The Lei Geral de Proteção de Dados Pessoais – LGPD (Law nº 13.709, since August 14,2018) aims to ensure the protection of personal data of citizens. This law was amended by the Provisional Measure nº 869, December 27, 2018, who even created the Autoridade Nacional de Proteção de Dados – ANPD.
As well the General Data Protection Regulation (GDPR), of the European Union, the LGPD defines definitions regarding personal data, sensitive personal data, control, processing, consent and anonymization.
It applies to all natural and legal persons, whether public or private, who process personal data in analogue or digital means, whenever the data processing is carried out in Brazilian territory or if the activity involves offering products or services. to people who are in national territory.
Let's explain one by one for you to understand better:
Personal Data Consist of any information that identifies an individual or that could lead to their identification. There are two types of personal data:
- Direct: Name, CPF, RG, enrollment, voter registration
- Indirect: Consumption habits, profession, sex, age, among others.
It is important to reinforce that personal data, even if made public, continue to be protected by law.
Sensitive Personal Data: They are made up of data classified by racial or ethnic origin, health, sex life, genetics, biometrics, religion, political opinion, skin color.
Anonymized: Are data in which the holder cannot be identified, considering the use of reasonable technical means available at the time of processing.
Pseudonymized: Are personal data that, through processing, lose the possibility of being directly or indirectly associated with an individual. In this case, the controller can locate the person using additional information that was kept separately.
Information of paramount importance for all of us to know is that the law only allows the processing of personal data when associated with a legal basis. The legal bases are conditions determined by the LGPD so that it is possible to collect personal data and process it, differentiating Personal Data and Sensitive Personal Data. Below, we will present what these legal bases are.
Legal Basis for Personal Data
- Consent;
- Compliance with legal or regulatory obligations;
- Execution of public policies by the Public Administration;
- Conducting studies by research bodies;
- Regular exercise of rights, including in contracts and in judicial, administrative and arbitration proceedings;
- Protection of life or physical safety of the holder or third parties;
- Health protection;
- Legitimate interest of the controller or third parties;
- Credit protection;
- For the execution of contracts and preliminary procedures related thereto.
Legal Basis for Sensitive Personal Data
- Consent;
- Compliance with legal or regulatory obligations;
- Execution of public policies by the Public Administration;
- Conducting studies by research bodies;
- Regular exercise of rights, including in contracts and in judicial, administrative and arbitration proceedings;
- Protection of life or physical safety of the holder or third parties;
- Health protection;
- Ensuring fraud prevention and holder security.
The definition of who is in the position of controller or operator, according to the respective personal data processing activity, is important to determine obligations and responsibilities of each of these treatment agents.
This evaluation and definition can be simple or extremely complex tasks, due to the dynamic nature of the processing operations that usually involve its agents.
Controller:
- Makes all decisions regarding the processing of personal data throughout their lifecycle;
- Determines the purposes and means of processing personal data;
- Evaluates the framework of the legal bases of treatment;
- You may be directly liable for GDPR violations;
- It guarantees the fulfillment of the holders' rights.
Operator:
- Processes personal data on behalf of the controller;
- It has no decision-making power;
- May perform complex tasks and with some discretion, but always under the command of the controller;
- You may be held jointly and severally liable for violations that you cause to the LGPD.
The operator will always obey the controller, who effectively determines the purpose of data processing, but if the operator uses the same data for another purpose, he also becomes the controller, with the responsibilities inherent to the position.
The LGPD brings together, in one place, the rights of data subjects. Before that, they were provided sparsely in several laws, such as the Consumer Protection Code and the Civil Rights Framework for the Internet. The holder can exercise these rights over his personal data at any time, upon request to the controller.
At CERAMICA VILLAGRES LTDA, you can exercise these rights in: DATA HOLDER PETITION.
In case of non-compliance with the LGPD, companies are subject to debts and must be administratively remaining by the ANPD as follows:
- Warning;
- Simple fine (up to 2% of revenues up to a limit of BRL 50 million);
- Daily fine;
- Possibility of publicizing the infraction;
- Blocking of the personal data involved;
- Elimination of the personal data involved;
- Partial suspension, for up to 06 months, of the database involved;
- Suspension of the activity of processing personal data;
- Partial or total ban on carrying out activities related to data processing.
The following will be taken into account by the ANPD:
- Gravity and nature of the infractions;
- Good faith and cooperation of the offender;
- Advantage obtained from the infraction;
- Economic conditions of the offender;
- Recurrence and severity of damage caused;
- Adoption of internal data protection mechanisms and procedures;
- Adoption of a good practices and governance policy;
- Prompt adoption of corrective measures;
- Proportion between the seriousness of the infraction and the intensity of the sanction.