BRAZIL Law and Practice Contributed by: Japyassú Resende Lima and Fabiana Lopes Pinto Santello, Lopes Pinto, Nagasse Advogados
• the ECA Digital (Law 15,211/25) has specific rules for digital platforms, prohibiting the profiling of children and adolescents for targeted advertis - ing, including the requirement of age verification mechanisms and parental consent; • explicit purpose and well-established legal basis (LGPD, Articles 7 and 11); • non-discrimination and non-abusiveness (undue intrusion); • children’s advertising is considered an abusive practice, according to the CDC (and CONAR’s understanding), due to the vulnerability and inexpe - rience of the target audience; • content restrictions for certain audiences (children and the elderly, for example, via sectoral agree - ments or good practices in advertising and content marketing); and In the context of work and related activities, even outside the company’s physical environment, compli - ance depends on the application of the LGPD and the Consolidation of Labour Laws (CLT). This is a typical case of combined regulation, in which two systems come together to protect the privacy and intimacy of workers. In a way, this harmonises the employer’s directive authority (CLT, Article 2), the employee’s self- determination and fundamental rights, including the protection and control of their personal data. The monitoring of employees (considered work moni - toring) is permitted under the legislation and by the courts, but without exaggeration, with reasonable pru - dence and with specific criteria, including: • transparency for the data subject. 4.3 Employment Privacy Law • background checks: only in exceptional situations, where the nature of the function or the level of trust requires it; • BYOD (Bring Your Own Device); • control of working hours: monitoring must respect private life; • candidate data: collect only those strictly neces - sary for the vacancy; • specific and explicit purpose: monitoring must not be generic; • limited to the professional context: monitoring must not extend to personal or family matters;
• work tools: monitoring can include professional tools; and • transparency. 4.4 Data Protection in M&A In an M&A scenario, attention to personal data and to the privacy and intimacy of individuals must be rigorous and absolute. The risks increase, and the possibility of a security incident increases as negotiations pro - gress. In addition, commercial and industrial secrets, in general associated with individual developers and inventors, whose data may be in evidence, are at stake. In this context, some requirements are non-negotia - ble, including the following. • Legal basis: avoid diffuse bases, including for shar - ing. • Purpose of the processing of personal data: must be precise, objective, explicit (non-generic) and transparent. • Mapping and stratification of risks in the target (company). In due diligence, the following practices should be observed. • Cautious sharing: minimised the exchange of documents with personal data. • Use of anonymised or aggregated information whenever possible. • Secure virtual data room (VDR): data transfers must take place in secure digital environments, with access control, encryption, and audit logs. • Confidentiality agreements (NDAs) must include data protection clauses, holding the parties responsible for their improper handling. On the change of control and signing, the following applies. • R&W (representations and warranties): purchase and sale agreements (SPAs) must have represen - tations and warranties confirming that the target company follows the LGPD. • Risks and indemnities: due diligence can reveal data liabilities, which leads to adjustments in the
22 CHAMBERS.COM
Powered by FlippingBook