Feira de Santana faces 6 ANPD warnings for naming 611 people with HIV

Brazil's data protection regulator has recommended six formal warnings, a 180-day notice on the city's own homepage and a list of corrective orders against the municipality of Feira de Santana, in the state of Bahia, which published the names and transit card numbers of 1,241 people living with HIV, sickle cell anaemia or fibromyalgia in its official gazette on September 20, 2025. The 32-page investigation report, signed on October 9, 2026, by the Sanctions General Coordination of the Agência Nacional de Proteção de Dados (ANPD), classifies all six infringements as serious. It still cannot fine the city. Brazil's General Personal Data Protection Law (LGPD) leaves fines out of the sanctions available against public bodies.

In Short

A city in Brazil printed a list in its official newspaper that named more than 1,200 people and revealed that they had HIV, sickle cell anaemia or fibromyalgia, because it wanted to tell them their free bus pass was being cancelled. Brazil's privacy regulator says the city broke six rules, from failing to protect the data to failing to tell the people affected or the regulator, and one person reportedly lost a job afterwards. The law does not let the regulator fine a city government, so its investigators want warnings, a public admission on the city's website and a set of deadlines to change how the city handles personal data.

What the document is

The document is Relatório de Instrução (PUB) No. 3/2026/CGS/SFI, filed under process 00261.004315/2025-11. It is the public version of an investigation report, with the names of several witnesses redacted under Article 31 of Law 12,527/2011, Brazil's access to information law. Amanda Muniz Oliveira, the General Coordinator of Sanctions, signed it electronically at 14:23 Brasília time on October 9, 2026. Two staff members, Kaique Afonso Costa de Souza and William Coser Stoffels, signed the same afternoon.

An investigation report is not the final word. Under Article 54 of the ANPD's inspection regulation, it supports the first-instance decision, and the document closes by sending the case to the Superintendent of Inspection for that decision. Once a decision is issued, the municipality is to be notified and given 10 business days to comply or appeal, and the decision is to be published in the Diário Oficial da União, the federal gazette.

The numbering places the case in a short series. In August, Investigation Report No. 2/2026 from the same coordination recommended R$ 153.7 million in fines against ByteDance over the data of children on TikTok. The Feira de Santana report reaches a very different sanction for reasons that have nothing to do with the severity of the conduct.

On October 26, 2026, several Brazilian outlets, among them Aratu On and Acorda Cidade, reported that the ANPD had sanctioned the city. None of those reports cites a decision number or date. According to Aratu On, the municipal Attorney General's Office said it was waiting to receive the ANPD's official notification and would take the appropriate steps once it had analysed the document.

The report also records an institutional change. A footnote explains that Decree No. 12,881 of March 18, 2026, restructured the regulator on its conversion from the Autoridade Nacional de Proteção de Dados into the Agência Nacional de Proteção de Dados, and created the Sanctions General Coordination that now handles sanctioning proceedings. Resolution CD/ANPD No. 33 of April 6, 2026, completed the reorganisation.

How 1,241 names reached the gazette

The list was a by-product of litigation over bus fares. Feira de Santana granted a "passe livre", a free pass on municipal public transport, to people living with HIV under a provisional injunction issued on January 22, 2016, in a case brought by the Bahia State Public Defender's Office. According to the report, the court later rejected the Defender's claims and revoked that injunction; the judgment cited in the footnotes, from the 2nd Public Treasury Court of Feira de Santana, is dated June 9, 2025. In a separate case, a court suspended, with effect from that point onwards, Municipal Law 4,278/2025, which had extended the same benefit to people with sickle cell anaemia and fibromyalgia.

To implement the suspensions, the Municipal Urban Mobility Secretariat (SEMOB) published ordinances in the Diário Oficial do Município on September 20, 2025. They listed, by condition, every beneficiary whose pass would be cancelled, with full names and free pass card numbers. A complaint filed with the ANPD two days later spoke of more than 600 people with HIV. The municipality's own internal investigation file gives the precise count:

• People living with HIV/AIDS: 611
• People with fibromyalgia: 346
• People with sickle cell anaemia: 284

The total is 1,241 people. Because each list was organised by diagnosis, anyone who found a name also learned a health condition.

The gazette edition stayed online for a few hours, a point the ANPD accepts. SEMOB attributed the publication to a "system failure" without explaining its technical nature, while the city's formal defence spoke of "human error" because the wrong document had been included. A public note acknowledging the publication appeared on the municipality's website on September 21, 2025, at 14:51.

