ACCESSIBLE AND SUPPORTED CONSENT IN PERSONAL DATA PROCESSING: LEGAL PARAMETERS FOR APPLYING THE BRAZILIAN GENERAL DATA PROTECTION LAW (LGPD) TO PERSONS WITH MENTAL OR INTELLECTUAL DISABILITIES

Abstract

This article examines the validity of consent for the processing of personal data concerning persons with mental or intellectual disabilities in light of the Federal Constitution, the Convention on the Rights of Persons with Disabilities, the Brazilian Inclusion Act, and the Brazilian General Data Protection Law. In this context, the study addresses the gap concerning the definition of criteria capable of reconciling the autonomy of the data subject, the provision of support, and the adoption of safeguards, without reproducing the former model of substituted decision-making or leaving without assistance those who require support in making decisions. Given this issue, the article aims to determine whether, and under what conditions, the data subject’s expression of will may constitute a valid lawful basis for processing personal data. To achieve this objective, qualitative, bibliographic, and documentary research was conducted, guided by the deductive method and a systematic legal interpretation of the relevant legislation and literature on legal capacity, sensitive data, hypervulnerability, parental consent, and automated decision-making. The results indicate that disability does not, in itself, eliminate the capacity to consent and that the sensitivity of disability-related information must be assessed contextually, considering its nature, purpose, and discriminatory potential. Furthermore, the findings demonstrate that the validity of consent depends on the data subject’s understanding, freedom of choice, the specificity of the purpose, the accessibility of the information provided, the possibility of withdrawal, and the potential effects of automated decisions. Therefore, data processing should prioritize accessible and supported consent whenever this lawful basis is appropriate and can be validly established. However, when valid consent cannot be obtained, the controller must demonstrate the applicability of another lawful basis and adopt enhanced safeguards. As its main contribution, the article systematizes parameters intended to reconcile personal data protection, the autonomy of the data subject, the provision of support, and the prevention of discriminatory practices.