Personal Data – Managing it Properly

For those who are not yet aware, the General Data Protection Law – LGPD (Law No. 13.709/18) will become mandatory across Brazil in just over eight months, in August 2020. While the Brazilian LGPD faces some criticism regarding specific determinations or gaps, it will undoubtedly provide data subjects with the necessary empowerment to satisfy their fundamental rights in a simplified, free, and effective manner.

Cultural Change and Moral Progress

Beyond making necessary changes to internal processes and norms, this law will demand a change in behavior and culture, which is always more labor-intensive. It will be a challenging yet rewarding exercise; as organizations adopt a posture aligned with ethics and good governance, this will echo in human relations, potentially even improving privacy awareness within domestic environments.

However, we must weigh the fact that not everything will be considered a privacy violation. The law exists precisely to outline this field, indicating what is lawful and what is not.

Data: More Valuable Than Raw Material

Personal data has often been traded without commitment to the subject’s rights. Monetizing personal data is one of the most profitable businesses today. But this inadequate method of collecting data is nearing its end.

For a company, personal data is often more valuable than its raw materials. Consider a food industry that cannot meet demand: it can buy raw materials from third parties. However, if that same company is legally prohibited from processing its clients’ data, its production will sit idle in the warehouse.

Among the penalties in the LGPD are:

• Temporary blocking of personal data until the infraction is regularized.

• Deletion of the personal data related to the infraction.

These sanctions could potentially make the continuity of a business unfeasible.

The Path to Compliance

In this digital society, data traffic grows exponentially. Organizations must be prepared for this revolution. Precautions are vital: every action oriented by the LGPD must be recorded and documented as a safeguard before the supervisory authority. Furthermore, companies should avoid suppliers who cannot prove adherence to the law, as liability is shared.

The implementation of the LGPD rests on three pillars: Legal, Compliance, and Technology. If one is missing, the entire foundation will fail.