When it comes to data protection, Brazil is still taking the first steps. However, they are firm and very important steps. If we were to compare the legislation to a child, in the coming days we would have a party, cake and brigadeiro: on September 18th it completes four years of the validity of the General Data Protection Law, the LGPD (Law 13,709/2018).
Only four letters, but which brought so many positive impacts (by the way! In recent years, the theme “data protection has gained relevance in Brazil and has been discussed in the media, in the corporate environment and among society in general. However, in many countries, information security is a present reality even before the internet is consolidated as a tool for work and entertainment.
That is, Brazilian thinking, individual and corporate, is still in its infancy, while the European already enjoys the maturity of this culture. Not least because, in 1981, in Europe, the International Data Protection Treaty was born, a document that later became the basis for other regulations.
It is already four years since the LGPD in Brazil and a portion of companies have been after the tools necessary to comply with the law and avoid liabilities and problems when it comes to data protection. Before that, however, the vast majority ignored the subject and had no established policies that would provide an acceptable level of security to personal information.
However, even after so much debate and so many negative episodes, there is still a significant number of corporations that have not implemented any technical and administrative measures, such as security policy to adapt to the LGPD. Opted to take risks, neglecting their database and their customer portfolio. A survey of the Daryus Group showed that 80% of Brazilian companies are not yet fully adequate to the LGPD 35% claimed to be partially adequate and 24% in the initial phase of adequacy.
The National Data Protection Authority (ANPD), the authority responsible for regulating, supervising and applying the provisions of legislation related to the protection of personal data, is active and attentive to the arbitrariness committed against data subjects. Contrary to what was thought until recently, the internet is not a land without law.
In many cases, what drives organizations to establish a data protection structure is the fear of penalties and sanctions provided for in the LGPD, as well as to meet contractual requirements. However, what should drive companies is the commitment to the safety of their customers and employees, not just the legislation. In addition, information is extremely valuable to companies. It is through them that the habits and way of consumption of their customers are known, enabling them to anticipate offers of services and products or even correct strategies.
While people begin to understand that protecting their personal data is a right provided by law, criminals take advantage of vulnerabilities in companies and systems to steal this information, since data is worth a lot of money in the underground market. A survey by Cybersecurity Venture pointed out that cybercrimes should cause estimated losses of about US$ 10.5 trillion annually by 2025.