The complaint, registered on September 22, 2025, as No. 100000446/2025/CGF/ANPD, attached three screenshots: the city's public note and reports by CNN Brasil and G1. On September 24, the ANPD's monitoring division contacted the city and asked it to name its data protection officer or legal representative within five days. That request, according to the report, went unanswered. The ANPD's incident-handling unit also confirmed that it had no record of any incident notification from Feira de Santana.

The regulator opened sanctioning proceedings and issued Infraction Notice No. 3/2025/FIS/CGF on October 20, 2025. It reached the city by post on October 30. The municipality filed its defence on November 13, 2025, and its final arguments on February 9, 2026.

A bus operators' lawyer in the drafting chain

The most unusual section of the report concerns who prepared the ordinances. It draws on testimony gathered by the city's own internal inquiry, which the ANPD obtained in two batches after asking for the documents the inquiry's final report referred to.

According to the report, the ordinances were drafted by a lawyer retained by Via Feira, the association formed by the bus companies that operate Feira de Santana's public transport. The ANPD describes Via Feira as "the party most interested in the immediate suspension of the free pass benefits." Emails in the file show the lawyer sending the draft ordinances from her personal email address to SEMOB for publication, with the then secretary, Sérgio Carneiro, in copy.

The city's Deputy Attorney for Administrative Probity told the inquiry that, once the court decisions came out, SEMOB phoned him informally to say it was "receiving high pressure from the company VIA FEIRA to carry out the cancellation of the free passes." He also told the inquiry that, after gathering the documents on the matter, he was surprised to learn that the lawyer possibly had no direct or indirect link to the public administration: apparently she was not a career civil servant, held no appointed post and was not an outsourced worker, since Via Feira had no outsourcing contract with the city or with SEMOB.

The lawyer, questioned by the same inquiry, said she audited free pass grants on a day-to-day basis and reviewed court cases and documents for pass applications. Her placement at SEMOB, she said, followed a meeting between bus company representatives and the secretary, who agreed on the need for her work "in view of the growing demand for benefit grant processes, impacting the economic-financial balance of the concession contracts."

An outsourced lawyer working in the Attorney General's Office gave the inquiry a different account of what legal advice had been on the table. Her opinion, she said, was that SEMOB "should notify these beneficiaries individually", giving them the right to a defence. She stated that the HIV, fibromyalgia and sickle cell anaemia ordinances never reached her for legal review, although she is the person responsible for reviewing ordinances and decrees, and that at no point was any guidance given to publish a list of names.

The ANPD draws two legal conclusions. It treats the informal access granted to the Via Feira lawyer at SEMOB and the Attorney General's Office as, "in practice, an irregular sharing of data with a private entity", in breach of Article 26, paragraph 1, of the LGPD, which bars public authorities from transferring personal data held in their databases to private entities. It also finds a conflict of interest within the meaning of Law 12,813/2013. The pressure from Via Feira, the report says, led the city to set aside individual and direct alternatives "in favour of a solution that primarily served the private interests of the company."

Six infringements

The report lists six conducts and assesses each against the evidence. All six were later classified as serious.

Purpose and legitimate expectations

The first finding concerns the purpose principle in Article 6, I, of the LGPD. People with HIV, fibromyalgia and sickle cell anaemia supplied their diagnoses first to SEMOB and then to the courts, for one reason: to obtain a free bus pass. The city never identified a legal basis for publishing those diagnoses in its gazette, a burden that the report says rested on the municipality.

To test whether the later use was compatible with the original purpose, the investigators applied criteria from an ANPD guide on processing for academic research: the nature of the data, the legitimate expectations of the people concerned, the LGPD's principles, the security measures in place and applicable ethical standards. Health information sits in the category the LGPD calls sensitive personal data, the counterpart of what European law calls special category data. Nobody who applied for a bus pass, the report argues, could reasonably have foreseen the publication of their name in an official gazette to tell them the pass was ending.

A second statute weighs more heavily. Law 14,289/2022 makes confidentiality mandatory about the condition of people living with HIV, chronic hepatitis B and C, leprosy and tuberculosis, including within the public administration and in court proceedings. The report concludes that the city's processing "is illegal, for frontally violating Law 14,289/2022, regardless of any eventual definition of a legal basis for carrying out the processing." It also cites Law 12,984/2014, which makes discrimination against people living with HIV a crime.

