017);
The data is also used to provide a personalized user experience and gather usage statistics.
With whom we share
Data entered on the portal for registration purposes are not shared with bodies or entities external to the Court, except for data related to courses offered in collaboration with other organizations.
Additionally, the Court does not condone or permit the sharing of information for illicit, abusive, or discriminatory purposes.
Training Initiatives
The Serzedello Corrêa Capacity Development Institute (ISC) is the TCU School of Government and operates in the fields of education, information, innovation, and culture, building knowledge to enhance the performance of External Control and improve Public Administration.
It was established by art. 88 of the Law No. 8.443/92, which states:
Art. 88. It is hereby created in the secretariat an institute directly subordinated to the Presidency, which will be in charge of:
I – Promoting periodic public contests of exams or of exams and titles to select candidates for the training courses required to join the careers of the Court staff;
II – The organization and delivery of courses to train university and high school level candidates selected through the contests referred to in sub-paragraph I above who must be approved in the training phase;
III – The organization and delivery of training and specialization courses for staff members;
IV – The promotion and organization of symposia, seminars, papers and research about issues related to the public administration control techniques;
V – The organization and administration of a library and documentation center, both national and international, about doctrine, techniques and legislation concerning control and similar issues.
Sole paragraph. The Court will issue a resolution to regulate the organization, the duties and working norms of the institute referred to in this article.
In line with its institutional mission, the ISC collects, stores, and uses personal data of students and other service users. Click here to learn how the ISC collects and processes personal data (text in Portuguese).
Internal Administrative Activities
The Segedam (General Secretariat of Administration) handles internal administrative activities tasks for the Court and manages the administrative information systems for recording several types of transactions with the target populations of its core activity. The public consists mainly of civil servants, authorities, retirees, pensioners, interns, outsourced collaborators, and the general public.
Segedam, as the primary administrative body of the Court, is responsible for handling the personal data of individuals who have a daily connection with the TCU. The data is distributed across different information systems used at the Court. They are listed below, together with the description of the main personal data that are processed by such systems.
-
Personnel Management Systems (GRH, CESP): they store information on the identification of civil servants, authorities, pensioners, and retirees, as well as documents, addresses, telephone numbers, employee health-related data, ethnical and racial information, contact information, and email, and financial information, whenever it involves any kind of relation between the individual and the Court.
-
Payment System: it records the financial personal information of civil servants, retirees, pensioners, interns, and authorities.
-
Salary Loan System: it records data on salary loans taken out by civil servants, retirees, and pensioners. It also tracks loan limits and repayment through payroll deductions, while sharing data with the relevant financial institutions.
-
Access Control System: It keeps image and biometric data for attendance records of civil servants, retirees, interns, and outsourced staff. It also records access to facilities at the TCU and the ISC by these individuals and outside visitors.
-
Health Management System: It keeps information on the health of active/inactive employees, dependents, and authorities, among others, patient service and tests, health records (medical, dental, nutritional), and first aid assistance (urgent care and emergency room service). Health data are sensitive, confidential, and protected information, the access to which is given only to the patient (if requested) and to health professionals in the exercise of their duties.
-
Active Persons Re-registration System: It keeps personal data on identity, parent information, dependents, addresses, telephone numbers, and personal documents, for periodical updates of the human resources system by the civil servants, authorities, and their dependents.
-
Medical/Dental Leave Management System: It maintains records of leaves for medical treatment (either the employee’s or a family member’s), including accidents and pregnancy-related leave (abortion and stillbirth cases) for managing forensic activities and tracking the employee's health history and functional life.
-
Trial Work Period System: It keeps personal data on the performance evaluation of employees during the trial work period.
-
Student Internship Management System: It keeps the personal data of students who signed student internship agreements with the Court, regarding registration, performance, and internship payment.
-
Contract Management System: It keeps personal data on the identification of outsourced collaborators who are connected to service-providing legal entities that are contracted by the Court.
-
CASA System: It stores information on the identification of civil servants, authorities, pensioners, retirees, outsourced staff, and interns, besides addresses, telephone numbers, contact information, email, and personal documents necessary for administrative purposes.
-
e-TCU Administrativo: It keeps the personal data of active civil servants, retirees, or pensioners who are stakeholders within a given case. The personal data and all collected information on active and inactive civil servants as well as pensioners may be accessed, treated, processed, reproduced, edited, translated, uploaded, downloaded, adapted, and entered on new systems, applications, and software, directly by the TCU or by third parties duly authorized by the TCU.
The data collected by the General Secretariat of Administration are used for compliance with its legal and contractual obligations. Regarding active and inactive civil servants and pensioners, the data is notably used for the following purposes:
-
Compliance with obligations related to the income tax (Decree No. 9580/2018), the actuarial legislation of the Specific Regime of Social Security– RPPS for Federal Government civil servants (Law No. 9.717/1998), the e-Social system (Decree No. 8373/2014), the Gfip (Law No. 9.528/97), and labor legislation;
-
telephone calls, sending of communications, notices, messages, surveys, and other information by email or messaging applications;
-
registration and confirmation of registration for access and use of the resources, functionalities, and tools available on the website, applications, and platforms used by the TCU
Access to data collected from interns, active civil servants, retirees, and pensioners is given only to TCU civil servants and collaborators authorized to use those data.
Requests for anonymization, lock, or removal of personal data that are unnecessary, excessive, or processed in defiance of the legislation in force must be sent to Segedam through a reasoned request, which will be granted provided that they do not violate any legal obligation.
