In August 2024, the General Data Protection Law (LGPD) will complete six years since its enactment in Brazil. Since its entry into force, the LGPD has brought a series of significant changes for companies, institutions, and citizens, redefining how personal data is collected, stored, and processed in the country. In this article, we explore the main impacts and challenges faced over these six years.
Origin and Objectives of the LGPD
Inspired by the European Union's General Data Protection Regulation (GDPR), the LGPD (Law No. 13,709/2018) was enacted on August 14, 2018, and came into force in September 2020. Its main objective is to protect fundamental rights to freedom and privacy, as well as to ensure the protection of personal data. The law establishes clear guidelines on how data can be collected, processed, and shared, imposing obligations on both the public and private sectors.
Positive Impacts of LGPD
1. Greater Transparency and Control
One of the biggest advances brought about by the LGPD is the increased transparency and control individuals have over their personal data. Companies are required to clearly inform how data will be used and obtain explicit consent from data subjects. This strengthens trust between consumers and companies, promoting a more ethical and transparent business environment.
2. Improved Information Security
The LGPD encouraged organizations to adopt best information security practices to protect personal data against unauthorized access, leaks, and other threats. Implementing appropriate technical and administrative measures became essential to avoid penalties and reputational damage.
3. Promoting a Culture of Privacy
The law also contributed to the creation of a culture of privacy in Brazil. Companies of all sizes and sectors began investing in training and development for their employees to ensure compliance with regulations and the protection of personal data.
Challenges Faced
1. Suitability and Compliance
Compliance with the LGPD represented a significant challenge for many organizations, especially those without a robust data governance framework. The need to review processes, policies, and systems required significant financial and time investments, which was particularly challenging for small and medium-sized businesses.
2. Inspection and Law Enforcement
The National Data Protection Authority (ANPD), responsible for monitoring and ensuring compliance with the LGPD, has faced challenges in terms of structure and resources. The capacity for monitoring and imposing sanctions is still evolving, and there is a continued expectation for more assertive action from the ANPD.
3. Awareness and Education
Despite progress, awareness of the importance of personal data protection still needs to be increased. Many citizens and small businesses remain unaware of their rights and obligations under the LGPD, which may hinder the law's full implementation.
Future Perspectives
With the LGPD established as an essential regulatory framework for data protection in Brazil, the future points to continued evolution. The ANPD will likely intensify its oversight and guidance efforts, while companies will continue to improve their data governance practices. Furthermore, the legislation may undergo adjustments and updates to keep pace with technological and social changes.
Conclusion
Six years after its enactment, the LGPD has brought significant advances to personal data protection in Brazil, promoting greater transparency, security, and a culture of privacy. However, challenges remain, especially in terms of compliance, oversight, and awareness. As society and technology evolve, the LGPD will continue to play a crucial role in guaranteeing citizens' rights and promoting a safer and more ethical business environment.