Transparency and the missing officer

The second finding concerns transparency under Article 6, VI. Public bodies covered by the access to information law must appoint a data protection officer, known in Brazil as the encarregado, under Article 23, I, of the LGPD, and Resolution CD/ANPD No. 18 of July 16, 2024, requires the officer's details to be published prominently on the controller's website. In its defence, the city presented the appointment of an officer as one of the measures it was still putting in place. The ANPD read that as evidence that no officer existed.

The report adds that months after the incident, once the deadline for its internal inquiry had run out after an earlier extension, the city remained silent towards residents, ignoring requests to release the results and to act on behalf of the people affected, even after city councillors raised the matter in the Municipal Chamber.

Discrimination without intent

The third finding, under the non-discrimination principle in Article 6, IX, rejects the defence's description of the episode as "a fortuitous and unexpected event resulting from human error." The report states that "the discriminatory potential does not require an explicit intention to discriminate; it is enough that the processing produces or enhances discriminatory situations to the detriment of the data subjects."

Two pieces of evidence support the finding. The president of the Association of Relatives, Friends and People Living with HIV/AIDS, Josefa Faria dos Anjos, is quoted in the report: "Many of the people affected had not revealed their condition even to family members, which makes the episode even more delicate." She also identified at least one case in which a person on the list lost their job after the publication, a report the ANPD takes from a local blog dated September 25, 2025. On that basis, the investigators write that harm materialised "to its maximum extent, even if only in relation to that individual."

Security, prevention and accountability

The fourth finding is the broadest. It combines the principles of security, prevention and accountability in Article 6, VII, VIII and X, with the security duties in Articles 46, 47 and 49. The report stresses that these obligations operate before an incident, not after it. Of all the steps the city said it was taking, only the opening and closing of the internal inquiry was proven, and every other measure, planned after the incident, was corrective rather than preventive.

The investigators found no information security policy and no formal incident response plan, measures the ANPD recommends even to small processing agents, and which the report says a large municipal body processing high-risk data should have treated as a minimum. The city's own inquiry described "a systematic failure in the entire process of publishing the said ordinances", adding that across all the departments the documents passed through, "no public agent took care to verify that the content of such publications contained sensitive data, which could therefore have been subjected to the appropriate anonymisation treatment."

The report also criticises a workflow built on email and attachments. It cites a decision of Italy's Garante per la protezione dei dati personali of April 29, 2025, which sanctioned the Comune di Bologna €40,000 under the GDPR after an unchecked email forwarded a spreadsheet with the names and health data of 61 children, holding that "human error" did not exempt the controller from its duties of diligence and governance.

On the defence's point that the gazette was online for only a few hours, the report answers that content published on the internet spreads irreversibly. It cites a University of Juiz de Fora article for the claim that such content spreads 70% faster than verified information, a figure that comes from research on misinformation and is applied here by analogy. A single screenshot or forwarded WhatsApp message, the investigators write, is enough for the information to escape the original controller permanently.

The investigators also fold the Via Feira episode into this finding. A data protection structure, they write, must include mechanisms to stop agents with significant private interests from accessing, guiding or interfering in decisions about processing, "especially when dealing with sensitive personal data."

Irregular processing

The fifth finding applies Article 44, which defines processing as irregular when it breaks the law or fails to provide the security a data subject can expect. The report treats the publication as an "internal fortuitous event", foreseeable from within the city's own operations, and notes that the techniques that could have prevented it, from a written security policy to prior review and anonymisation, were available and in many cases cheap. "The absence of anonymisation, prior review and a structured system cannot be justified by technical or budgetary limitations," the report states.

Notification: 22 letters for 1,241 people

The sixth finding concerns Article 48, which requires controllers to notify the ANPD and the people affected of a security incident that may cause relevant risk or harm. Feira de Santana notified neither. The ANPD learned of the incident only through a third-party complaint, and the city's first formal statements to the regulator came after the sanctioning process opened on October 20, 2025. Even then, according to the report, its defence did not contain the minimum information an incident notification must carry.

Brazil's Security Incident Communication Regulation, approved by Resolution CD/ANPD No. 15 of April 24, 2024, sets a deadline of three business days from the moment the controller learns that an incident affected personal data. The notice must include at least seven elements: the nature and categories of data affected, the security measures used, the risks and likely impacts, the reasons for any delay, the mitigation measures, the date the controller learned of the incident and a contact point, including the officer's details where applicable. Notification to individuals must be direct and individual, through the channels the controller normally uses, such as telephone, email, electronic message or letter. A notice on a website or social media is reserved for cases where direct contact is not feasible or the people affected cannot be identified.

