Companies may be forced to disclose data leaks

Canaltech reported that a bill being processed in the Chamber of Deputies intends to force companies that suffered hacker attacks, which resulted in data leaks, to disclose the cases in the press, in order to make the information in these situations transparent. Dr. Matheus Puppe, partner in the TMT, Privacy & Data Protection area at Maneira Advogados, was interviewed to comment on the matter.

Companies may be forced to disclose data leaks

By Felipe Demartini | Edited by Wallace Moté

(Image: Surfshark)

A Bill could bring more transparency to security incidents involving data leaks in Brazil. PL 1876/23, under analysis in the Chamber of Deputies, wishes to force companies that have suffered attacks of this type to publicize the cases in the mainstream press and also on their social media pages and official websites.

The measure was authored by deputy Marcos Tavares (PDT-RJ) and would be included in the General Data Protection Law (LGPD). The public disclosure of security incidents would become an obligation alongside another already in force, which asks corporations to inform the National Data Protection Agency (ANPD) about information leaks within three days of detecting the attack.

In Tavares' view, the PL would change the current panorama, in which news reports the leaking and sale of Brazilian information on the dark web, without the users themselves knowing what information was compromised or when the incidents occurred. With the proposal, however, ususers could take measures to protect themselves and avoid losses.

The author also sees an increase in awareness and information about digital security as part of the large-scale outreach measure. Furthermore, the ANPD itself would also be strengthened, having access to more information quickly to take appropriate measures under data protection legislation.

“Inserting this measure in the LGPD can be considered a natural reinforcement of the legislation, further strengthening Brazil's commitment to data protection”, points out Matheus Puppe, partner in the TMT, Privacy and Data Protection area at Maneira Advogados. In his view, the increasing digitalization of society and the economy brings security challenges, with the PL addressing one of the main concerns in this regard.

On the other hand, the expert points out what is delimited in the Project, with disclosure being necessary only in cases where data compromise could lead to relevant risks or damages to data holders. In Puppe's view, this is a subjective concept that can open the door to different interpretations.

Bill 1876/23 is being analyzed by the Constitution and Justice, Citizenship and Communication committees of the Chamber of Deputies. There is no forecast for the end of the processing, voting and sanctioning, if the proposal is approved.

https://canaltech.com.br/governo/empresas-podem-ser-obrigadas-a-divulgar-vazamentos-de-dados-258108/