The year 2021 is already being marked by the strong performance of our National Data Protection Authority (ANPD), which has also structured its priorities for the regulation of the General Law on Personal Data Protection - LGPD, in a phased manner, through a Regulatory Agenda¹for the 2021-2022 biennium.
Among the various topics contemplated in this Agenda, we highlight those whose regulatory processes have already been initiated:
- Security incidents: a Grant Taking stage was initiated² and other details were explained in the recently published Technical Note 3/2021/CGN/ANPD³.
This stage will involve consulting economic agents, consumers and stakeholders on the topic to gather information to assist the regulatory process, so that, in the end, the ANPD will be able to weigh and establish a distinction between a trivial security incident and one that actually creates risks or causes relevant damage, bring possible risk classifications of the incident, and also set a deadline for companies to inform the ANPD and the holders of personal data about data leaks - in the European Union, the deadline is three days, but the LGPD only requires that it be done without delay.
The ANPD itself has also made available on its website, for assistance while this regulation process is not completed, a form for communicating personal data security incidents for submission to the Authority and a document that provides guidelines on what should be done and observed when there is an incident4.
- LGPD application for microenterprises, small businesses, startups and individuals: the ANPD has also started the Grant Takingprocess5 This year, as published in Technical Note no. 1/2021/CGN/ANPD.The LGPD provides for the ANPD to carry out the edition of simplified and differentiated rules, guidelines and procedures for these categories. The ANPD's grant-making will serve to weigh two fundamental points: the guarantee of the rights and protections granted to the holders of personal data in the LGPD vis-à-vis the specificities of the size and limitations of such data processing agents, which requires a simplification in the requirements for adaptation to the LGPD.As a result, it will seek to identify regulatory alternatives that guarantee such rights and, in parallel, maintain a balance between the rules contained in the LGPD and the size of the data processing agent, always seeking to encourage innovation and economic development of these categories.
Other issues pending regulation that will be addressed this year according to the Regulatory Agenda are the criteria for the application of fines and penalties and the regulation of the Personal Data Protection Impact Report, which, according to the LGPD, may be required of the authority for activities of greater risk to privacy. In 2022, the ANPD's priority will be to regulate the international transfer of personal data and the requirements and responsibilities of the Data Protection Officer (also called "DPO" or "Data Protection Officer"), and in the second half of the year, it will address the rights granted by the LGPD and the regulation in detail of the legal bases for the processing of personal data.
The ANPD's continuous and prompt action in regulating the LGPD is essential, given the range of relevant topics for its application that still await definitions and additional rules for its application in a uniform and consistent manner.
We are following the developments and evolution of this regulation to keep our legal practice up to date and will bring news to our clients through our newsletter
Karin Klempp Franco, PHD, LL.M., CIPP/E
Luiz Fernando Plastino Andrade, CIPP/E, CIPM
Mahyra Milani
[1] https://www.gov.br/anpd/pt-br/assuntos/noticias/ainda-na-semana-internacional-da-protecao-de-dados-anpd-inicia-tomada-de-subsidios-sobre-microempresa
1] Ordinance No. 11/2021, available at: https://www.in.gov.br/en/web/dou/-/portaria-n-11-de-27-de-janeiro-de-2021-301143313
[2] Available at https://www.gov.br/anpd/pt-br/assuntos/noticias/anpd-inicia-processo-de-regulamentacao-sobre-incidentes-de-seguranca-com-tomada-de-subsidios
3] Technical Note No. 3/2021/CGN/ANPD, available at: https://www.gov.br/anpd/pt-br/documentos-e-imagens/sei_00261-000098_2021_67-nt-ts-incidente.pdf
[4] Available at: https://www.gov.br/anpd/pt-br/assuntos/incidente-de-seguranca
[5] https://www.gov.br/anpd/pt-br/assuntos/noticias/ainda-na-semana-internacional-da-protecao-de-dados-anpd-inicia-tomada-de-subsidios-sobre-microempresa