The city's public note did not meet that standard, the report finds, and there was no question that the people affected could be identified: their names were the problem. Of the 1,241 people, the internal inquiry file shows that the city attempted to notify 22 by post, or 1.77% of the total. The same file records an alternative that was discussed internally: hiring the postal service, or using SEMOB's own resources, to notify beneficiaries in person, as the municipal finance secretariat had done in July 2025, when around 5,000 summons for a conciliation drive were hand-delivered by hired cars and motorcycles.

The report also finds no detail in the file on the psychological support the city said it offered, nor any count of how many people received it or how it was publicised. It notes that the supposed difficulty of contacting these people was one of the factors behind the publication in the first place.

Drawing on the work of Danielle Citron and Daniel Solove, the investigators identify five of seven categories of privacy harm in the case: reputational, psychological, autonomy, discriminatory and relational.

Serious, but no fine

Under Resolution CD/ANPD No. 4 of February 24, 2023, the dosimetry regulation, an infringement is serious when it meets the test for a medium infringement and at least one aggravating circumstance applies. The report finds two for every conduct: the processing of sensitive data, under Article 8, paragraph 3, I, item "d", and unlawful or abusive discriminatory effects, under item "f".

For a serious infringement, Article 10 of the dosimetry regulation points to a simple fine. The investigators set that aside. Article 52, paragraph 3, of the LGPD, which lists the sanctions applicable to public entities and bodies, leaves out fines and daily fines, which the report reads as excluding them "by omission". The available alternatives are a warning, which Article 9 of the dosimetry regulation permits when a corrective measure is needed, and publicisation, under Article 20, in which the infringer itself must publish the infringement at its own cost.

The investigators also rejected the heavier non-monetary sanctions in Articles 22 to 26: blocking or deleting the data, or suspending the database or the processing activity. The processing, they write, is necessary for public policies in health and social assistance, and halting it "would compromise the continuity of essential public services" and could cause even greater harm to the people concerned.

The outcome has an ironic edge. In its defence, the municipality asked that any sanction be set at the minimum level, "preferably a warning." It now faces six warnings, five of them combined with corrective measures that add up to more than a dozen separate obligations. The contrast with the private sector is stark: in the ByteDance case, the same coordination applied fines calculated against a ceiling of 2% of Brazilian revenue, up to R$ 50 million per infringement.

What the city must do, and when

All deadlines run from formal notification of the first-instance decision. Proof of compliance is generally due within five business days after each deadline.

The data-sharing rule

The internal rule the city must adopt has four required parts: who may authorise sharing between departments, a mandatory prior technical and legal review, minimum requirements on purpose, legal basis, duration and security, and a ban on generic or "mass" sharing without specific justification, with particular protection for sensitive data. Each recorded sharing flow must describe which data move, in what format and from which source, along with the specific public purpose and the legal basis under Article 7 or Article 11 of the LGPD.

The impact reports

The data protection impact reports must cover every operation involving sensitive data for granting, managing, maintaining, inspecting or reviewing transport benefits linked to health conditions or disability. They must set out the types of health data, the categories of people concerned, the purpose and legal basis of each operation, the full data flow from collection to deletion, the risks of discrimination, stigmatisation and material or moral harm, and the safeguards the city has adopted or will adopt, such as anonymisation, pseudonymisation, data minimisation and access reviews. The incident response plan must cover detection, internal communication, criteria for notifying the ANPD and individuals, containment and recovery, and a log of every incident.

180 days on the homepage

The publicisation order requires a notice on the first page of the municipality's website, feiradesantana.ba.gov.br, for 180 days. The report prescribes the text, which opens: "The Municipal Government of Feira de Santana - BA, in compliance with the decision issued by the National Data Protection Agency (ANPD), announces that it has been administratively sanctioned for infringing the General Personal Data Protection Law (Law No. 13,709/2018 - LGPD)." The notice must list all six infringements, including the "public exposure of legally confidential personal data, which constitutes processing of personal data for unlawful or abusive discriminatory purposes." To prove the notice stayed up, the city must file six dated screenshots, one at the end of each 30-day period.

