On August 11, Law No. 8,973/2020 was published in the Official Gazette of Rio de Janeiro, which prohibits the use of personal data, sensitive data and metadata from users of virtual platforms of “distance learning” (DL) for the purposes of commercial exploitation.
The exception to the prohibition is given through users consent, which must be given in a prominent way and reflect the determined purposes for which the personal data will be processed. In addition, the burden of proof that consent has been obtained in a regular way lies with the data controller. The law also provides for sanctions in case of non-compliance, such as warning and monetary fines of up to 5,000 UFIR-RJ (Fiscal Unit of Reference), as of the third recurrence. The enactment of the law generated numerous discussions about the constitutional jurisdiction to legislate on the topic.
Lean more at: full law