BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
• guarantee of fraud prevention and the security of the data subject; • protection of the life or physical safety of the data subject or a third party; • conducting studies by a research body; and • protection of health by health professionals. Personal data related to children and adolescents may also be processed, but the legislation requires that this be done under an unclear criterion of the “best inter - est”. This means that processing this type of personal data must consider the special protection given to the intimacy and privacy of children and adolescents, without creating an insurmountable restriction. The legislation also imposes two conditions: the process - ing must comply with the principles and rules of the LGPD and, in the case of children, the consent of a parent or legal guardian is required. 1.4 Processing of Personal Data for Research and Development Purposes In the context of the processing of personal data for research and development, especially of health and life protection products and services, the subject is more complex and must be evaluated from two angles: that of the processing carried out by the government and that of the processing resulting from applications and mechanisms provided by private companies. The LGPD provides (Article 13) that it must occur with - in the public entity – which, in other words, means that hiring third parties for processing and sharing the data is not allowed – and under strict security and reliability protocols, including anonymisation or pseudonymisa - tion. Even in these cases, the processing must respect the principles and requirements of the LGPD, especially if it involves handling of sensitive data or data of high relevance to individuals. The same level of care applies to the processing resulting from applications and mechanisms provided by private companies (MedTechs, HealthTechs, etc). Even stricter criteria may also apply. For example, in the case of R&D, the processing of personal data must be based on a “strictly legitimate purpose”, ie, one
that, in origin, has a legitimacy that cannot be ques - tioned. In addition, the processing must be based on irreversible anonymisation, in which the data cannot be linked to a specific person and which, therefore placing it outside the rules of the LGPD. In terms of commercial use of this data, Brazil follows the European system: it is prohibited to process the data for commercial purposes or to achieve economic advantage, except for the provision of health services. 1.5 Processing of Personal Data in the Context of Artificial Intelligence In the context of personal data processing and AI, two premises are strictly essential: “human in the loop” (“human on the top”) and strict compliance with data protection legislation. These principles give rise to some requirements. The first is that the use of personal data in AI systems, models, or resources must always consider risk- based regulation, which prohibits AI being used for behavioural manipulation or sensitive categorisation (eg, the use of biometric data). The second is the strict and rigorous assessment of high-risk AI, considered to be systems that can significantly impact fundamen - tal rights, public safety or the health of the population, in line with the criteria of the European AI Act. The third requirement is that AI should always be subject to active human supervision, especially in the case of automated decisions. In Brazil, the regulation of AI is still under discussion. The most recent document in this regard is Bill 2,338, approved by the Senate and currently under consid - eration in the Chamber of Deputies. According to the Bill, some high-risk categories should require much stricter restrictions, such as employee recruitment and selection, justice and law enforcement, and facial rec - ognition and biometrics. The Bill also considers some modalities of AI as excessive risk (Article 14), and as a result prohibits models whose objective is, for example, behavioural manipulation, real-time biometric identification, and emotion recognition.
14 CHAMBERS.COM
Powered by FlippingBook