Brazilian Data Protection Authority publishes its 2023-2024 Regulatory Agenda

On November 8, 2022, the Brazilian Data Protection Authority (“Authority”) published its 2023-2024 Regulatory Agenda (“Current Agenda”), establishing high-priority topics over the next two years. The Agenda reflects societal input received during this year, as well as topics deemed important for study and/or regulation.

Unlike the 2021-2022 Agenda (“Past Agenda”), the Current Agenda’s initiatives are divided into 4 (four) phases, in order of priority:

• Phase 1: Matters for which the regulatory process (“Process”) began during the Past Agenda;
• Phase 2: Matters for which the Process will begin within 1 year;
• Phase 3: Matters for which the Process will begin within eighteen months; and
• Phase 4: Matters for which the Process will begin within 2 years.

Following public hearings held in August 2022, the Authority categorized the following matters as most relevant:

1. Regulation of dosimetry and application of administrative sanctions;
2. Data subjects’ rights;
3. Communication of incidents and specification of the notification deadline;
4. International transfer of personal data;
5. Data Protection Impact Assessment;
6. Data Protection Officer;
7. Legal basis for processing personal data;
8. Definition of high-risk and large-scale;
9. Sensitive data regarding religious organizations;
10. Use of personal data for academic purposes and for studies by research organizations;
11. Anonymization and Pseudonymization;
12. Regulation of the provisions of art. 62 of the Brazilian General Personal Data Protection Law;
13. Data sharing by public authorities;
14. Processing minors’ data;
15. Guidelines for the National Policy on Personal Data Protection and Privacy;
16. Regulation of criteria for recognizing and disclosing rules on good practices and governance;
17. Sensitive data regarding biometric data;
18. Security, technical and administrative measures;
19. Artificial Intelligence; and
20. The Conduct Adjustment Agreement.

As compared to the Past Agenda’s ten topics, the Current Agenda covers many more initiatives.

With publication of the Current Agenda, the Authority will assume the task of completing work already begun, while embarking on new topics.

Dosimetry regulation and administrative penalties stand out among matters noted, having been the subject of public hearings in August and September 2022. Regulations on both topics are currently in their final stages of preparation.

Inclusion of matters such as biometric data and artificial intelligence also demonstrates the importance of personal data-related issues in the digital environment. Thus, publication of the Current Agenda evidences the Authority’s commitment to providing information, while also promoting legal certainty in the relationship with regulated agents.

Our Digital Law team continues to follow all related developments and may be reached at digital@kasznarleonardos.com.