BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
• good faith; • purpose; • free access; • non-discrimination; • necessity; • accountability;
• information on shared use of data; • intimacy; • freedom; • portability; • privacy; • revocation of consent; and • ownership.
• prevention; • data quality; • accountability; • security; and • transparency.
In the context of the processing of personal data, meeting the principles and respecting the rights is not sufficient. Each processing agent – controller and operator – must observe the “organic requirements” for this processing. The main “organic requirement” is the centralised and unitised control of personal data processing operations, provided for in Article 37 of the LGPD. This requires that the agent should institute, maintain, and manage a system capable of providing, in real time, up-to-date information on the circular - ity of personal data in the organisation, including the categories of data, the purpose of the processing, and the protection measures in place. In this sense, the processing agent should consider adopting strict and transparent internal policies, pro - tocols for the regular processing of data, specific pro - cedures and, at a more objective level, control tools, such as the assessment of the impact of the process - ing on the privacy of individuals and the assessment of legitimate interest (LIA). 1.3 Special Categories of Personal Data Sensitive data, which the LGPD defines as that refer - ring to racial or ethnic origin, religious conviction, political opinion, union membership or religious, phil - osophical or political organisation, health, sex life, genetics or biometrics (Article 5, II), receive special protection under the law. In this sense, this data may (or should only) be pro - cessed under the following bases: • consent; • compliance with a legal or regulatory obligation by the controller; • execution of public policies; • regular exercise of rights in judicial, administrative or arbitration proceedings;
Based on these principles, there are the so-called “essential requirements” for any processing of per - sonal data. The first is that the processing must be carried out under the rules of the LGPD, which involves investigating where the data was collected, where it is processed, and for what purposes (the “triad”). The other requirements are (Articles 7 and 11 of the LGPD): • consent of the data subject; • compliance with a legal or regulatory obligation by the controller; • execution of a contract or preliminary procedures in a contract to which the data subject is a party, at their request; • execution of public policies; • regular exercise of rights in judicial, administrative or arbitration proceedings; • legitimate interest of the controller or third party; • protection of the life or physical safety of the data subject or a third party; • credit protection; • conducting studies by a research body; and • protection of health by health professionals. The LGPD also establishes the main rights of the data subject (Articles 17 and 18): • access to personal data; • anonymisation, blocking or deletion of unneces - sary, excessive or non-compliant data; • confirmation of processing treatment; • data correction; • deletion of personal data processed with consent; • information about non-consent;
13 CHAMBERS.COM
Powered by FlippingBook