The General Personal Data Protection Law (LGPD) completes seven years in Brazil in a context in which data protection already impacts sectors of the economy in several aspects, transforming the way personal data is treated. At the same time, the milestone established a new era of governance, security and transparency in the handling of personal information.
“More than a normative instrument, the LGPD consolidated a new level of privacy protection in Brazil, directly influencing corporate strategies and society's awareness of the use of personal data”, says Carla do Couto Hellu Battilana, partner in the Cybersecurity & Data Privacy area at TozziniFreire Advogados.
Since the LGPD was published, we have had several changes in the way the issue of data protection is viewed in Brazil. Among the most significant milestones in the last 7 years is Constitutional Amendment No. 115/2022, which recognized the protection of personal data as a fundamental right, alongside guarantees such as freedom of expression and human dignity. “This recognition brought more legal security to citizens and companies, in addition to shielding the legislation from setbacks”, explains Battilana.
Another advance was the maturity in the application of legitimate interest as a legal basis for data processing, which now includes additional clarifications in the Guide published by the National Data Protection Authority (ANPD). “By establishing clearer parameters, the ANPD contributed to balancing the needs of companies with the preservation of the rights of holders,” said Battilana.
The regulation of international data transfer marked another important step. Resolution CD/ANPD No. 19/2024 established specific rules for standard contractual clauses and technical security measures. “Today, companies rely on a series of rules to ensure that data remains protected, regardless of the country of destination”, emphasizes Battilana.
According to Battilana, the inspection and application of sanctions by the ANPD have become more frequent and structured, especially after Resolution CD/ANPD nº 4/2023, which defined criteria for the dosimetry of penalties. “The more active presence of the authority is increasing the maturity of organizations and the effectiveness of the law.”
The publication of CD/ANPD Statement nº 1/2023 relaxed the requirement for consent as a legal basis for the processing of data from children and adolescents, as long as the principle of the best interests of the minor is respected. “The change does not reduce protection, but offers legitimate alternatives in cases where consent is not the most appropriate path,” says Battilana.
In the field of technology, ANPD has gained prominence in discussions about artificial intelligence, by launching a sandbox regulatory framework and actively participate in debates on Bill No. 2,338/2023, which could make her the national AI governance coordinator. “The intersection between AI and data protection is inevitable and requires increased attention so that innovation goes hand in hand with security and privacy”, assesses Battilana.
With advances in data protection, awareness about cyber risks and the importance of incident reporting are increasing in the country, a fundamental measure to mitigate damage. Resolution CD/ANPD No. 1/2024 also helped by establishing clear protocols so that companies can communicate incidents to the authority and data subjects.
"Looking at the future of LGPD means following trends such as the advancement of artificial intelligence, the integration of international data protection standards and the sophistication of cyber threats. A constantly evolving scenario that requires updating and commitment from all agents involved", emphasizes Battilana.
