The LGPD applied to the credit protection services market

Follow on Google News

Before the data protection law, credit bureaus already followed practices in line with its principles

The digital economy around the world - and here too - is expanding as the use of technology in the most diverse daily activities increases. Thus, in the digital economy and its hyperconnected society, having legislation that regulates the processing of personal data allows society to function better and more securely.

With the aim of defining the rules for processing this personal data, in order to reconcile the economic potential of data processing by organizations with the privacy of individuals, the General Personal Data Protection Act (LGPD). The new legislation is positive for the country, its citizens and companies.

For citizens, because data subjects will have more information about the processing of their personal data. For companies, because the LGPD will guide how to process this data according to specific criteria and rules. And it is equally positive for Brazil, because it promotes the legal certainty needed to attract foreign investment and stimulate the development of the economy, technology and social welfare.

Even before the LGPD, credit bureaus already followed procedures compatible with its recommendations.

One of the most important contributions of the LGPD is the principle of informational self-determination, which is the right of the data subject to be aware of who knows what about them. Through informational self-determination, the data subject can exercise real control over the accuracy of the information collected, as well as its recipients and the purposes for which this data is used.

In Consumer Protection Code (The principles of fairness in the treatment of information, such as access or participation, integrity, security and reparation - all of which are also included in the LGPD - are present in the CDC, as well as in the Cadastro Positivo Law. These internationally recognized principles are known in Canada, the United States and Europe as the “fair information principles” and have been guiding bureaus' actions for some time.

Article 5 of the Positive Registration Law, for example, which deals with the rights of the registered person, strengthens informational self-determination in this area by ensuring the following rights: cancellation or reopening of the registration, when requested; free access, regardless of justification, to the information in the databases, including credit history and score, with the database manager (GBD) being responsible for maintaining secure systems, by telephone or electronic means, for consultation of the information by the registered person; contestation of information erroneously noted in databases and its correction or cancellation in all the databases that shared the information; the right to be informed in advance of the identity of the manager, storage and purpose of the processing of their personal data.

With regard to data processing, Article 7 of the LGPD provides for ten legal bases or hypotheses for processing personal data, without there being any hierarchy. The credit bureaus deal with personal data, which is all data relating to an identified or identifiable natural person. And in most of their activities they use the legal basis of item X: credit protection, including in line with the Positive data. In addition to the Positive Registry, there are other legal bases that the bureaus use to evaluate credit.

The crucial role of the ANPD

The entry into force of the LGPD without the full functioning of the National Personal Data Protection Authority (ANPD), in the view of the credit sector, creates legal uncertainty as to the proper application of the law.

The sector is therefore pleased to see that the necessary initiatives are being taken for the functioning of the ANPD, which is responsible for regulating and guiding the application of the LGPD. This is because the Presidency of the Republic has approved the Authority's regimental structure, the list of commissioned positions and positions of trust, and appointed the five members of the Board of Directors, who have already been heard and approved by the Federal Senate.

As the LGPD involves all sectors and segments of the Brazilian economy, it is recommended that the ANPD be led by a Board of Directors and a staff with ample availability to know the specifics of each segment and technical expertise, especially from sectors accustomed to the use of personal data, data science, data governance, information security, the development of the digital economy and digital transformation, as well as knowledge of regulatory convergence, certifications and international best practices.

Considering that issues involving privacy and personal data protection are new disciplines in Brazil, the ANPD's technical capacity is relevant to the Authority's normative and structural work. As well as the broad participation of all sectors of society, especially those directly affected by the new regulatory framework.

The ANPD is also essential for legal certainty regarding the definition of the best interpretation of the rules, with a view to maintaining a balance between the protection of personal data subjects, ensuring all the rights provided for such as the correction of incomplete, inaccurate or outdated data, and economic and social development.

Without its strategic and educational management, the multiple interpretations of other public spheres will tend to cause legal uncertainty and thousands of lawsuits, which could be resolved in most cases by prior instructions and guidance from the competent authority.

From the credit bureau sector's point of view, the implementation and standardization of the issue in the country must be orchestrated, under the coordination of the ANPD. And as a result of broad and open processes of public consultations and regulatory impact analysis, avoiding monocratic and punctual decisions, without first effectively adapting to the LGPD.

Dialogue with the government and other organized sectors is and will continue to be a priority for the private sector in the search for the best results for society. At the same time as suggesting the regulatory debate, the organized private sector is proposing to actively collaborate in drawing up the guidelines, regulatory orientations and educational work necessary for the implementation of the LGPD.

(published in Portal Jota)