[News] Data Protection
Since it was established, the National Data Protection Authority (“ANPD”) has adopted measures and promulgated regulations and recommendations regarding the General Data Protection LAW. Listed below are the main news on the subject, released in April and May 2023:
ANPD releases technical note on personal data treatment in the pharmaceutical sector
Technical Note No. 4/2022/CGTP/ANPD brings a series of findings on the use of personal data in the pharmaceutical sector. Through a study conducted by the General Coordination of Technology and Research (“CGTP”), irregularities were found in the treatment of personal data in the pharmaceutical sector, such as (i.) use of data for reasons other than those informed; (ii.) excessive collection of data; and (iii.) lack of transparency concerning the sharing of data with service providers. Therefore, it was determined that the CGF should open an inspection procedure and an analysis of the limits of consent as a legal base for granting discounts.
ANPD formalizes technical cooperation with the Development Bank of Latin America – CAF
To promote innovation, the ANPD signed a partnership with the Development Bank of Latin America (CAF) to prepare an instrument regulating artificial intelligence (sandbox). The program aims to encourage the development of technologies that will be tested and analyzed in controlled environments and implement good practices to ensure compliance with personal data protection regulations. In the specific case of the ANPD, the sandbox will gather inputs to improve the drafting of its regulations that may involve artificial intelligence.
ANPD opens public consultation on the Regulation of Communication of Security Incidents with Personal Data
The public consultation on the draft resolution regarding the Regulation of Communication of Security Incidents with Personal Data aims to regulate the provision of communication, indicated in Article 48 of the LGPD, which the controller should perform if a security incident that may lead the data subject to a situation of risk or relevant damage occurs.
Preliminary contribution to the public debate on the Brazilian Law of Freedom, Accountability and Transparency on the Internet
The ANPD has released its preliminary analysis of Bill No. 2630/20, establishing the Brazilian Law of Freedom, Accountability, and Transparency on the Internet. As main points, ANPD highlighted the need to: a) preserve ANPD’s competencies on the regulation, supervision, and application of sanctions to digital platforms regarding the protection of personal data and the right to privacy; b) express and restrictive indicate which data may be collected for criminal investigation purposes.
ANPD releases statement on the treatment of personal data of children and adolescents
The ANPD has released the Statemen CD/ANPD No. 1, of May 22, 2023, which brings some guidelines for interpreting Article 14 of the LGPD. According to the Statement, the processing of personal data of children and adolescents, taking into account the best interests of the minor, may be carried out considering the legal basis provided in the LGPD, such as the consent provided by the data subject, the fulfillment of a legal obligation, the protection of life, or meeting the legitimate interest of the controller.
Law enforcement determining the collection of racial-ethnic data of employees in the public and private sectors
Law No. 14.5553/2023, which changes the Racial Equality Statute, was published. The purpose of the law is to make mandatory the collection of ethnic-racial data, which are considered sensitive data, of employees in the public and private sectors, to subsidize public policies for the promotion of equality in labor and the carrying out of censuses by IBGE. Here, the legal basis of compliance with legal and/or regulatory obligation and execution of public policies may be used by the controllers to authorize the treatment of sensitive data.
ANPD releases list of ongoing inspection processes
The ANPD has released a list of 16 processes and 27 institutions currently under investigation for compliance with the LGPD. The disclosure seeks to promote transparency and demonstrate that the inspection has been ongoing since the creation of the ANPD, even before the publication of the regulations. According to Fabrício Lopes, General Enforcement Coordinator, the dissemination of these enforcement proceedings is a commitment that the ANPD had already made for this first semester to provide transparency to the agency’s activities and communicate to society that enforcement has been ongoing since the creation of the ANPD, even before the publication of the enforcement regulations and the dosimetry regulations.
ANPD opens notice for the selection of civil society representatives to the CNPD
The announcements were republished in the Official Gazette of the Union for the nomination of civil society representatives to the National Council for Personal Data Protection and Privacy (CNPD). Entities have until July 3, 2023, to nominate their representatives via electronic petition. It is necessary to previously register as an external user and follow the guidelines of the External User’s Manual. After sending the documents, the registration will be released in up to three working days. The following steps include the selection of the representatives and their nomination by the President of the Republic. The news can be accessed via the link.