Violations of the LGPD by public authorities

The website Legal Consultant published an article written by Dr. Matheus Puppe, partner in the TMT, Privacy & Data Protection area at Maneira Advogados, which deals with violations of the General Data Protection Law by public authorities.

Violations of the LGPD by public authorities

March 17, 2023

By Matheus Puppe

To what extent is the legal basis for protecting the public interest in the LGPD?

A recent case leads us to question the limits of the legal basis of public interest in the General Data Protection Law by State representatives.

The fact is that the LGPD protects the data of individuals, regardless of their profession or position.

It was recently revealed by Folha de S.Paulothat Ricardo Pereira Feitosa copied confidential tax information from Eduardo Gussem, former attorney general of Rio de Janeiro, and two allies who later broke with Jair Bolsonaro: businessman Paulo Marinho and former minister Gustavo Bebianno.

At the time, Feitosa held the position of general coordinator of research and investigation at the Federal Revenue Service and accessed the documents during the first year of President Bolsonaro's administration.

The former attorney Gussem, for example, who was conducting investigations into the alleged “rachadinhas” scheme, in the office of senator Flávio Bolsonaro, had his documents accessed by Feitosa, who, among other personal information, accessed complete Income Tax declarations and made a copy of the information declared by him over seven years.

Based on the criminal repercussions that such access entails, the LGPD has a legal basis for accessing personal documents in the name of the public interest, as per article 7, item III of the law, but it must be interpreted in line with legal principles, in particular the purpose, the necessity, the adequacy and the transparency, which were clearly not present.

In general, public authorities have a duty to protect the public interest and may have the right to access personal information if this is necessary to fulfill their public functions, however, without violating the rights of data subjects, which through the Constitutional Amendment 115/2022, became a Constitutional right.

It is important to emphasize that access to personal information must be done in a legal and proportionate manner, and in accordance with the fundamental rights of these individuals, including the right to privacy. Certain that the improper disclosure of personal information can result in serious consequences for the people involved and can be considered a violation of personal data protection laws, both Brazilian and international, the damage caused by this access could be irreparable.

It can be argued, for example, that in some instance such data fell within article 4, item III, where the law would not apply to the processing of personal data carried out for the exclusive purposes of public security, national defense, state security, or investigation and prosecution of criminal offenses, which is certainly not the case, since there was supposedly no formal investigation in progress against the holders of the improperly treated data, much less hypotheses of national security.

In what happened, it appears that there was in fact a gross violation of the LGPD, leaving us to define whether it was the act of an individual carrying out the processing, usurping their state functions, for apparently personal objectives, and in this way it must be sanctioned directly (since a “controller” can be a natural or legal person) or is the State acting in clear excess of its functions, in a way that it had violated its own law and the constitutional right of a data subject, and as such, must answer for the violation of the law and be held responsible in addition to accountability.

Therefore, it is essential that public authorities act with transparency and clear and reasonable legal justification when accessing personal documents in the name of the public interest, in order to guarantee adequate protection of the fundamental rights of individuals and it remains for the ANPD to take the necessary measures to investigate and eventually apply the law to those involved in this clear violation.

Matheus Puppe is a partner in the TMT, Privacy & Data Protection area at Maneira Advogados, member of the CNJ Compliance GT and the Judiciary Integrity Committee (CINT) and guest professor at the postgraduate course in New Technologies, Compliance, ESG and Contracts at the University of São Paulo (USP).

Legal Consultant Magazine, March 17, 2023

https://www.conjur.com.br/2023-mar-17/matheus-puppe-violacoes-lgpd-autoridade-publica