The Brazilian data protection authority ('ANPD') issued, on 20 April 2022, an official clarification note stating that it was made aware of the publication of Ordinance No. 167 ('the Ordinance') authorising the Federal Service for Data Processing ('SERPRO') to provide third parties with access to data subject's personal data held by the Federal Revenue Service of Brazil ('RFB'). 

In particular, the Ordinance addresses topics such as: 

• the costs of maintaining the electronic systems required to enable access to personal data, which would be compensated to SERPRO by third parties interested in buying the data; and 
• assuring the execution of a risk identification process for the institution or a risk to confidentiality. 

As a result, the ANPD announced that it has begun an administrative inspection process in accordance with the authority's prerogative to ensure the protection of personal data, and will verify the adequacy of the Ordinance with Law No. 13.709 of 14 August 2018, General Personal Data Protection Law (as amended by Law No. 13.853 of 8 July 2019) ('LGPD'). 

You can read the official clarification note, only available in Portuguese, here.