More than 100 days after the General Data Protection Law (LGPD) came into effect, many business owners have not yet given it the proper attention and value that the regulation demands.
The law, which took effect on September 18, 2020, brings significant repercussions for the national market across a wide range of activities, making it essential that companies make the necessary adjustments to their day-to-day internal procedures and processes.
It is well known that this lack of attention stems mainly from the fact that the regulatory agency responsible for setting guidelines on the law's applicability has not yet been established. The National Data Protection Authority (ANPD) will be responsible for safeguarding citizens' rights, with the autonomy to ensure compliance with LGPD and serving as a link with the Federal Government.
Furthermore, another key point of the law concerns the application of fines for violations of its articles. The fines, which range from 2% up to R$ 50.000.000,00 (fifty million reais) per infraction, will only take effect, according to the legislative text, as of August 1, 2021, which, to some extent, gives business owners a sense of reassurance and the feeling that there is still time to make the necessary adjustments without imminent risk to the business.
However, "all that glitters is not gold," as the common saying goes. Some public administration bodies are already using the new legislation to penalize companies that are failing to comply with LGPD, particularly PROCONS and the Judiciary.
The first of these cases to gain national attention involves a well-established construction company, fined R$ 10.000,00 (ten thousand reais) for moral damages after sharing its client's data with several companies, which then approached that person in an unauthorized manner in an attempt to sell goods and services. In this case, the judge who rendered the ruling specifically cited art. 2º of LGPD, which states that the "foundations of data protection discipline include, among others, respect for privacy, informational self-determination, the inviolability of intimacy, honor and image, consumer protection, human rights, the free development of personality and dignity." In the judge's understanding, there was no authorization for the use of the data provided by the client beyond the construction company's own registration, which made the transfer abusive.
From another perspective, the Judiciary of the Federal District ruled to suspend the sale of consumers' personal data by Serasa Experian. The organization was freely trading significant personal data, such as names, addresses, CPF numbers, phone numbers, and email addresses, collected without authorization, at a price of R$ 0,98 (ninety-eight centavos) per registered individual. According to the ruling, the sale of such data directly violates the legislation, since data subjects are guaranteed control over the circulation and use of their information.
Therefore, although the penalties specifically provided for in the legislation are not yet being applied, there is no guarantee that the consequences of its enforcement will not affect those who have not prepared for this new reality.
In the midst of all this, we are still facing the COVID-19 pandemic, navigating new scenarios created by employees adapting to the home-office environment, which makes it even more difficult to maintain control over the confidentiality of data handled by professionals across a wide range of fields.
Swift and necessary compliance with current legal standards will benefit those who understand that it is essential to protect not only the privacy and data of clients, but also of employees and business partners, whether in an online or offline environment, enhancing the company's reputation in the market.
It is important to observe the particularities of each company and to understand that the law is broad and requires careful attention not only in information technology departments. Its application is also critical in other areas, such as marketing, human resources, legal, finance and administration. Being prepared will make all the difference.
By Edson Berwanger, lawyer and consultant, partner at Advisor.Tips
