Follow on Google News

A approval of the General Personal Data Protection Law (LGPD) was a major step forward for legal certainty and the country's economic, technological and social development. It should be noted that the law contains numerous provisions that require regulation by the competent authority. For this reason, the full functioning of the National Data Protection Authority (ANPD) is essential for Brazilian organizations to work with more legal certainty regarding their compliance with the new law, preserving the balance between the protection of personal data and the expansion of the digital economy.

Due to the importance of using data in the most diverse activities and the rapid growth of the digital economy, it is essential that the different sectors, especially those that handle large volumes of data, participate in the process of forming the structure responsible for data protection in Brazil, bringing their contributions and the main challenges encountered in the practical applications of the law.

To use an example I'm familiar with, that of credit protection service companies, it's worth noting that the sector processes around 150 million pieces of data on individuals and companies, using only the information necessary to legitimate purpose of providing credit assessment in an environment of total information security. The processing of data for the analysis and granting of credit to individuals and companies is the essence of credit bureaus, which represent an important instrument for generating confidence and security in the credit market, They work very closely with banks, fintechs and financial startups.

A National Association of Credit Bureaus (ANBC) actively participated in the construction of the personal data protection bill and made numerous suggestions for the main concepts relating to personal data, especially those directly linked to the credit market. For all its involvement in the process, and for the international experience of credit bureaus in handling data with respect for privacy, the sector has made itself available to support and provide input to the activities that will be developed within the ANPD and the Advisory Council of the Personal Data Protection Authority.

The representatives of the credit bureaus considered the positions that have been defended by the nominees for the ANPD Board to be in line with the wishes of the market and society. Among them, that the Authority should favor constructive engagement, encourage education in the use of personal data, reward appropriate behavior and use punishments only as a last resort. It also intends to listen to all sectors when formulating the National Policy for the Protection of Personal Data and to act with transparency and innovation to ensure that personal data is shared responsibly. There is also the proposal to take action to facilitate the country's inclusion in global value chains, for example by urgently regulating international transfers.

OECD report on the digital economy in Brazil

The immediate functioning of the ANPD is so important for Brazil that the Organization for Economic Cooperation and Development (OECD), a body to which Brazil has been applying for membership, has launched report on the country's digital economy, with recommendations for improving confidence in the digital economy.

A OECD suggests that the country should re-evaluate the conditions set out in Article 55-A of Law 13.709, to guarantee the ANPD's full independence from the outset, and that the rules for appointing the ANPD's Board of Directors and the National Board of Protection of Personal Data and Privacy (CNPDP) are transparent, impartial and based on technical knowledge.

The document also warns that LGPD is silent on how the entities will manage the disagreements that arise, that clear rules need to be established regarding decision-making within the ANPD and its implementation by the Board of Directors, that a predictable budget needs to be guaranteed for the ANPD and that the Brazilian Strategy for Artificial Intelligence needs to be aligned with the General Data Protection Law and other relevant legal frameworks in cooperation with all actors.

ANPD Board of Directors

Because it involves all sectors of the Brazilian economy, the credit bureau sector also believes that the ANPD's Board of Directors and staff should have ample availability to know the specificities of each segment and technical expertise in areas such as information security, the development of the digital economy and digital transformation, as well as knowledge of regulatory convergence, certifications and good international practices.

At the same time, the sector also believes that the ANPD should develop its activities in harmony with other bodies responsible for regulating specific economic activities, as has happened in other countries that already have data protection legislation. And, as the LGPD itself makes clear, the ANPD should work with other public regulatory authorities to exercise its powers in specific sectors of economic and governmental activities subject to regulation. In the industry's view, without the strategic leadership of the ANPD, the multiple interpretations of other public spheres will tend to cause legal uncertainty and many lawsuits, which could be avoided in most cases by prior instructions and guidance from the competent Authority.

Finally, we believe that it is up to all of us - government, society, controllers and operators of personal data in the private sector - to ensure that the LGPD is complied with, as everyone is responsible for exercising digital rights in a sustainable manner. Therefore, the creation of the ANPD, its internal structure and the regulatory pieces must be based on broad and unrestricted public consultation, with guidance and education for organizations and citizens around these rules.

Thanks for reading! Access other content at ANBC website.

By: Elias Sfeir President of ANBC & Member of the Climate Council of the City of São Paulo & Certified Advisor