ANPD points out conflicts and overlaps between AI PL and LGPD

Report from the website TeleSíntese showed the analysis carried out by the National Data Protection Authority on the proposal to regulate the use of artificial intelligence. The text features a comment from Dr. Matheus Puppe, partner at Maneira Advogados, on the subject.

ANPD points out conflicts and overlaps between AI PL and LGPD

EDUARDO VASCONCELOS
7 JULY 2023

(image credit: Freepik)

In analysis of the proposal that aims to establish legislation for Artificial Intelligence in the country, the municipality also says that the text needs to pay more attention to data protection in innovation environments and calls itself a “key authority” for technology regulation

The National Data Protection Authority (ANPD) released a preliminary analysis of the Bill (PL) 2338/2023, which provides for the use of Artificial Intelligence (AI) in the country. In the document, the authority emphasizes that the proposal has several points of convergence and conflict with the General Personal Data Protection Law (LGPD) and defends the creation of regulatory environments to promote responsible innovation.

In addition, the entity positions itself as a “key authority” in AI regulation, as highlighted by its president, Waldemar Gonçalves, in a webinar held on Thursday, 6, which included the participation of the PL rapporteur in the Senate, senator Eduardo Gomes (PL-TO).

Check out a summary of the main topics analyzed by the authority below.

Points of interaction between LGPD and PL 2338/2023

ANPD highlights that overlaps and conflicts between the PL and the LGPD need to be resolved. In the assessment of the authority, the proposal that aims to create legislation for AI in Brazil is correlated with the data protection standard, in particular with regard to the protection of rights, the classification of high-risk AI systems and governance mechanisms.

On the first point, the proposal guarantees the rights to information, explanation and contestation for people affected by AI systems. In this sense, the individual would have the right to request a review regarding automated decisions. According to the authority, such propositions are provided for in articles 9 and 20 of the LGPD. However, wording differences may cause conflicts.

“It is necessary, therefore, that legal compatibility is established by the PL, ensuring respect for the ANPD’s competences in regulating the topic that is already affected by it”, argues the entity.

In the case of the classification of excessive and high-risk AI systems, the authority emphasizes that the PL envisages evaluating technologies under development using personal data, such as those relating to the identification of holders and when there are expectations reasonable that anyone will be affected by the use of the data.

In addition, the ANPD points out that the governance mechanisms provided for in the PL (transparency, security, non-discrimination, among others) “dialogue directly with several provisions of the LGPD”. Therefore, he argues that, “whatever the AI supervisory authority, it must be aligned with the regulatory activities of the ANPD.”

Fostering innovation

Regarding the innovation environment, the ANPD shows support for the PL as it contains a specific section on the topic, highlighting that the project does not anticipate many rules, leaving it up to the competent supervisory authority to authorize the operation of sandboxes that meet the requirements outlined by law and future regulations.

However, the entity says that “it would be important for the PL to give greater emphasis to issues relating to data protection in AI sandboxes that process personal data”. In the authority's assessment, this will be quite common in several high-risk AI systems.

In its analysis of the bill, the authority says that the attributions defined for the authority responsible for applying the AI law “bear close similarities with the legal responsibilities of the ANPD”, especially with regard to the protection of fundamental rights and the nature of the data processed.

AI supervisory entity

Additionally, it reinforces that, according to the LGPD, the application of sanctions relating to the protection of personal data is the exclusive responsibility of the ANPD. In this way, its powers will prevail over those of other entities or public administration bodies when the case involves protection of personal data.

The authority, furthermore, maintains that it can “guarantee legal security and regulatory convergence” by being appointed as the entity responsible for regulating AI in the country. “In view of the strong synergy of the proposal presented in PL 2338/2023 with the topics covered in the LGPD, this Authority understands that it has a key role in the governance of AI and protection of personal data”, it states, in an excerpt from the document.

Lawyer Assessment

In the view of Luis Fernando Prado, partner at Prado Vidigal Advogados, the ANPD's analysis of the PL, in practice, formalizes the authority's position in relation to its claim to be the authority responsible for supervising AI issues in the country.

“In addition, the document reveals a series of overlaps and/or potential conflicts between PL 2338/2023 and the LGPD, reinforcing, in my opinion, the need to adopt caution – and not rush – in the legislative debate around AI regulation”, assesses Prado.

For Matheus Puppe, partner specializing in new technologies at Maneira Advogados, the ANPD report highlights the “urgency and complexity” of AI regulation. According to the lawyer, the entity shows that there is a need to balance robust protections for citizens and promotion of technological innovation.

However, Puppe highlights that the conflicting points between the project and the data protection standard need to be resolved. "Given the prior existence of the LGPD, it is crucial that any new legislation on AI is carefully harmonized with it, avoiding unnecessary conflicts or redundancies. The AI ​​law must reinforce the fundamental principles of the LGPD, including transparency, accountability and respect for the rights of data subjects", he opines.