Government authorizes Serpro to sell personal data of companies and citizens

Report from Canaltech shows that the federal government authorized Serpro (Federal Data Processing Service) to sell personal data and company records to third parties. Dr. Matheus Puppe, partner in the TMT area at Maneira Advogados and specialist in data protection, was heard to comment on the topic.

Government authorizes Serpro to sell personal data of companies and citizens

By Felipe Demartini | Edited by Claudio Yuge | April 20, 2022

This week, the government authorized the Federal Data Processing Service (Serpro) to sell personal data and records of Brazilian companies to third parties, as a way of reimbursing infrastructure expenses and improving information sharing with society. The ordinance on the subject was published this Tuesday (19) by the Ministry of Economy and the Special Secretariat of the Receita Federal.

The letter authorizing the sale of data contains a list of what can be sold, including CPF, full names, dates of birth and registration status of individuals. In the case of companies, in addition to data that is already public, such as CNPJ, addresses and more, there is also other personal information from their owners and partners, such as negative debt certificates, passports, merchandise indicators and invoices, which can also contain addresses and other entries related to recipients not related to the company, but involved in a buying and selling process.

The government's idea is to allow companies to have direct access to the Serpro database, or else for such data to be made available in exchange for amounts that can be invested in infrastructure. It is also a way to monetize the operation of the state-owned company, which is part of the National Privatization Plan of the Ministry of Economy, but could not be included in the negotiations this year, which is electoral.

While some contrary reactions were immediate, the government states, in the ordinance itself, that data sharing is legal and follows the rules of the General Data Protection Law (LGPD). According to the Federal Revenue, the information would be released to interested parties in a controlled manner, with specific requests for each set of data and controls regarding compliance with standards and contracts between companies and Serpro.

Matheus Puppe, partner in the privacy and data protection area at Maneira Advogados, points out that this week's ordinance updates another, published in 2016, which already provided for third-party access to Serpro information. According to the expert, the new authorization adapts this use of information to the General Data Protection Law and authorizes the sector to fulfill its role in accordance with the new standards.

“We must think of the LGPD as an additional layer of protection and not as a barrier to the development of business and public policies”, explains the lawyer. “Despite the initial recipe brought by the words ‘sharing data with third parties’, the ordinance demonstrates the efforts of the Public Authorities to comply with its own laws and continue performing its social functions.”

Opposite reaction in the Chamber of Deputies

Also this Tuesday (19), deputy André Figueiredo (PDT-CE) filed a draft legislative decree in the Chamber, in an attempt to block the effects of the ordinance published by the Ministry of Economy. He, who is against the privatizations of the state-owned company and also of Dataprev, another public administration data processing body focused on social security, states that monetization exorbitates the government's power over data and lacks transparency.

For the deputy, the Federal Revenue initiative also goes against the Federal Constitution by removing from citizens the power to control their own information, which can be passed on without consent to third parties. The result, it states, would be the unauthorized manipulation, loss and disclosure of personal information in an unauthorized manner, a constant seed of phishing attacks and scam attempts against citizens.

“One of the main effects on the population is the fact that [the ordinance] allows access to third parties, crossing between different bases or publicizing personal data, opening the door for access and misuse”, explains Márcio Chaves, partner in the digital law area at Almeida Advogados. In his view, the danger is related to transfers carried out in an unsafe manner, excessive collection and misuse.

Source: Federal Government, Capital Digital

https://canaltech.com.br/governo/governo-autoriza-serpro-a-vender-dados-pessoais-de-empresas-e-cidadaos-214486/