As its own name indicates, the General Personal Data Protection Law (LGPD) has as its main concern the regulation of the way in which personal data is processed, with the intention of protecting the fundamental rights of their owner.
Therefore, so that it is possible to adequately evaluate the reach and relevance of the LGPD, as well as the measures needed for the adaptation to its dispositions, it is of the utmost importance to understand what exactly the legislation understands as personal data.
The LGPD, in its Article 5, Item I, defines as personal data the “information related to an identified or identifiable individual”.
That is, personal data is all information that identifies or may lead to the identification of an individual, whether separately or in conjunction with other information.
As can be seen, the legislation adopted an expansionist definition for the concept of personal data, as it seeks to extend, and not restrict, the scope of the definition regarding which kind of information would be considered as personal data, following the example of the personal data protection rules of several other countries, such as Canada and Argentina, and of various international organizations, such as the OECD and the European Union.
That means that, potentially, any information regarding an individual may be classified as personal data, depending on the context in which its processing is done.
Besides, the law also gives special treatment to some types of personal data, which it considers sensitive, being considered as such personal data “about racial or ethnic origin, religious conviction, political opinion, enrolment with an union or an organization of religious, philosophical or political character, data regarding the health or the sexual life, genetic or biometric data, when linked to an individual”.
To such data special protection is given, whether by means of a larger restriction to the hypotheses in which their processing is permitted without the express consent of their owner, whether by means of the express provision in the legislation of the need to consider the sensitivity of the processed data as a factor that must be observed in the drafting of good practice and governance regarding the treatment of personal data.
At last, we must also mention anonymized data, which consist on the data related “to an owner that may not be identified, considering the use of reasonable technical means available on the occasion of its processing”, which, being anonymized in a way that does not permit the reversion of the anonymization, stop being considered personal data.
In face of that, it is clear that people, whether individuals or corporate entities, that do any form of data processing (subject that will be discussed in our next article) need to seek information regarding the General Personal Data Protection Law, so that they may correctly identify the classification of the processed data and, with the help of professionals with the adequate technical knowledge, adopt the measures needed for their adjustment to the law.
News
Articles
Cases
