Feira de Santana sanctioned for exposing medical data of 1,200 people

The National Data Protection Authority (ANPD) has sanctioned the city government of Feira de Santana, Bahia, following the unauthorized disclosure of sensitive medical information belonging to 1,241 individuals. The breach occurred in September 2025 when the municipality published a list in its Official Gazette intended to identify citizens whose free public transit benefits were suspended by judicial order.

In addition to names, the publication improperly included sensitive health diagnoses, such as HIV, sickle cell anemia, and fibromyalgia. Although the city removed the document after a few hours, the ANPD determined that the municipality failed to comply with the General Data Protection Law (LGPD). Specifically, the administration violated the principle of purpose and failed to notify both the ANPD and the affected individuals about the security incident.

As a result, the city has received a formal warning and is required to publish a notice regarding the infraction on its official website for six months. The municipality must also implement corrective measures to prevent future leaks.