BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
• review policies and agreements on personal data; and • review contracts and data agreements in general. 3.4 Regulators and Enforcement For personal data, the Brazilian authority is the ANPD, as established in the LGPD, Article 55-J, I. A recent issue involves the ANPD’s competence to “ensure the observance of commercial and industrial secrets” (LGPD, Article 55-J, II, and ANPD Ordinance 1/21, Article 16, XXI). Commercial and industrial secrets, in general, fall within the Industrial Property Law (Law 9.279/96), which provides penalties for acts of violation of these secrets, since secrecy is essen - tial to safeguard the competitiveness and economic value of the information. In practice, what the LGPD establishes (or should be understood to establish) is that the protection of personal data must also account for the protection of commercial and industrial secrets related or linked to them. This means that the ANPD does not technically have “direct” authority over these secrets, but a derivative or ancillary role in ensuring their protection. For non-personal data, other Brazilian regulatory enti - ties can act, such as CADE, in the case of competition issues (or linked competition), Anvisa, ANS and even, for financial services and products, the Central Bank. Online tracking (and its derivatives, such as active tracking) and its technologies, including the use of cookies, web beacons, fingerprints, and SDKs (Soft - ware Development Kits), are governed by the Brazilian LGPD. In practice, this method of obtaining a person’s location in real time suggests that data from individu - als can be accessed and used both to distinguish them from others and to know where they are, elimi- nating other possible places. As a result, regulation falls on the ANPD. The fundamental requirement for compliance in these cases is that the collection of personal data is trans - parent and based, whenever possible, on the user’s 4. Sectoral Topics 4.1 Use of Cookies
consent, allowing the user to manage their own set - tings. For consent models, it is possible to apply the follow - ing approaches. • Opt-in: requires prior, free, informed and unam - biguous consent for the use of cookies that are not strictly necessary, such as tracking cookies for personalised advertising or behaviour analysis. • Opt-out: for strictly necessary cookies (technical or functional), which guarantee the proper functioning of the page in navigation. • Third-party and tracking cookies: pure opt-out (first track and then give the option to opt-out) is not recommended as the best compliance by the ANPD. In any scenario, certain “essential rules” must be applied, as follows. • Third-party cookies: being more invasive, they require greater rigour in obtaining consent, as they track the user on different pages and applications. • Children and adolescents: require extra safe - guards, via measures proportional to the risks. • Preference management: a cookie banner must be adopted for the user to reject or accept specific categories of cookies. • Transparency: pages and applications must have a “Cookie Policy”, explaining what personal data is collected, the purpose and the duration of storage. 4.2 Personalised Advertising and Other Online Marketing Practices In the national territory, personalised and targeted advertising in Brazil is basically regulated by the LGPD, the Consumer Protection Code and, at some level, the Brazilian Code of Advertising Self-Regula - tion (CONAR). This type of activity depends on some conditions, including: • free, informed, specific and unambiguous consent (if used), preferably with an active confirmation (opt-in), via pre-checked boxes;
21 CHAMBERS.COM
Powered by FlippingBook