BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
tion (through the ANPD and its rules) works to ensure that these legal requirements are met from a “macro” point of view. The government can use mechanisms (inspections, audits, etc) to ensure that the guidelines established by the LGPD are observed. On the other hand, there is the relationship between this framework and non-personal data. In general terms, if there is personal data being processed, whether alone or in combination with non-personal data, or even with strictly technical data (which does not touch on aspects of privacy and intimacy of individuals), the LGPD applies and also applies to the regulatory data exer - cised by the ANPD. This concept, known as “cross- regulation”, allows different regulators to act within the same process, each in its own scope of action, so enabling “extended protection” to occur. In this sense, the different regulators interact to ensure, for example, “privacy by design” and “privacy by default.” This means, for example, that AI systems and capabilities must be created and configured to also protect data automatically, that personal data in model training must be protected by measures (such as anonymisation) to prevent the AI model from “dec - orating” and exposing sensitive data (data inversion), and that privacy impact assessments (DPIA) are made on high-risk AI systems. 3.3 Rights and Obligations Under Applicable Data Regulation The idea of “regulatory interaction” (which Brazil has adopted, at least in part), although useful and opera - tional, reflects a distinction also adopted by the EU Data Act: personal data, which directly relate to the privacy and intimacy of individuals, and non-personal data, which focus on competition, innovation, access, sharing, and invention. In both cases, organisations move away from the role of “owners” of data and assume that of “controllers”; this change has strong legal and legal impacts. In the context of strictly personal data (typically per - sonal, related to the privacy and intimacy of individu - als), the focus is on its protection, since this has to do with fundamental rights, established by the Federal Constitution. “Protection” includes a whole set of legal and regulatory guidelines, such as:
• access (LGPD, Article 9); • confirmation of existence (LGPD, Article 19); • portability (LGPD, Article 18, V); and • revocation of consent (LGPD, Article 18, IX). In the field of non-personal data (not related to natural persons), the idea of “protection” is mainly related to the following. • Sharing: this should only occur under “FRAND (fair, reasonable and non-discriminatory)” conditions, which can help prevent holders of essential patents from refusing to license them or demanding abu - sive fees, impacting competition and technological innovation. • Right of access and use: users (companies or con - sumers) have the right to access data generated by connected products and services, most often in real time. • Interoperability: users have the right to replace data service providers or providers, including cloud switching. • Protection of secrets: manufacturers and devel - opers can refuse to share data if there is a risk of exposing industrial secrets. • Termination with migration: users must be guaran - teed data portability at the end of their contract, without facing abusive fees. For both personal and non-personal data, organisa - tions must take certain actions, including: • update storage, update and deletion policies, to ensure that at the end of the contractual relation - ship portability is possible, with rollback and con - tingency plans; • implement standards for data portability between cloud providers with a reduction (or elimination) of switching fees; • implement safeguards that are at least reasonable against unlawful access to data by third govern - ments; • include FRAND terms in non-personal data con - tracts; • map data generated by IoT devices and ensure that the interface allows direct user access to the data; • react in terms of infrastructure;
20 CHAMBERS.COM
Powered by FlippingBook