Individual notices

The individual notices follow a template in the report. Each must state the date the city learned of the incident, describe the data exposed - full name, benefit card number and health condition - and explain why no notice was given at the time. The template warns of risks including embarrassment, discrimination based on health information and misuse by third parties, "such as scam attempts, including by telephone call." The city must then file a spreadsheet listing every person notified, with the date and the contact details used, which the Sanctions General Coordination will check by sampling. Where contact details are missing, the notice text must be added to the homepage announcement.

Gaps in the record

The report contains several inconsistencies. Its identification table lists a "sectoral" data protection officer for the municipality, with a name and an email address, while the analysis concludes that no officer had been appointed. The city's internal inquiry carries two numbers: No. 61310/2025 in the list of references and No. 966/2025, from the Mayor's Office, in the body. The footnotes attribute Ordinance No. 20/2025 to both the sickle cell anaemia list and the HIV list. And the corrective measures for the fourth conduct are lettered "a", "a" and "c", while the proof section refers to items "a", "b" and "c". None of these points changes the findings.

Why it matters for the marketing community

The case involves a city government, a bus pass and a gazette, not an advertising platform. The reasoning, however, is the ANPD's own reading of rules that apply to every controller in Brazil, private companies included, and several elements bear directly on how health and other sensitive data move through marketing systems.

The regulator has been explicit about where its attention lies. When the ANPD approved its 2026-2027 enforcement priorities on December 22, 2025, the data subject rights theme singled out biometric, health and financial data, and the plan included five enforcement activities on the secondary use of data for targeted advertising. The Feira de Santana report sets out at length how the ANPD tests secondary use: the nature of the data, what the person could reasonably expect when handing it over and whether the new use is compatible with the original purpose. It also states that discriminatory effects do not depend on intent.

The notification standard is another point of general relevance. The report treats a website notice as an exception, permissible only when individuals cannot be reached or identified, and requires individual notices to be provable. Its rejection of the "human error" defence, supported by the Italian Garante's Bologna decision, places the weight on structural safeguards rather than on the mistake of a single employee.

Brazil's broader regulatory position is also at stake. When the European Data Protection Board assessed Brazil's adequacy in November 2025, it asked the European Commission to monitor how incident notification works in practice and noted that the LGPD does not clearly require impact assessments for high-risk processing. Here, the ANPD orders both: individual incident notices and impact reports for the sensitive data at issue.

The ANPD's enforcement has accelerated in 2026. Its Inspection Superintendence gave Discord three business days in August to suspend its Go Live feature for users in Brazil, and the ByteDance report recommended fines across five conducts. The Feira de Santana case shows the limits of that toolbox when the controller is a public body, a constraint not shared by every jurisdiction: Portugal's data regulator issued just two fines in 2025, one of them against a local government entity.

Health data has been a steady theme in privacy enforcement elsewhere. Italy's Garante fined IQVIA €7 million over data on about one million patients that the company had treated as anonymous. Sweden's regulator fined the pharmacies Apoteket and Apohem a combined SEK 45 million after Meta's tracking pixel sent customer purchase data, including sexual health products, to Meta. Grindr agreed to pay £26 million to settle a UK claim alleging it shared users' data with advertising companies, in some cases including HIV status, without admitting liability. And in California, a data broker was fined $45,000 for failing to register while selling lists of people grouped by health condition.

Lists of people grouped by diagnosis are a familiar product in parts of the data market. The Feira de Santana report shows what Brazil's regulator concludes when such a list reaches the public, even for a few hours, and even when the publisher is a city that cannot be fined.

