BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
them and their economic situation may be taken into account. 1.9 Enforcement Trends There have been many developments in recent months in terms of privacy, security in the process - ing of personal data and inspection, especially in the expansion of certain basic concepts. Some notable events include the following. • The advancement of operations with crypto-assets has required that extra care be taken with personal data, especially those submitted to blockchain- based trading. These operations often involve personal data of the traders that crosses borders, which implies international sharing and indistinct storage. • The pressure on the processing of sensitive per - sonal data has significantly increased. The LGPD’s protection of this data does not seem to be suffi - cient to stop practices such as “biotyping”, passive biometrics, and the transfer of databases without the knowledge (and even without agreement) of the data subjects. • The judiciary has explicitly recognised, following a decision of the Superior Court of Justice (STJ), that there is presumed moral damage (without the need for explicit proof) if a processing agent shares personal data without the knowledge or agreement of the data subject. • The international transfer of personal data has gained more attention from the ANPD, following the publication of Resolution 19, which imposes stricter conditions on this transfer. For organisations, there are many lessons: • policies are insufficient; it is necessary to demon - strate the complete mapping of data flows (dynam - ic), so that the data subject knows how and for what purpose their data is processes; • embed privacy considerations from the outset when developing new AI products, services, and algorithms; • implement quick and effective incident response plans; • liability for personal data is joint and several;
• adopt rigorous anonymisation and pseudonymisa - tion techniques when dealing with sensitive data and train AI models to minimise risk. Privacy is now treated as a competitive differentiator and a driver of customer loyalty (privacy-led market - ing), beyond just a compliance requirement.
2. Privacy Litigation 2.1 Privacy Litigation Overview
Arguably, the number of litigations and disputes involving privacy and personal data is growing year by year. These conflicts are no longer about finan - cial issues, but relate to the improper, unauthorised, rights-violating or even illegal use of personal data for commercial purposes, and in some cases, illicit activities. With the consolidation of the LGPD and the structur - ing of the ANPD, the trend towards greater judicialisa - tion is being observed at different levels, including in the main Brazilian courts. Litigation has originated from these main sources: • security incidents; • misuse of personal data; • inadequate processing, without purpose and with - out legal basis; • invasive biometrics; • sharing for financial purposes; • violation of minimum rights by some mass con - sumer companies; • improper commercial profiling; and • use of personal data to contract unsolicited ser - vices. These disputes range from personal data subjects and consumers to civil society entities and the Pub - lic Prosecutor’s Office. There are already signs that groups of data subjects, impacted by the misuse of their data, are organising to file complaints with the regulator, establishing a regulatory basis for relevant lawsuits. Employees, with the support of their unions, are taking action against practices such as the use of biometric data by companies to monitor working
17 CHAMBERS.COM
Powered by FlippingBook