In 5 years, LGPD has a regulatory impact, but practical effect is doubtful

Report published on the website Legal Consultant addressed the impacts that the General Data Protection Law had on companies. The LGPD has just completed 5 years. To discuss the issue, the site heard from several experts on the subject, including Dr. Matheus Puppe, partner in the TMT, Privacy and Data Protection area at Maneira Advogados.

In 5 years, LGPD has regulatory impact, but practical effect is doubtful

August 14, 2023

By Danilo Vital

(Photo: Freepik)

Despite its bureaucratic nature and slow implementation, the five years of validity of the General Law for the Protection of Data (LGPD), completed this Monday (14/8), opened regulatory horizons in relation to the newest technologies. However, the practical impact of the standards on the day-to-day lives of companies and citizens is still doubtful, according to experts.

By modifying so many aspects of data processing in Brazil, the rule sanctioned on August 14, 2018 came into force, in part, in December of the same year, in relation to the section that regulates the National Data Protection Authority (ANPD) and the National Council for the Protection of Personal Data and Privacy.

The ANPD has the function of monitoring compliance with the LGPD and it was only structured in August 2020, with two years of delay. In 2022, the entity was transformed by law into a federal authority, granting administrative and financial autonomy, which, as published the ConJur, reinforced the data protection system in the country.

The rest of the law would come into force two years after its approval, in August 2020. The government tried to delay for May 2021, based on the Covid-19 epidemic. Finally, the Senate determined effective from September 2020, a measure confirmed by presidential sanction. The punishments came into effect, amid a totally unprepared market.

It was only in February 2023 that a regulation for dosimetry and application of administrative sanctions was defined by ANPD. The first punishment was recorded in July: warning and fine of R$ 14,400 against a micro-company for failure to indicate the person responsible for processing personal data.

Another relevant milestone was the promulgation of Constitutional Amendment 115/2022, which made the protection of personal data, including in digital media, a fundamental right. According to lawyers consulted by ConJur, this entire scenario has led to a cultural change, although there are doubts about its sufficiency so far.

Still needs to improve
In exclusive research carried out by the Business Law Yearbook, which will be released in November, lawyers from the legal departments of the largest companies in Brazil were interviewed regarding the adequacy of their companies to the LGPD. Although there is a majority perception of the high impact of the law (opinion of 59% of those interviewed), the number of executives who believe that the new rules had little or no impact on governance is relevant (38%).

For Juliana Regueira, from VBD Advogados, the concepts and mechanisms of the LGPD have not yet been understood, largely due to the lack of awareness about the value of personal data. People are not aware that, by providing their CPF to obtain a discount at a pharmacy, they are selling valuable information about their habits and preferences, illnesses and frequency of medication consumption at a modest price.

“Our society does not have a deep-rooted notion that personal data constitutes a precious asset for the individual, which protects their right to privacy, inviolability and, ultimately, their own dignity”, he states. “It is essential that there is digital education and cultural change in the way we relate to our personal data”, he adds.

Márcio Chaves, from Almeida Advogados, sees progress in the country on this topic as still very timid compared to all the potential that will develop in the coming years. Even the regulations still fall far short in defining important details of obligations. “Contrary to what many people think, the LGPD is still taking the first steps on a long journey, and its effects will still be felt for many years to come, something similar to what happened with the Consumer Protection Code, which has had such an impact on Brazil over the past 30 years”, he says.

Matheus Puppe, from Maneira Advogados, assesses that the LGPD brought a change of paradigms by requiring transparency and appropriate legal bases in the processing of data. But he criticized the delay in applying sanctions. For him, the challenge is to ensure that legislation continues to evolve. "This slowness in applying penalties can weaken the effectiveness of the LGPD, undermining citizens' trust and allowing violations to persist without due accountability. It is essential that the competent authorities speed up this process, ensuring that the law is not just symbolic."

“The LGPD and its respective enforcement [putting it into practice] surprises all the time”, points out Daniel Becker, from BBL Advogados. He cites the lightning-fast publication of the law and the vanguard of the Judiciary in its application in consumer and labor relations. “We hope that in the next five years, with the galloping maturity of the ANPD, there will be even more predictability and security when it comes to privacy.”

The LGPD has already caught on
Other experts consulted by ConJur preferred to highlight the advances identified. In the view of Bruno Beserra Mota, from Eduardo Ferrão Advogados Associados, the standard has been very well understood and complied with by the vast majority of companies and agents that process data. “We hope that this compliance will advance in the coming years, as this is an essential standard”, he states.

Bruno Guerra de Azevedo defines the first five years since the approval of the LGPD as the beginning of a cultural change on the part of market players. "Today, when contracting services that involve the processing of personal data, one of the main clauses of the contract and which generates enormous debate between the parties are precisely those relating to the security and operations of processing personal data. In particular, those that define the divisions of responsibility between the contractors and the third parties involved."

In the same vein, Eduardo Maciel, from MFBD Advogados, states that the LGPD “has already caught on”. With the definition of what types of sanctions can be imposed, now is the time for greater oversight and consequent application of the law. “We are going to enter a new phase of applying legislation and it will be cheaper to adjust to it than to expose ourselves to the risks of illegality”, he predicts.

For Antonielle Freitas, from Viseu Advogados, the impact on the data protection culture in Brazil caused by the LGPD led all segments of society to review and reformulate their collection, use and storage practices. “This commitment not only ensured legal compliance, but also cultivated greater trust between the parties involved, promoting transparent and lasting relationships.”

“In recent years, we have been able to witness a true cultural revolution in terms of data protection in the business sphere. The attention and investments that the topic has attracted among companies is unprecedented”, says Luis Fernando Prado, from Prado Vidigal Advogados, who defines the LGPD as fundamental for business, including to bring Brazil economically closer to the vast majority of developed countries.

New horizons
Shy or not, advances in the data protection ecosystem in Brazil have served to establish operational base structures, in addition to programs that meet the main legal requirements and guarantee aspects such as governance and security of personal data.

This experience, in the analysis of Pedro Iorio, from Artese Advogados, opened new regulatory horizons. “The last five years will certainly influence the reality of the next five years: also included in the rise of technologies, other relevant themes are already manifesting themselves in the Brazilian regulatory framework, such as the regulation of artificial intelligence and information security.”

For him, the LGPD is the prelude to considering the regulation associated with technologies in a more solid way. “This is a reality that is here to stay”, he warns. Luis Fernando Prado agrees, highlighting how the recent Brazilian experience can be beneficial in the near future.

“The same level of debate and caution that we had when regulating data protection, which included years of multisectoral discussion, should be used from now on with topics such as artificial intelligence, so that we can have balanced legislation in Brazil with massive adherence by regulated entities (companies receiving obligations to be established), which does not represent an unjustified barrier to innovation.”

For Laércio Sousa, from Velloza Advogados, the expanded use of artificial intelligence, blockchain and other emerging technologies only increases regulatory pressure. “Brazil’s ability to respond to these challenges, remaining faithful to the principles of the LGPD and the Constitution, will determine the future of data protection in the country.”

Danilo Vital is a correspondent for the magazine Consultor Jurídica in Brasília.

Magazine Legal Consultant

https://www.conjur.com.br/2023-ago-14/anos-lgpd-muda-cultura-abre-horizonte-regulatorio