  Data privacy is a trending topic in the internet era. Given such importance,
many challenges emerged in order to collect, manage, process, and publish data.
In this sense, personal data have got attention, and many regulations emerged,
such as GDPR in the European Union and LGPD in Brazil. This regulation model
aims to protect users' data from misusage and leakage and allow users to
request an explanation from companies when needed. In pandemic situations, such
as the COVID-19 and Ebola outbreak, the action related to sharing health data
between different organizations is/ was crucial to develop a significant
movement to avoid the massive infection and decrease the number of deaths.
However, the data subject, i.e., the users, should have the right to request
the purpose of data use, anonymization, and data deletion. In this sense,
permissioned blockchain technology emerges to empower users to get their rights
providing data ownership, transparency, and security through an immutable,
unified, and distributed database ruled by smart contracts. The governance
model discussed in blockchain applications is usually regarding the first layer
governance, i.e., public and permissioned models. However, this discussion is
too superficial, and they do not cover compliance with the data regulations.
Therefore, in order to organize the relationship between data owners and the
stakeholders, i.e., companies and governmental entities, we developed a second
layer data governance model for permissioned blockchains based on the
Governance Analytical Framework principles applied in pandemic situations
preserving the users' privacy and their duties. From the law perspective, we
based our model on the UE GDPR in regard to data privacy concerns.
