BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
1.6 Data Breach Requirement The expression “data breach” is part of a larger cat - egory of events harmful to personal data called “secu - rity incident.” Resolution CD/ANPD 15/24 defines a security incident as “any confirmed adverse event, related to the violation of the properties of confidenti - ality, integrity, availability, and authenticity of personal data security” (Article 3, XII). In general, a security incident can encompass differ - ent types of attacks on personal data, including the violation itself, improper disclosure, and data leakage, ranging in severity from the most minor to the most serious. The Brazilian regulator has established a set of meas - ures necessary to deal with a security incident, man - age its effects and prevent its repetition over time, as outlined below. • Communication to the regulator: the control - ler must formally notify the ANDP of the incident within three days of the occurrence. • Communication to the data subject: the control - ler must formally communicate the incident to the data subject within three days of becoming aware that the incident has affected the data subject’s data. • Information: the controller must include, in the communication, a description of the nature and category of personal data affected. • Recordkeeping: the controller must maintain a detailed record of the incident for five years. • Management: the DPO takes over the management of the incident. • Compliance: the controller and DPO establish how and to what extent regulatory compliance was impacted by the incident. A security incident may require an inspection action by the regulator, with or without the application of penalties. However, there is always the possibility that an incident that compromises a large amount of data or exceeds the controller’s limits will be investi - gated by the ANPD or even by the Public Prosecutor’s Office. In addition, an incident may also lead to claims for indemnification (reparation) against the controller,
requiring it to compensate data subjects for losses and damages (LGPD, Article 42). 1.7 Regulators In Brazil, the regulatory authority for personal data and its protection has been well established since Law 13,853/19, which created the ANPD. This authority is competent to, among other respon - sibilities (LGPD, Article 55-J): • co-ordinate with public regulatory authorities to exercise their powers in specific sectors of eco - nomic and governmental activities subject to regulation; • enter into an agreement with processing agents to eliminate irregularities, legal uncertainty or litigation in the context of administrative proceedings; • deliberate, in the administrative sphere, on a con - clusive basis, on the interpretation of this Law; • provide for the forms of publicity of personal data processing operations; • issue regulations and procedures on personal data protection and privacy, as well as on personal data protection impact reports for cases in which the processing represents a high risk to the guarantee of the general principles of personal data protec - tion provided for in this Law; • draft guidelines for the National Policy for the Pro - tection of Personal Data and Privacy; • supervise and apply sanctions in the case of non- compliant data processing, through an administra - tive process that ensures the adversarial process, full defence and the right to appeal; • implement simplified mechanisms, including by electronic means, for the registration of complaints about the violation of this Law; and • promote co-operation with personal data protec - tion authorities in other countries, of an interna - tional or transnational nature. The ANPD’s role, although predominantly guiding (at this stage of Brazilian legislation), has a strongly instructive, supervisory and sanctioning character. This is possibly why its investigative process, espe - cially regarding direct violations of personal data pro - tection legislation, is especially detailed. Under the
15 CHAMBERS.COM
Powered by FlippingBook