Timeline

• January 22, 2016 - A provisional injunction grants a free transport pass to people living with HIV in Feira de Santana.
• April 29, 2025 - Italy's Garante sanctions the Comune di Bologna €40,000 over a forwarded email with health data of 61 children.
• June 9, 2025 - Date of the judgment cited by the report that rejects the Public Defender's claims and revokes the 2016 injunction.
• July 2025 - Feira de Santana's finance secretariat hand-delivers about 5,000 summons for a conciliation drive.
• September 20, 2025 - SEMOB publishes ordinances in the municipal gazette naming 1,241 free pass holders by condition.
• September 21, 2025 - The city posts a public note at 14:51 acknowledging the publication.
• September 22, 2025 - A complaint is filed with the ANPD.
• September 24, 2025 - The ANPD asks the city to name its data protection officer within five days; no answer follows.
• September 25, 2025 - A local blog reports that a man on the HIV list was fired.
• September 26, 2025 - The city opens an internal inquiry.
• October 20, 2025 - The ANPD opens sanctioning proceedings and issues Infraction Notice No. 3/2025/FIS/CGF.
• October 30, 2025 - The notice reaches the city by post.
• November 4, 2025 - The EDPB adopts its opinion on Brazil's adequacy, flagging breach notification and impact assessments.
• November 13, 2025 - The city files its defence.
• December 22, 2025 - The ANPD approves its 2026-2027 enforcement priorities, naming health data.
• February 9, 2026 - The city files its final arguments.
• March 18, 2026 - Decree No. 12,881 restructures the regulator as the Agência Nacional de Proteção de Dados.
• April 6, 2026 - Resolution CD/ANPD No. 33 completes the reorganisation.
• August 12, 2026 - The ANPD orders Discord to suspend Go Live in Brazil.
• August 24, 2026 - Investigation Report No. 2/2026 recommends R$ 153.7 million in fines against ByteDance.
• September 23, 2026 - Italy's Garante adopts its €7 million decision against IQVIA.
• October 9, 2026 - The Sanctions General Coordination signs Investigation Report No. 3/2026, recommending six warnings against Feira de Santana.
• October 26, 2026 - Brazilian outlets report the sanctions; the city's Attorney General's Office says it awaits official notification.

Related PPC Land coverage

• ByteDance faces R$ 153.7 million in fines over TikTok children's data - The previous investigation report from the same ANPD coordination, with fines calculated against the 2% and R$ 50 million caps that do not apply to public bodies.
• Brazil's data watchdog adds child protection to enforcement agenda - The ANPD's 2026-2027 enforcement map, which names health data and the secondary use of data for targeted advertising.
• Brazil gives Discord 3 days to halt Go Live for all local users - The Inspection Superintendence's precautionary order under the child protection statute.
• European data protection board evaluates Brazil adequacy decision - The EDPB's opinion on the LGPD, including its concerns about breach notification and impact assessments.
• Brazil's ANPD releases draft age verification guide open to public input - The regulator's draft guidance on age assurance mechanisms under the ECA Digital.
• Brazil's ANPD keeps Synapse in AI sandbox despite scoring 45 of 100 - The ANPD's AI sandbox monitoring report, including a health chatbot whose anonymised data was reclassified as pseudonymised.
• Italy fines IQVIA €7M over health data of 1M patients it called anonymous - The Garante's ruling that persistent codes left patient records identifiable.
• Swedish DPA fines Apoteket and Apohem for transferring Sensitive Data to Meta - Pharmacy purchase data, including sexual health products, sent to Meta through its pixel.
• Grindr pays £26m to settle UK claim over alleged HIV data sharing - A settlement over claims that HIV status reached advertising companies, with no admission of liability.
• California data broker fined $45,000 for selling health condition lists - A Delete Act penalty against a broker selling lists of people with Alzheimer's disease and other conditions.
• Portugal's data watchdog issued just 2 fines in all of 2025 - One of the two fines went to a local government entity.

Summary

Who: Brazil's Agência Nacional de Proteção de Dados (ANPD), through its Sanctions General Coordination, and the municipality of Feira de Santana, in Bahia, whose Urban Mobility Secretariat published the list. About 1,241 people living with HIV, sickle cell anaemia or fibromyalgia were affected. A lawyer retained by Via Feira, the association of the city's bus operators, drafted the ordinances.

What: An investigation report recommends six warnings, five with corrective measures, plus a 180-day notice of the infringement on the city's homepage. It finds infringements of the purpose, transparency, non-discrimination, security, prevention and accountability principles, of the LGPD's security and irregular processing provisions and of the duty to notify incidents. No fine is possible because the LGPD leaves fines out of the sanctions for public bodies.

When: The publication took place on September 20, 2025. Proceedings opened on October 20, 2025, the report was signed on October 9, 2026, and Brazilian outlets reported the sanctions on October 26, 2026. A first-instance decision by the Superintendent of Inspection follows, with a 10-business-day window to comply or appeal.

Where: Feira de Santana, Bahia, Brazil, with the list published in the city's online official gazette.

Why: The city published health diagnoses protected by a confidentiality statute, never identified a legal basis, had no data protection officer, security policy or incident plan, let a bus operators' lawyer draft the ordinances and notified only 22 of the 1,241 people affected, and none of them in the form the rules require. The case shows how the ANPD applies purpose, non-discrimination and notification rules that bind every controller in Brazil, including those handling health data for marketing.